Unsaflok and the MIFARE backdoor: hotel keycards cloned in minutes

The summer of 2024 dealt hotel keycards two separate blows. The Unsaflok research project, disclosed in March and presented at DEF CON 32 in August, showed a technique that opened any door in a property running Dormakaba Saflok locks, an installed base of 3 million doors across 13,000 properties in 131 countries. Weeks later, the French lab Quarkslab published hardware backdoors in MIFARE Classic contactless cards, the RFID (radio-frequency identification) technology behind many of those very locks. For guests, the physical security of a room rested on an object a stranger could reproduce. For operators, the cleanup is measured in years.

Unsaflok, the facts

The work belongs to Lennert Wouters, a hardware security researcher at KU Leuven's COSIC group, and Ian Carroll, an independent researcher who founded the travel site Seats.aero, together with a wider team. Research began in August 2022 during a bug bounty event run by Las Vegas hotels and casinos alongside DEF CON 30. The group reported the flaws to Dormakaba in September 2022, shared full technical details in November 2022, and held at least thirteen meetings with the vendor before the coordinated disclosure of March 2024. The first hotels were remediated starting November 2023, and as of the disclosure roughly 36% of affected locks had been updated or replaced, a figure the researchers still cited in August 2024. The most common models, Saflok MT and RT Plus, sit on a large share of those fleets.

The mechanism, read from the defense side

The principle, as the researchers and Wired described it publicly, fits in a few sentences and reads cleanly in defensive terms. The attack touches none of the hotel's IT systems. It starts with reading a single keycard from the target property, even an expired card tossed in an express-checkout box. With a roughly $300 RFID reader-writer, an attacker produces a pair of forged cards: the first rewrites one data area of the lock, the second opens it, and the same pair works on every door in the property. "Two quick taps and we open the door," Wouters said.

Three properties of the flaw define the risk for an operator. First, it combines the known weaknesses of the MIFARE Classic protocol with a Dormakaba-specific key derivation function; the DEF CON 32 slides conclude the system had been vulnerable since 1988, because the earlier magnetic-stripe cards carried the same data format. Second, these locks work offline, with no real-time log at the front desk: a door opened by a forged card alerts nothing and no one. Third, the in-room deadbolt offers no extra protection, because it is controlled by the keycard lock and can be retracted by a malicious card. The researchers say only an independent mechanical device, a chain lock, still deters entry. Dormakaba told Wired it was not aware of any use of the technique in the wild. That is a vendor statement, unverifiable from outside, and the researchers answer that silence is not proof: "We think the vulnerability has been there for a long time. It's unlikely that we are the first to find this."

The MIFARE backdoor

In August 2024, Quarkslab researcher Philippe Teuwen published, alongside the IACR ePrint 2024/1275 paper, a discovery of a different and blunter kind. Fuzzing the FM11RF08S chip from Shanghai Fudan Microelectronics, a "MIFARE Classic compatible" variant released in 2020 and marketed as resistant to known attacks, he found a hardware backdoor that authenticates with an unknown key. Worse, the backdoor's secret key is common to every FM11RF08S card in existence. With that key, a few minutes of physical proximity to a card compromise all its internal keys, even properly diversified ones, and allow cloning it. A similar backdoor, protected by another key that also turned out to be shared, was found in the previous FM11RF08 generation, on cards dating back to at least November 2007, and even in older NXP and Infineon chips. Quarkslab found these cards in numerous hotels across the US, Europe and India, often without the property's knowledge, since the badge itself does not reveal the chip's true origin. Teuwen also noted that an entity positioned in the supply chain could run these attacks instantaneously and at scale, and that the MIFARE Classic protocol remains, in his words, "intrinsically broken" regardless of the card.

Patch, detect, coexist

Remediating a Saflok fleet is heavy work: every lock gets a software update or a replacement, every guest card is reissued, front desk software and card encoders are upgraded, and third-party integrations such as elevators, parking and payment systems may need extra work. For a guest who wants to check, the project site offers one clean signal: if the card handed over is a MIFARE Ultralight C rather than a MIFARE Classic, the hotel has probably completed the upgrade, a distinction anyone can verify with NXP's free NFC Taginfo app. Nothing visible on the lock itself separates a patched unit from a vulnerable one.

Two years after disclosure, the patched fleet remains a minority, and the Quarkslab findings widen the point beyond a single manufacturer: legacy contactless access cards are an inventory problem, chip provenance included. In the meantime, the researchers' advice for guests staying at an unpatched property still stands: throw the chain lock, do not trust the deadbolt alone, and leave nothing valuable in the room.