NEW: Learning electronics? Ask your questions on the new Electronics Questions & Answers site hosted by CircuitLab.
Project Help and Ideas » Hotel door opener
July 26, 2012 by virtual |
The door lock that's most commonly used in hotels around the world for card entry has been cracked. It's quite interesting because you can communicate with the lock over a single wire protocol - and open any door. It's a very interesting read as it's a nice combination of analysis, hardware and software. http://demoseen.com/bhpaper.html The guy build a proof of concept using an Arduino - which I think is cheating. I'm intending to have a bash at building one from the nerdkit this weekend. Thought others might be interested. If you build it - don't be naughty :) |
---|---|
July 26, 2012 by virtual |
There's also a presentation with some diagrams of the clock timings http://demoseen.com/bhtalk2.pdf |
July 27, 2012 by pcbolt |
virtual - Very interesting reading. I'm surprised the access port is that accessible, why not just put a locked panel around it. Good luck with your project, hope you post some results...just don't go framing any poor chambermaids for murder :-) Although this post wanders precariously close to "black hat" territory (which I believe is frowned upon here) the content is MCU related and relevant in that respect. |
July 30, 2012 by virtual |
So i've taken the Ardunio sketch and converted it to plain C to use with the nerdkits libs - although all i've really used is the delay headers. The rest is just converted from the code in the above link. Setup your atmega as if you're just going to drive a flashing LED off of PC4 and attach a barrel connector between there and ground. I've yet to try this on a door - but i'm away in a few weeks so i'll take the laptop + electronics to do a bit of testing (on my own door of course). Here's the code.
|
July 31, 2012 by virtual |
found a bug - due to lack of program space i need to shift this stuff into rom so just add the PROGMEM attribute - otherwise the code wont run.
|
July 31, 2012 by pcbolt |
virtual - Looks like you are storing 1-bit values in 8-bit memory locations and losing a great deal of memory. If you consolidate each 8-bit sequence into a single hex number, you can store much more data. Then all you need to do is a little bitwise arithmetic to extract the bit values. If you have an array of say 18 bytes which contain all your bit sequences, you can extract them like this:
|
July 31, 2012 by virtual |
Thanks for the advice - that sounds like a much better idea! I'll get started on that just now :) |
August 02, 2012 by virtual |
So i've updated the code as suggested plus done a bit of testing and a tidy up. New code is below. I've built a little test harness + programmer with a ftdi um232r module to handle programming without the bootloader plus using the uart to talk back to the pc for debug messages. Here's a little photo of it - http://i.imgur.com/bUzs1.jpg - i'm afraid it's not very neat at the moment so don't cringe too much - the voltage reg is off to the side so i can run the circuit when i'm not using power from the usb - uart bridge. I'll draw a schematic if anyone is that interested. I've run tests via debugging and i'm fairly happy that the code works - the only thing will be adjusting the delays. The original author of the paper used the delays i've used but he was using an arduino based on a atmega128. I need to get myself a door lock to play with - there's one on ebay that i'm hoping to get :)
|
August 02, 2012 by pcbolt |
virtual - Wow. Looks like you're really sinking your teeth into this project. One thing in the code looks odd to me (lines 185-189):
Should the "if/else if" statements compare to "j" instead of "i"? Just curious. I'd be very interested to see your results when you interface with the door lock. |
August 02, 2012 by virtual |
Hey pcbolt - I'm somewhat obsessive I'm afraid. Thanks for taking time to read the code - proof that code reviews do work - you're absolutely right! |
August 03, 2012 by virtual |
Btw - i have an appropriate onity door lock on the way. Its coming from the US to me in the UK so it might be a week or two before i can really test. I'll post again once I've got something to show for it. Pcbolt - thanks again for the help. |
August 10, 2012 by virtual |
Ok - I have the lock and after a little playing around with a logic probe and chatting to the guy who wrote the paper i have a working version. I shall do a proper write up later with some pics and and a diagram + code. |
August 10, 2012 by virtual |
Lock + circuit http://imgur.com/a/yr5pB#0 Little video of it actually working http://youtu.be/2SrUaGBBvF8 Code http://pastebin.com/U5HJMWg9 One of the comments in the code is a bit wrong. It's not being driven of PC4 any more, it's PD3 due to needing to be able to detect the falling edge of the interrupt. This was done with a blank ATMega168 that I programmed with my own circuit but it should work just fine with the nerdkits bootloader. I intend to give it a try tomorrow - it's a bit late here now. It's quite shocking that you can read the memory of a hotel door lock via an easily accessible connector - even more shocking that the key to the lock is essentially stored unencrypted in memory. |
August 11, 2012 by Ralphxyz |
Yeah but can you access it from a card reader? If one has access to the guts of a lock it is not surprising that it's security can be bypassed. Never the less this is a very intriguing project but I'd like to see what you can do with a installed lock with just the card reader. Which I can imagine might be doable especially after your demonstration of how relatively easy it is when you have access to the internals. Then of course I want to use a non contact scanner. Ralph |
August 11, 2012 by virtual |
There's a barrel connector on the bottom of the lock. Accessible to all. No special access required! i can walk up to an installed lock an open it in 200us :-o I can however create a card to access any lock but that's also based on another persons research. |
Please log in to post a reply.
Did you know that you can use printf and scanf functions to talk to your computer from your USB NerdKit? Learn more...
|