{"id":6288,"date":"2010-11-08T16:16:48","date_gmt":"2010-11-09T00:16:48","guid":{"rendered":"http:\/\/blogs.mcafee.com\/?p=6288"},"modified":"2025-06-02T20:49:36","modified_gmt":"2025-06-03T03:49:36","slug":"missing-hotel-room-key-try-your-phone","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/missing-hotel-room-key-try-your-phone\/","title":{"rendered":"Missing Hotel Room Key? Try Your Phone"},"content":{"rendered":"

If you are like me, there are times when you will misplace your hotel key. Times when you’re switching a bucket of ice between hands while searching your pockets or bag. Wondering if you’ve left the key in your room or possibly the lobby. Thinking “I’ve always got my phone on me, wouldn’t it be so much easier if I could use it to open the door.” OK, maybe I’ve never thought that last bit, but the folks at high-security lock makers Assa Abloy apparently have.\u00a0They’re running a four-month trial of their Mobile Key technology at the Clarion Hotel in Stockholm. Essentially a guest checks in with a phone and the room key is sent directly to the device. No more misplaced keys.<\/p>\n

The hotel trial is a joint effort among Choice Hotels Scandinavia, mobile carrier TeliaSonera, and near field communications (NFC)<\/a> vendor Venyon. NFC is an extension of the same technology used in “tap and pay” credit cards.<\/a> NFC turns your phone into a mobile wallet.\u00a0In this case, just tap your NFC-enabled phone next to the hotel door knob and it unlocks.<\/p>\n

\"\"<\/a>
Just hold your mobile phone near the door and it unlocks. What could possibly go wrong?<\/figcaption><\/figure>\n

Assa Abloy has an interesting video showing off the many uses of their Mobile Keys<\/a> (house key, office key, temporary key for contractors, hotel keys, etc.). You can issue temporary keys to contractors or cleaners, and you receive a notification whenever one of the temporary keys is used.\u00a0In the same way, when you check in to a hotel using your phone, they can send your hotel key directly to your phone.<\/p>\n

Because most people don’t have NFC-enabled phones, the Clarion’s guests are given new versions of a Samsung\u00a0phone.\u00a0The Samsung\u00a0S5230<\/a> was a popular touch-screen phone released last year, and this year it’s been updated for NFC.\u00a0So for the moment guests will still carry multiple devices–two phones–but eventually we expect to use one smartphone for nearly everything.<\/p>\n

\"\"<\/a>
The Java Mobile Keys application provides relevant information on the hotel key, and a handy reminder of the room number.<\/figcaption><\/figure>\n

NFC security<\/strong><\/h2>\n

NFC phones sound like a great improvement over hotel keys and keycards.\u00a0If you’re like me, however, you’re probably wondering how it could all go horribly wrong–especially if you’re familiar with Collin Mulliner’s security research on NFC-enabled phones.<\/a><\/p>\n

Mulliner took a look at a number of Nokia NFC phones. He tried a number of attacks against the devices: phishing, fuzzing, spoofing.\u00a0He also developed a python library and tools to read and create NFC tags.\u00a0This library generated a number of specially crafted tags to fuzz the NFC reader on the Nokia 6131.\u00a0This research isn’t current for the latest NFC phones, but it serves as a basis for expanding to new devices.<\/p>\n

\"\"<\/a>
A Nokia 6131 NFC-enabled phone loading a URL from a Smart Poster. This phone was investigated by security researcher Collin Mulliner.\u00a0(Credit: Timo Arnall at the English Wikipedia project)<\/figcaption><\/figure>\n

Unlike the Nokia 6131, the Samsung S5230 supports the Security and Trust Services API for the J2ME (JSR-177) standard for secure distribution of Mobile Keys.\u00a0This is basically using public key encryption to ensure that the key your phone receives came from the hotel (no spoofing attacks) and that it hasn’t been tampered with on the way (no man in the middle attacks).<\/a><\/p>\n

Your phone’s accepting a fake key isn’t the most likely attack. An attacker or thief would rather get the actual key or, in this case, an electronic copy of your key.\u00a0With NFC and other RFID systems, there’s an attack called ghost and leech, or simply a relay attack. Here’s a quote from the first paper to mention the attack: “The ghost is a device which fakes a card to the reader, and the leech is a device which fakes a reader to the card.”\u00a0An attacker would either need to steal an actual reader (from a hotel door) or manufacture a compatible reader to function as the leech, and similarly clone the hardware used in your phone to play back the Mobile Key to your hotel room’s door as the ghost. It’s difficult for attackers to get access to the hardware during a trial, but once the hardware is widely in use there will be opportunities to acquire it.\u00a0We’ve already seen as much with RFID credit card readers sold on eBay.<\/p>\n

