Proxmark 3 RDV2 Bypasses Millions of Hotel Rooms

InfoSec firm F-Secure, as widely reported, have managed to cracked Assa Abloy's Ving Card system using the Proxmark 3 RDV2.

The Proxmark 3 RDV appears to:

  • Read an original hotel card in Stand-Alone mode
  • Determine the Master Key for the Site Installation
  • Use this Master Key to generate a Master Badge for the Site
  • Emulate the badge in Stand Alone Mode.

From the information and videos surfacing in the press, it would appear that F-Secure have cracked the Ving Card encryption algorithm, allowing for unfettered access to any site.

In theory, this attack could be used to:

  • Snatch a card from a hotel patron, and access any room / area
  • Upgrade your own hotel card to an all-access card

A full explanation video can be seen here:

Implementations aside, this is a testament to the Proxmark's flexibility as a device, and its Open-Source framework, easily allowing for security professionals to adapt the device to their own requirements.

Related articles

  • Black Friday 2025 is live!

    This Black Friday / Cyber Monday, enjoy 10% discounts and 5000€ in store credit! Starting Friday until Monday, (almost) everything is 10% off storewide. And - the Hamster Hunt is back for Black Friday with 5000€ of store credit to be won!
  • We need to talk about the iCopy-X.

    It's been three years since the iCopy-X's last firmware update. Is it still the ultimate RFID device? Has the project been abandoned? We need to talk about the iCopy-X. The Lab401 team flew to China, sat down with the dev-team, and now we need your help to shape the future of the iCopy-X.
  • Building the DigiLab : Behind the scenes

    Check out the complete behind-the-scenes journey of Lab401's DigiLab for Flipper Zero - from initial brainstorming to mass production — including prototype failures, code challenges, and manufacturing lessons learned. The DigiLab is a "magic wand" for electronics, allowing you to feel voltages, hear signals, see frequencies, and poke around directly in the brains of modules and sensors! ✅ Sketches, blueprints and initial planning material✅ Off-the-shelf components vs custom made✅ Designing testing jigs for rapid production testing✅ Behind-the-scenes videos, fumbles and fixes.
  • Building the LightMessenger : Manufacturing, Part 2

    Check out the complete behind-the-scenes journey of Lab401's LightMessenger  for Flipper Zero - from initial brainstorming to mass production — including prototype failures, code challenges, and manufacturing lessons learned. The LightMessenger creates stunning persistence of vision effects with 16 RGB LEDs and an accelerometer, painting text and images through air when swiped - fully open source and open hardware. ✅ Sketches, blueprints and initial planning material✅ Smart component selection in 2025✅ Designing testing jigs for rapid production testing✅ Behind-the-scenes videos, fumbles and fixes.
Go to full site