Slashdot Mirror
Ransomware Infects a Hotel's Key System (dailymail.co.uk)
An anonymous reader writes:
A luxury hotel "paid "thousands" in Bitcoin ransom to cybercriminals who hacked into their electronic key system. The "furious" hotel manager says it's the third time their electronic system has been attacked, though one local news site reports that "on the fourth attempt the hackers had no chance because the computers had been replaced and the latest security standards integrated, and some networks had been decoupled." The 111-year-old hotel is now planning to remove all their electronic locks, and return to old-fashioned door locks with real keys. But they're going public to warn other hotels -- some of which they say have also already been hit by ransomware.
UPDATE: The hotel's managing director has clarified today that despite press reports, "We were hacked, but nobody was locked in or out" of their rooms.
UPDATE: The hotel's managing director has clarified today that despite press reports, "We were hacked, but nobody was locked in or out" of their rooms.
Who thought it was a good idea for essential systems like this to be online in the first place?!
This is why the Internet of Things is such a horrible concept. Most things don't need to be online and connected to everything else, and the cost of trying to be trendy is huge increases in risks to the privacy, security and reliability of everyday items.
Closed networks do just fine for these kinds of systems, don't actually need to cost that much more, and have none of the vulnerabilities.
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
Critical infrastructure DOESN'T NEED ACCESS TO A PUBLIC INTERNET.
Governments, utility providers, MILLITARIES! All of them have publicly accessible computers. WHY?
Welp folks, since we're not willing to use common sense in deploying our electronic systems to ensure their security and integrity, we're going to abandon digital and go back to mechanical.
With this challenge out of the way, we're looking at resolving the parking lot conundrum by bringing back horse buggies. To prevent our central heating and air from being hacked, we're uninstalling it and putting fireplaces and fans in all the rooms.
What was the name of the ransomware, what was the name of the company that designed the locks, what OS did the reservation system run on, what OS did the cash desk system run on?
"Unless this is all just a big publicity stunt to advertise their new door locks."
Yea, that's it, a hotel would try and drum up business by advertising that its electronic door locks can be compromised.
That's crap you usually hear from "3rd-world-countries" like india or pakistan ("30 burned to death because emergency exits where locked")!
I can only hope the Fire-Marshall or whatever they call them there is going to kick the Hotel's ass!
I can understand people being locked out of their rooms. But if they're being locked in they're in massive violation of fire safety laws.
So, back to picks and rakes then?
Following me once, shame on you. Fool me twice, shame on me.
Three times? Really?
Enjoy life! This is not a dress rehearsal.
a sane locking system that would not have an override on the inside so that occupants can leave the room whatever the state of the electronic lock.
Fail-safe instead of fail-secure would have to be mandatory in these cases. What if there was a fire?
And no one saw this coming. Just wait till the focus becomes IoT and I will laugh my ass off at all you dofusses.
This is type-a classic prankster penetration, now under the guise of "IOT" because SOCs have become so cheap you can stick them into anything, add a shoddy non-updateable web-thingie to it that is 5 version behind and has holes in it so big you can drive a mac truck through it. Or, more likely, default access codes that a 12-year old can look up on the intarweb in less than 15 seconds.
This is freakin' hilarious and really quite funny.
Did anyone of you guys see this coming? I certainly did.
IOT is one big pile of trash and hype about it will disappear faster than the first dot-com boom.
That's my humble opion anyway. My toaster doesn't need a webserver and certainly my freakin' doorlock doesn't either!
I hope this is over soon, if only for the sake of public safety.
Meanwhile we will get some neat laughs and see some hilarious pranks by bored highschoolers.
We suffer more in our imagination than in reality. - Seneca
Let's connect EVERYTHING to the internet!
Daily Mail? Seriously? Out of all the media that covered this story extensively over the past couple of days, you picked to link to the daily mail as the source? Also including the clickbait phrase of "paid thousands" to refer to 2 bitcoins? The only hope is that slashdot community does what it's best at: does not read the article.
in some systems power lost = doors unlock (the ones that have the push to exit button) as the power is needed to hold them locked. Also the fire system can trigger the unlock.
Ya know there is a world outside the United States and sometimes the laws there are different.
Maybe Austria doesn't have US fire safety laws or 100+ y.o. hotels have waivers?
I thought electronic door locks could stil be overridden manualy with old fashioned knobs and handles on the room side of the door. I wonder what the city's code enforcement and fire department thinks about this?
Sometimes, try as I might, I simply cannot prevent myself from cheering wholeheartedly for the criminal.
Must be a character flaw.
Why do Hotel door locks need To be connected to a network? Use keys.
with Russian prostitutes, films entire thing, demands Presidency.
Something about it's actually less secure to use physical keys and virtual ones. I mean even years ago they switched away from physical keys to cards because in the past you only needed to have the key copied and then it was good for that room until they thought to change the locks. (Which given they're physical wasn't going to happen because that cost money.) The new key system they basically generate a new key and put it on the card and publish it to the lock in your room every single time a new guest checks in.(So you take the key card with you when you leave? Good luck getting back into your old room because the system knows the key is expired.) Sure you can swipe the key card and copy it but that will only work until the guest checks out or asks the manager to put a new code on the lock.
Did you know 80 to 90% of the moderators on slashdot wouldn't recognize a troll even if one dragged them under a bridge.
