Slashdot Mirror
Hotel Experience With Android Lightswitches (dreamwidth.org)
jones_supa writes: The hotel in which Matthew Garrett was staying at, had decided that light switches are unfashionable and replaced them with a series of Android tablets. In his tour to the system, one was quickly met with a glitch message "UK_bathroom isn't responding." Anyway, two of the tablets had convenient-looking ethernet cables plugged into the wall, so MacGyver began hacking. He managed to borrow a couple of USB ethernet adapters, set up a transparent bridge and then stick his laptop between the tablet and the wall. Tcpdump showed traffic, and Wireshark revealed that it was Modbus over TCP. Modbus is a pretty trivial protocol, and does not implement authentication. The Pymodbus tool could be used to control lights, turn the TV on/off, and even close and open the curtains. Then he noticed something. His room number was 714. The IP address he was communicating with was 172.16.207.14. They wouldn't, would they? Indeed, he could access the control systems on every floor and query other rooms to figure out whether the lights were on or not, which strongly implies that he could control them as well.
It just seems daft to me that this is just pointless complexity.
He should check his bill in case they charged him twice.
At the bottom of the
See, this is what you get when you have wink-and-nod, everyone-gets-a-trophy education in the schools instead of teaching people not to be stupid by boxing them on the ears when they get out of line.
If they used a REAL control system this would not be the issue. but instead they tried to do it as cheap as possible using consumer crap.
Tablets at the light switches is insanely stupid as well. real automation lighting systems still have physical buttons at entryways and doorways for the lights.
Whoever sold this system to the hotel needs to be outed and publicly shamed.
Do not look at laser with remaining good eye.
If he can query the light status, why not polls every room every two minutes or so - and make a note of which rooms had been on, then were turned off implying the owners had left...
Nothing like being able to know a room will have belongings but is unoccupied to make the burglar's work easy.
On a side note I can't really blame them for matching IP to room number, just from a trouble-shooting perspective... the real problem is lacking unique per-room authentication.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
To the engineer's credit, at least he used a platform that won't require testing due to software updates!
"I like to lick butts!" by MobileTatsu-NJG (#32700246) (Score:5, Informative)
So lame.
Ironically, WPA2 would have prevented this jackass from tapping the link layer.
The lack of security doesn't stop at everything using unlicensed wireless bands.
MacGyver would have built a transparent bridge using mothballs and saliva, not usb adapters.
so we installed combination cocks[NSFW].
Easy security problem to solve. (since you messing with your own room isn't a problem... I would think) Wonder why they decided on a totally flat and open LAN?
I recently stayed in a hotel that provided a tablet in every room for accessing amenities, such as room service. It appeared to be equipped with a camera and microphone, as most tablets are. And I have little doubt the security at that hotel was as bad as what the poster described.
Loading...
It's not a control system. It's a slapdash bunch of crap stuck together, not a system.
https://www.youtube.com/watch?v=Fe581bHpvZo
This, exactly this, hacking into it, outing it as cheap crap, saying it's not secure, blah blah blah, keep living in your encrypted utopia and kill yourself yesterday for all our sakes.
why does it have to be ten times the price this hotel already paid for? just fuck you guys, you're all just a bunch of lame ass chatterbugs, not even worthy of any goatse.
have fun with it for a moment, let the hotel know about it, especially the owners of the hotel, and maybe just maybe, karma won't bite you in the electrical switches.
and all you others here, keep on whining about it, it's your national pass time, though it only serves the war; go babelfish !
[wdw]
I would have left the standard switches and implemented the Android control system with a key you load into an app in the customers device.
"sir, would you like to use your device to control your room, lock and unlock your door, get a message if your room is entered, order from the room service menu, check in and out and a lot of other services we offer?"
Guarantee this was dreamed up by someone from India.
Only the State obtains its revenue by coercion. - Murray Rothbard
I would like to use my device to simultaneously flush every toilet in the building. And then after having done that, then I would like to use my device to book a different hotel for the evening.
Welcome to the Internet of really gadamned stupid things.
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
In a lot of hotels in Europe, you have to shove your key card into a receptacle near the door which turns on the power to the room.
(of course, most don't care what card you use, so if you want to leave the lights on when you leave, you use a keycard from some other place)
If your going though all the trouble of networking all the lights/TV's in the entire hotel, why not the door locks too?
So, eventually, was he able to play tetris with the hotel as display?
I hadn't the slightest objection to his spending his time planning massacres for the bourgeoisie... (P.G. Wodehouse)
The solution is pretty simple, setup private vlanning so that only the ports in a given room can talk to each other, and any central server authenticates the connection based on the incoming port.
Sure the traffic is still in the clear but so what? You would be able mitm your own room and turn off your own lights, which you could have done anyway.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
...Matthew Garrett was killed in a hail of automatic weapons fire in an arrest gone wrong, when a federal multi-agency task force attempted to serve a warrant on his residence pertaining to alleged DMCA violations related to his recent posting of security holes that he found in a hotel's lighting system.
When asked for comment, the task force leader said, "It's a bit of a shame, yeah. Someone on the team believed they saw a gun being pointed at them and fired a 30 round burst as a warning shot, and the rest of the team joined in. It was all over in a matter of seconds. Upon further investigation it was determined that the target was actually clutching a stuffed bear. As I said, it's a bit of a shame, but when we hear about someone trying to hack into a hotel lighting system, we just can't take any chances and mobilize immediately, and yeah, sometimes people get shot. I still think it's a win, because we at least got the address right this time."