Slashdot Mirror
Hotel Experience With Android Lightswitches (dreamwidth.org)
jones_supa writes: The hotel in which Matthew Garrett was staying at, had decided that light switches are unfashionable and replaced them with a series of Android tablets. In his tour to the system, one was quickly met with a glitch message "UK_bathroom isn't responding." Anyway, two of the tablets had convenient-looking ethernet cables plugged into the wall, so MacGyver began hacking. He managed to borrow a couple of USB ethernet adapters, set up a transparent bridge and then stick his laptop between the tablet and the wall. Tcpdump showed traffic, and Wireshark revealed that it was Modbus over TCP. Modbus is a pretty trivial protocol, and does not implement authentication. The Pymodbus tool could be used to control lights, turn the TV on/off, and even close and open the curtains. Then he noticed something. His room number was 714. The IP address he was communicating with was 172.16.207.14. They wouldn't, would they? Indeed, he could access the control systems on every floor and query other rooms to figure out whether the lights were on or not, which strongly implies that he could control them as well.
He should check his bill in case they charged him twice.
At the bottom of the
If they used a REAL control system this would not be the issue. but instead they tried to do it as cheap as possible using consumer crap.
Tablets at the light switches is insanely stupid as well. real automation lighting systems still have physical buttons at entryways and doorways for the lights.
Whoever sold this system to the hotel needs to be outed and publicly shamed.
Do not look at laser with remaining good eye.
If he can query the light status, why not polls every room every two minutes or so - and make a note of which rooms had been on, then were turned off implying the owners had left...
Nothing like being able to know a room will have belongings but is unoccupied to make the burglar's work easy.
On a side note I can't really blame them for matching IP to room number, just from a trouble-shooting perspective... the real problem is lacking unique per-room authentication.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
That's a ~95% solved problem and has been for decades. Room key on thick plastic block, block goes in a cradle inside the door, activating power to the room. Pull the key to leave and everything goes off.
Worked in the 90's at least when I started traveling for work, and it wasn't just in big city hotels then. Perspex blocks don't have to be smudge-free, don't need extra power of their own, won't break down, are significantly cheaper, can't be trivially hacked to screw with every other room in the hotel - no this is a solution looking for a problem.
Welcome to the Internet of really gadamned stupid things.
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
You put the keycard (these days its more often chip based I think, but anyway) in the cradle by the door and it has the same effect (turn on/off thelights etc), usually except for one power socket which is used for the fridge. Two guests get two keycards so one is always in the room with them. Simple ... works this way across the world.
"Totally" is a severe exaggeration. Smartasses are never easy to deal with, but they do solve the problem 99% of times.
Also, most people don't just carry around random credit card-sized cards that they're willing to leave behind for a little added convenience.
So, eventually, was he able to play tetris with the hotel as display?
I hadn't the slightest objection to his spending his time planning massacres for the bourgeoisie... (P.G. Wodehouse)