These are attacks that attempt to intercept the key during transit or block it from arriving on your phone.\u00a0There is still the possibility that an attacker will go after the device that holds the key or the mobile app that interfaces with the NFC hardware.\u00a0The Samsung S5230 is a J2ME device and the Mobile Keys app is very likely a Java program.\u00a0Generally the threats we’ve seen on J2ME phones have been Trojan horse programs, designed to trick users into harming themselves or costing them money.\u00a0It’s unlikely that a Trojan could properly convince a user to install it in place of the legitimate Mobile Keys app.\u00a0It would make more sense, as on platforms such as Android, to go after the underlying operating system or Java Virtual Machine (JVM).\u00a0Two years ago security researcher Adam Gowdiak exposed vulnerabilities in the JVM used by a number of well-known mobile phones.\u00a0He developed a number of proof-of-concept exploits and malware targeting the JVM. Given that the flaws were in the JVM and not in the applications, the fixes would require a firmware update on affected phones.\u00a0Although these threats are more difficult to defend against, they also require a much higher skill level and a greater amount of work from an attacker.<\/p>\n

For the moment these are either old or theoretical attacks. We still have some time before attackers and thieves catch up to the new technology.\u00a0I hope the trials will go well and in the near future I won’t need to shuffle things around in my arms to hunt down that elusive hotel key.\u00a0But finding my misplaced mobile phone is another story.=”\/blogs\/wp-content\/uploads\/<\/p>\n","protected":false},"excerpt":{"rendered":"

