Hotel door locks: from the 2012 Onity flaw to SALTO CVEs
A probe on a service port opened Onity hotel locks in 2012. Four SALTO ProAccess SPACE CVEs show physical security is still the weak layer in hotels.
Since November 1, 2026, Alberta stays on UTC-6 year-round. Access cards, PMS night audits, CCTV timestamps and NTP: the checks hotels need to run now.
At 2:00 a.m. on Sunday, November 1, 2026, Alberta did not fall back. The province now keeps what used to be daylight saving time permanently, UTC-6 all year, under the official name Alberta Time (ABT). The decision was made on June 18; the practical effect landed this weekend. The rest of North America did turn its clocks back one hour in the same night.
That asymmetry is where the risk lives. A Calgary or Banff property talks to partners in Vancouver, Toronto, Chicago and Phoenix on offsets that just moved, while its own systems corrected their calendars only if the patches were installed. The desynchronization is invisible on the day and loud weeks later, when someone reconstructs an incident or audits logs.
Electronic access cards encode an expiry computed from the encoder's local time. An encoder left on the old rules issues keys whose expiry is off by one hour during the transition window, in one direction or the other. PMS night audits fire at 2:00 a.m., the exact hour the transition just made false on unpatched systems. Video recordings and access-control logs must stay coherent to serve as evidence in a dispute, and two diverging clocks turn a timeline into a puzzle.
Windows workstations and servers. Microsoft published dedicated fixes, KB5124010 for Windows 11 24H2 and 25H2 and the October security updates for the remaining supported versions, including Windows Server 2016 through 2025. The updates introduce a new time zone, Mountain Time (Alberta). After patching, verify on every machine, application servers included, that this zone is selected rather than a fixed UTC offset.
Linux servers and appliances. The IANA database shipped the change in release 2026c. On each Linux system, local PMS, access gateway or NAS, check the tzdata version, update it and recompile if needed. The test is simple: zdump America/Edmonton must show UTC-6 with no future change.
Card encoders and locks. Ask the lock vendor for its official Alberta Time statement, then retest with a card encoded after November 1. Virtual-key solutions with time-limited credentials are the most exposed.
PMS night audit and interfaces. Confirm the audit ran once and only once on the night of the change, and that reports sent to an out-of-province head office carry the expected timestamp. Interface files exchanged with a concession operator or booking channel often embed local time in their names: a one-hour shift is enough to missequence a batch.
Calendars and meeting invites. The Windows fix does not correct Outlook on its own: set the calendar time zone to Mountain Time (Alberta), then reopen existing series to reselect that zone, organizer only. Recurring meetings created under Mountain Time (US & Canada) will follow US rules and slide one hour in March. The office reflex of "going back" to Mountain Time (US & Canada) is counterproductive: that zone fell to UTC-7 on November 1 and displays Alberta time minus one all winter.
Time sources. Verify internal NTP servers and their clients. Kerberos rejects clock skew above five minutes: a mistimed domain controller breaks domain authentication before it ever causes a timestamp problem.
Embedded equipment. In-room phones, PBX, ballroom projectors, HVAC controllers, elevators, NVR recorders: many receive no time-zone update and are set by hand. A physical walk with a reading of the displayed clock remains the only reliable method.
Verification journal. Record per system: model, version, check date, deviation found. That record is what turns a checklist into due diligence before an insurer, a PCI assessor or a court.
The IANA database models the change with a temporary workaround for a limitation in the CLDR library, which phones and many web applications rely on: some platforms will display the abbreviation CST for Alberta time, confusing in logs but not changing the actual hour. In Lloydminster, on the Saskatchewan border, the town sets its own rule: confirm locally. And the calendar does not stop at Alberta: British Columbia keeps UTC-7, Manitoba UTC-5 and the Northwest Territories UTC-6 under the same logic, producing a Canadian time-zone patchwork best handled property by property rather than by a single chain-wide rule.
A probe on a service port opened Onity hotel locks in 2012. Four SALTO ProAccess SPACE CVEs show physical security is still the weak layer in hotels.
Kr00K (CVE-2019-15126) made Broadcom and Cypress Wi-Fi chips encrypt frames with an all-zero key. Patches shipped in 2019-2020. Open question: AP firmware.
Unsaflok opened any Dormakaba Saflok hotel lock with two forged cards. A separate hardware backdoor hits MIFARE Classic cards used in hotels worldwide.