Slashdot Mirror
Big Vulnerability In Hotel Wi-Fi Router Puts Guests At Risk
An anonymous reader writes Guests at hundreds of hotels around the world are susceptible to serious hacks because of routers that many hotel chains depend on for their Wi-Fi networks. Researchers have discovered a vulnerability in the systems, which would allow an attacker to distribute malware to guests, monitor and record data sent over the network, and even possibly gain access to the hotel's reservation and keycard systems. The vulnerability, which was discovered by Justin W. Clarke of the security firm Cylance, gives attackers read-write access to the root file system of the ANTlabs devices. The discovery of the vulnerable systems was particularly interesting to them in light of an active hotel hacking campaign uncovered last year by researchers at Kaspersky Lab. In that campaign, which Kaspersky dubbed DarkHotel.
An anonymous reader writes incomplete sentences.
Isn't it sort of obvious that hotel networks are a free-for-all security wise?
Use a VPN and SSL.
I just assume that, with free wifi, I'm getting precisely what I'm paying for.
Happiness in intelligent people is the rarest thing I know.
Ernest Hemingway
Hotel wireless is already a risk anyway.
Let's assume the wireless is open. Then anyone and everyone in an adjoining room can sniff everything you do over it anyway.
Let's assume that you are given the key to join the network. Anyone else who has the same key - same thing. AP isolation doesn't save you against someone recording your traffic and having access to the key used to encrypt it.
Wireless is UNTRUSTED. Even wired is UNTRUSTED. You do not know who's pushing that Facebook DNS entry to you, nor that the Facebook TLS is properly signed if you can't rely on the DNS entry.
When you're not using your own networks, use a VPN. That way you don't even have to care if someone bothered to put even WEP on the connection - the VPN gives you the security for your data. However, be sure that if you're doing this, you have a firewall (you are STUPID if you don't) as anything else can send you traffic in these instances too, no encryption, WEP, WPA, WPA2, it doesn't matter.
Every time someone says "join my wireless", replace it mentally with "just plug this cable that connects to all my local machines and also every guest that's ever had the same offer, into your laptop".
Firewall it. VPN it. Then you don't even need to care that it's an open network. And, shockingly, the same config will work with cabled networks.
And if it doesn't work? You don't want to use that connection. Any hotel that breaks your VPN is one that's almost certainly providing some poor replacement for it.
There is a reason why I generally use LTE through my phone instead of "free" wifi when traveling. Not only is the LTE usually faster and less geographically constrained, but I don't have nearly as many security or connectivity problems 99% of the time. I've been behind the scenes at some restaurants and hotels and the "security" setup pretty much convinced me that free wifi is generally not worth the risk if you have a viable alternative. I assure you that many hotels and probably most restaurants do not have a crack IT staff maintaining their system. It's about as basic and insecure as you can possibly imagine. I've even had to point out to a franchised restaurant that they had the free wifi on the same subnet as their internal computers with zero protection of any kind.
Must every bug and vulnerability get a marketing campaign???
How many smaller hotels, shop and other wifi APs bothered to change the default admin password? A lot did not. So, you may need a user password initially (as a customer), but then the setup page is usually at http://router/ where the router model and version are commonly displayed. A quick search on the Internet and you may try the default root/admin password which is quite likely to work. Then you may inject your own DNS servers, and voilà.
Not mentioning how you can also (even more) easily impersonate any of the no-password SSID that people know well (the phone/mac/pc will choose the highest Db one when both are available), and again redefine some DNS entries, add some filtering etc...
So this hotels security hole is maybe important - but the whole wifi/routers security concept is pretty much flawed in the first place (due to people negligence and incompetence, to routers manufacturers who want to provide an "easy setup" router, to other many entities keen on providing a free wifi access with no security at all etc...).
Slashdot, fix the reply notifications... You won't get away with it...
All hotel networks should be treated as hostile, they typically have no meaningful security.
I routinely sniff hotel networks. After checkin I fire up Driftnet to see what others are up to. I'm really surprised at the LACK of porn. Nearly none in most cases.
I wonder is this part of the lawful intercept they mention in the manual? I mean what are the odds of accidentally leaving unauthorized rsync active in the device. Who did ANTlabs get to do the work?
.. It’s not known exactly how the attackers compromised that key system.
Lawfull Intercept
- Monitoring of Networks
- Comply with legistative requirements
- Local storage of logs
"Gaining access to a guest room through a compromised key lock system wouldn’t just be of interest to thieves. One of the most famous cases involving the subversion of a hotel’s electronic key system
Again, the locks were compromised by plugging an Arduino microcontroller into the DC socket on the lock. The lock then disgorged the 32 bit passcode to the device - in the clear - no encryption. A curious design decision on behalf of the locks manufacturers to say the least.
@sjbe: "There is a reason why I generally use LTE . I don't have nearly as many security or connectivity problems 99% of the time."
You have got to be shitting me? Folks, you would think the designers of these 'secure' base stations would have wondered how to protect against cell site spoofing. Besides which, it is currently illegal in the EU to sell mobile phones that cannot be intercepted regardless of the level of 'security'
'Stingrays Go Mainstream: 2014 in Review'
You have got to be shitting me?
Not in the slightest. I've seen the hardware and setup for a few hotels and and a lot of restaurants with my own eyes. While I'm sure there are plenty of security issues with LTE, I know for a fact that plenty of public free wifi is about as clean as a $2 hooker.
Folks, you would think the designers of these 'secure' base stations would have wondered how to protect against cell site spoofing.
Please point me to a single instance of non-governmental cell site spoofing outside of black-hat hacking conferences. This simply is not a significant problem. Highly insecure wifi is a significant problem. Extremely slow and annoying public wifi is a significant problem. Anything that can be intercepted via LTE can be (more easily) intercepted via public free wifi. There is no truly secure solution but I'll take my chances with LTE over dubious hotel wifi any day of the week. It's kind of a least worst option.
I used the hotel internet just long enough to get on (using the browser to type in the magic word for full access), then RDPing into my home system (and then dealing with somebody who has their own computer, but was still using my home computer), to get what I needed accomplished. Get home, and find out that searches were now hijacked. A scan fixed the problem, but my home system wasn't infested, not that RDP is an attack vector that I'm aware of, and since the only pages I loaded were the hotels, it doesn't even take a WiFi exploit to get malware when the ad system obviously can do a drive by.
Bryan