If you are like me, there are times when you will misplace your hotel key. Times when you’re switching a…<\/p>\n","protected":false},"author":674,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[442],"tags":[180,214],"coauthors":[3973],"class_list":["post-6288","post","type-post","status-publish","format-standard","hentry","category-mcafee-labs","tag-malware","tag-mobile-security1"],"acf":[],"yoast_head":"\nMissing Hotel Room Key? Try Your Phone | McAfee Blog<\/title>\n<meta name=\"description\" content=\"If you are like me, there are times when you will misplace your hotel key. Times when you're switching a bucket of ice between hands while searching your\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Missing Hotel Room Key? Try Your Phone | McAfee Blog\" \/>\n<meta property=\"og:description\" content=\"If you are like me, there are times when you will misplace your hotel key. Times when you're switching a bucket of ice between hands while searching your\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/missing-hotel-room-key-try-your-phone\/\" \/>\n<meta property=\"og:site_name\" content=\"McAfee Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:published_time\" content=\"2010-11-09T00:16:48+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-06-03T03:49:36+00:00\" \/>\n<meta name=\"author\" content=\"McAfee\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@McAfee\" \/>\n<meta name=\"twitter:site\" content=\"@McAfee\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"McAfee\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/missing-hotel-room-key-try-your-phone\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/missing-hotel-room-key-try-your-phone\/\"},\"author\":{\"name\":\"McAfee\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/47851fdb92fad9456152405839c92efa\"},\"headline\":\"Missing Hotel Room Key? Try Your Phone\",\"datePublished\":\"2010-11-09T00:16:48+00:00\",\"dateModified\":\"2025-06-03T03:49:36+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/missing-hotel-room-key-try-your-phone\/\"},\"wordCount\":1063,\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"keywords\":[\"malware\",\"mobile security\"],\"articleSection\":[\"McAfee Labs\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/missing-hotel-room-key-try-your-phone\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/missing-hotel-room-key-try-your-phone\/\",\"name\":\"Missing Hotel Room Key? Try Your Phone | McAfee Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\"},\"datePublished\":\"2010-11-09T00:16:48+00:00\",\"dateModified\":\"2025-06-03T03:49:36+00:00\",\"description\":\"If you are like me, there are times when you will misplace your hotel key. Times when you're switching a bucket of ice between hands while searching your\",\"breadcrumb\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/missing-hotel-room-key-try-your-phone\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/missing-hotel-room-key-try-your-phone\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/missing-hotel-room-key-try-your-phone\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Blog\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Other Blogs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"McAfee Labs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"Missing Hotel Room Key? Try Your Phone\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"name\":\"McAfee Blog\",\"description\":\"Internet Security News\",\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\",\"name\":\"McAfee\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"width\":1286,\"height\":336,\"caption\":\"McAfee\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/x.com\/McAfee\",\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/www.youtube.com\/McAfee\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/47851fdb92fad9456152405839c92efa\",\"name\":\"McAfee\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/1ffadfeeda1f4f9e7891a81f27a9ecf4\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2020\/08\/Original-Logo-96x96.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2020\/08\/Original-Logo-96x96.png\",\"caption\":\"McAfee\"},\"description\":\"We're here to make life online safe and enjoyable for everyone.\",\"sameAs\":[\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/x.com\/McAfee\"],\"url\":\"https:\/\/www.mcafee.com\/blogs\/author\/mcafee\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Missing Hotel Room Key? Try Your Phone | McAfee Blog","description":"If you are like me, there are times when you will misplace your hotel key. Times when you're switching a bucket of ice between hands while searching your","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"en_US","og_type":"article","og_title":"Missing Hotel Room Key? Try Your Phone | McAfee Blog","og_description":"If you are like me, there are times when you will misplace your hotel key. Times when you're switching a bucket of ice between hands while searching your","og_url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/missing-hotel-room-key-try-your-phone\/","og_site_name":"McAfee Blog","article_publisher":"https:\/\/www.facebook.com\/McAfee\/","article_author":"https:\/\/www.facebook.com\/McAfee\/","article_published_time":"2010-11-09T00:16:48+00:00","article_modified_time":"2025-06-03T03:49:36+00:00","author":"McAfee","twitter_card":"summary_large_image","twitter_creator":"@McAfee","twitter_site":"@McAfee","twitter_misc":{"Written by":"McAfee","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/missing-hotel-room-key-try-your-phone\/#article","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/missing-hotel-room-key-try-your-phone\/"},"author":{"name":"McAfee","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/47851fdb92fad9456152405839c92efa"},"headline":"Missing Hotel Room Key? Try Your Phone","datePublished":"2010-11-09T00:16:48+00:00","dateModified":"2025-06-03T03:49:36+00:00","mainEntityOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/missing-hotel-room-key-try-your-phone\/"},"wordCount":1063,"publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"keywords":["malware","mobile security"],"articleSection":["McAfee Labs"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/missing-hotel-room-key-try-your-phone\/","url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/missing-hotel-room-key-try-your-phone\/","name":"Missing Hotel Room Key? Try Your Phone | McAfee Blog","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/#website"},"datePublished":"2010-11-09T00:16:48+00:00","dateModified":"2025-06-03T03:49:36+00:00","description":"If you are like me, there are times when you will misplace your hotel key. Times when you're switching a bucket of ice between hands while searching your","breadcrumb":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/missing-hotel-room-key-try-your-phone\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/missing-hotel-room-key-try-your-phone\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/missing-hotel-room-key-try-your-phone\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https:\/\/www.mcafee.com\/blogs\/"},{"@type":"ListItem","position":2,"name":"Other Blogs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/"},{"@type":"ListItem","position":3,"name":"McAfee Labs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/"},{"@type":"ListItem","position":4,"name":"Missing Hotel Room Key? Try Your Phone"}]},{"@type":"WebSite","@id":"https:\/\/www.mcafee.com\/blogs\/#website","url":"https:\/\/www.mcafee.com\/blogs\/","name":"McAfee Blog","description":"Internet Security News","publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.mcafee.com\/blogs\/#organization","name":"McAfee","url":"https:\/\/www.mcafee.com\/blogs\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","width":1286,"height":336,"caption":"McAfee"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/McAfee\/","https:\/\/x.com\/McAfee","https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/www.youtube.com\/McAfee"]},{"@type":"Person","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/47851fdb92fad9456152405839c92efa","name":"McAfee","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/1ffadfeeda1f4f9e7891a81f27a9ecf4","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2020\/08\/Original-Logo-96x96.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2020\/08\/Original-Logo-96x96.png","caption":"McAfee"},"description":"We're here to make life online safe and enjoyable for everyone.","sameAs":["https:\/\/www.facebook.com\/McAfee\/","https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/x.com\/McAfee"],"url":"https:\/\/www.mcafee.com\/blogs\/author\/mcafee\/"}]}},"_links":{"self":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/6288","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/users\/674"}],"replies":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/comments?post=6288"}],"version-history":[{"count":6,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/6288\/revisions"}],"predecessor-version":[{"id":214981,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/6288\/revisions\/214981"}],"wp:attachment":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/media?parent=6288"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/categories?post=6288"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/tags?post=6288"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/coauthors?post=6288"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}