Zero Knowledge Unsaflok The Unsaflok Saga Continues

The talk extends the earlier Unsaflock research on Saflock hotel locks. The original attack needed two physical keycards, one of them to read the hotel's property ID, which made it hard to carry out. The researchers show that the HH6 maintenance unit's interrogation protocol returns that property ID straight from the lock, so no hotel card is needed.

To learn that protocol they had to recover the HH6's firmware. Its LPC2468 microcontroller was set to a read-protection level that blocks dumping. Voltage glitching failed because the chip's brownout detector reset it, so they switched to electromagnetic fault injection with a budget rig built from a 3D-printed mount, a Raspberry Pi and a Pico. After about two months of glitching, they had a full firmware dump. They loaded it into Ghidra, used a Flipper Zero as a JTAG debugger, and disabled the watchdog timer that kept resetting the chip during analysis.

With the lock ID and property ID in hand, the attacker emulates a variable key from the Flipper. Variable keys skip the sequence-and-combination check, so the hotel's own emergency keys keep working and the logs record only a guest key. The takeaway for practitioners is that any property not using enhanced security, which enforces per-site keys, stays exposed, and the speakers urge operators to switch.