Proxmark 3 RDV2 Bypasses Millions of Hotel Rooms

InfoSec firm F-Secure, as widely reported, have managed to cracked Assa Abloy's Ving Card system using the Proxmark 3 RDV2.

The Proxmark 3 RDV appears to:

  • Read an original hotel card in Stand-Alone mode
  • Determine the Master Key for the Site Installation
  • Use this Master Key to generate a Master Badge for the Site
  • Emulate the badge in Stand Alone Mode.

From the information and videos surfacing in the press, it would appear that F-Secure have cracked the Ving Card encryption algorithm, allowing for unfettered access to any site.

In theory, this attack could be used to:

  • Snatch a card from a hotel patron, and access any room / area
  • Upgrade your own hotel card to an all-access card

A full explanation video can be seen here:

Implementations aside, this is a testament to the Proxmark's flexibility as a device, and its Open-Source framework, easily allowing for security professionals to adapt the device to their own requirements.

Related articles

  • We need to talk about the iCopy-X.

    It's been three years since the iCopy-X's last firmware update. Is it still the ultimate RFID device? Has the project been abandoned? We need to talk about the iCopy-X. The Lab401 team flew to China, sat down with the dev-team, and now we need your help to shape the future of the iCopy-X.
  • Building the DigiLab : Behind the scenes

    Check out the complete behind-the-scenes journey of Lab401's DigiLab for Flipper Zero - from initial brainstorming to mass production — including prototype failures, code challenges, and manufacturing lessons learned. The DigiLab is a "magic wand" for electronics, allowing you to feel voltages, hear signals, see frequencies, and poke around directly in the brains of modules and sensors! ✅ Sketches, blueprints and initial planning material✅ Off-the-shelf components vs custom made✅ Designing testing jigs for rapid production testing✅ Behind-the-scenes videos, fumbles and fixes.
  • Building the LightMessenger : Manufacturing, Part 2

    Check out the complete behind-the-scenes journey of Lab401's LightMessenger  for Flipper Zero - from initial brainstorming to mass production — including prototype failures, code challenges, and manufacturing lessons learned. The LightMessenger creates stunning persistence of vision effects with 16 RGB LEDs and an accelerometer, painting text and images through air when swiped - fully open source and open hardware. ✅ Sketches, blueprints and initial planning material✅ Smart component selection in 2025✅ Designing testing jigs for rapid production testing✅ Behind-the-scenes videos, fumbles and fixes.
  • Product Manufacturing with Lab401

    Want to see behind the scenes of making an accessory for the Flipper Zero? Get an exclusive behind-the-scenes look Lab401's development framework for transforming ideas into market-ready devices. Learn about our accessory "Product Metric"'s four core requirements: crystal-clear use cases, plug-and-play functionality, open-source expandability, and built-in educational value. The development process spans five critical phases from conceptualization through mass production. ✅ Pre-production planning prevents costly manufacturing mistakes✅ Smart component selection avoids export bans and EOL issues✅ Minimized packaging reduces shipping costs and environmental impact✅ Exhaustive QC procedures ensure customer satisfaction
Go to full site