Experts concerned about security of hackable hotel keys

RICHMOND, VA (WWBT) - More hotels are now offering a new convenience: digital room keys. They are the next wave in high-tech travel, but experts are worried you could pay a steep price for this convenience.

Dorinda Purvis has a lot to keep track of when she travels. One thing she's glad she doesn't have to worry about losing anymore? Her hotel key.

"I've been able to use an electronic key that you can access through your phone," said Purvis.

Digital keys work through a hotel's mobile app, typically paired with Bluetooth. It's a technology in place at some major hotel chains.

The high-tech keys allow you to skip the check-in process, give you instant access to your room when it's ready and, of course, they eliminate those magnetic key cards.

"I have a hard time keeping up with plastic key cards sometimes. A lot of times, too, they might lose their magnetism," said Purvis.

Tech security expert Shawn Kanady says the convenience may come with risks. His company gets hired by hotels looking to secure their systems. He tries to hack the mobile keys to find - and fix - vulnerabilities before criminals do.

He says when your phone is close to the door lock, it's sending the key through Bluetooth technology.

"That transmission was captured via an antenna, and then what the researchers did was they replayed that transmission to the lock and were able to open the lock," said Kanady with Trustwave Security Consultant.

Kanady says his team also hacked in and changed some hotel administrator passwords.

"Once you have the administrator password, it's game over for any application. At that point, you can do whatever you want," said Kanady.

Kanady stresses that he knows of no actual criminal hackings.

Marriott didn't respond to our requests, but Hilton tells us "this innovation continues to provide a seamless and secure experience for our guests," explaining there are safety mechanisms built into the system. "Consumers can also help by removing any apps after they are done using them."

Purvis says for her, convenience outweighs any potential risks.

"I am notorious for losing the regular keys, so I really do enjoy the feature," said Purvis.

We reached out to representatives of the American Hotel and Lodging Association. They declined to comment. Meantime, Hilton reiterates the safety of the devices, explaining the digital keys are assigned only to known guests and known devices associated with that Hilton Rewards member, and it requires a unique security certificate to unlock the door.

Copyright 2018 WWBT NBC12. All rights reserved.

Report an Error or Submit a Tip to NBC12