It's just weird. Not that anyone with some common sense wouldn't know that all these idiotic new fangled IoT devices will end up having their own problems with vulnerabilities and hacking, we basically have proof every single week or day on how easily those can be defeated... yet we keep seeing big companies investing on stuff like that as if nothing was happening.
Save yourselves the headache guys, and do not buy any IoT devices whatsoever in which usefulness do not trample security concerns and overall problems. Your fridge shouldn't be connected to the Internet, your dishwasher, your washer/drier, your home security cameras, your thermostats, your home lamps, your fancy bathtubs, your pet feeding machines.. basically anything that isn't computers/tablets/smartphones and perhaps a home server. If you can find a way to work around some of these to stay into the local network or simply disconnected from everything, it'll be better in the long run. The slight convenience they promise more often than not already doesn't go over all the trouble they bring with setting up, updating, configuring, solving bugs, going through glitches and all the extra work that comes with anything that is Internet connected, let alone worries about security and privacy.
Get over the hype, the promises, the ads, the control everything with your smartphone crap, the unrealistic idealized scenarios and all that - and bring things down to real world usage and real world experience. It's not that much of an exercise for the imagination. Folks buying IoT crap because it's shiny and new are no different from delusional compulsive shopping addicts. A device being connected to the Internet is not an advantage, but something to be treaded carefully.
I won't even mention AI assistants. People think they know how invasive and how bad these things are, but they don't. And I'm tired of discussing this with hard headed folks who willingly pay for and put these devices in their homes. I'll just laugh at the flurry of problems that comes from those when things start falling apart.
I'd think that by now, if societies were smart enough, we'd be thinking of ways to add convenience to everyday appliances while keeping them offline, not by ramdonly connecting things. But it just seems people haven't waken up to that.
When you check in the front desk literally generates a new key. That key gets put on your card and gets put on the lock on your room. If it wasn't on the network then they'd have to send someone up and go through the process of putting the key code on the lock so your card would work.
Did you know 80 to 90% of the moderators on slashdot wouldn't recognize a troll even if one dragged them under a bridge.
What kind of fucking stupid design is that where that is even physically possible? It should run afoul of absolutely every kind of fire regulation imaginable that a door lock can even *POSSIBLY* lock a person in their unit.
The mechanism to unlatch the door should be *PHYSICALLY* tied to the turning of the handle or knob on the inside of the unit such that the only way to potentially lock someone in would be to physically damage the latch first... either by welding it into position or otherwise gutting the innards so that it did not work.
File under 'M' for 'Manic ranting'
Hotel management said that they have now been hit three times by cybercriminals who this time managed to take down the entire key system. The guests could no longer get in or out of the hotel rooms and new key cards could not be programmed.
Bahaha, and I hadn't even seen this yet. They're hard working, too! And they only demanded 1,500 EUR? Hell, the hotel should pay them more than that for security auditing services.
Also, who the hell designs an electronic lock that can lock people in the room if it goes down? Is that even legal in Austria?
Yet according to the hotel, the hackers left a back door open in the system, and tried to attack the systems again.
See, they even offered you a free security audit checkup to verify that you fixed things properly. Try as I might, I just cannot bring myself to dislike these guys.
Brandstaetter said: "We are planning at the next room refurbishment for old-fashioned door locks with real keys. Just like 111 years ago at the time of our great-grandfathers.
Yeah, high security mechanical locks have been around for at least two hundred years now.
And we've known for decades that electronic does not equal high security. Is anyone still selling passive RFID door locks? What about that one expensive electronic lock that could be easily defeated with a $50 magnet?
I'm not sure I could feel any less sympathy for the hotel if they next decided to replace all of their locks with aggressively positioned anti-theft feng shui decorations. I mean, at least that system wouldn't lock guests inside their rooms, possibly killing them if there's a fire.
The source of the story, at the bottom of TheLocal article, is Central European News, which BuzzFeed proved to be a source of fake news: https://www.buzzfeed.com/alanw... There's an accurate report here, with statements from the hotel's manager: https://www.bleepingcomputer.c...
Was it Locky?
by Cyphase ( 907627 )
Woosh.
Beware of the Leopard.
secure digital locks.com
I assume this abomination of a software runs on Windows? (for the record, I did not read the article)
Works for me - I rarely go out (living in what amounts to the Garden of Eden will do that for ya) - and no one gets my data if I don't want them to.
.
BUT! Now let's look at why things are the way they are. Artificial scarcity of both IPv4 addresses and um, profits. No one wants to settle for the margin they can get selling you something just once, now. Oh no, we all have to subscribe to almost everything (I Avoid this like the Plague - and do without if I hve to).
So they have to insert themselves in the loop by owning a static IP and domain. Yeah, some of them are free NOW - how long before you get charged rent to even make your own home work? I'll ignore the snooping for the purpose of making this point. You're willingly handing over control via IoT and anything subscription model. Period. You might not like the eventual results.
You have been warned!
Why guess when you can know? Measure!
I would never trust anything I own and absolutely need to work to an electronic lock. Not that I'm a luddite ... far from it ... but because I know what can go wrong, and in some circumstances absolutely nothing can be allowed to go wrong. So no electronic locks on my home's entry doors, and no home safes with electronic locks (includes gun safes).
Hotels ... I can see huge advantages for a hotel to have electronic locks on rented rooms. They will also have staff who can defeat said locks if need be. Downsides? Could be a problem if fire breaks out, but as I understand it (my ex worked for a Federal Prison System) a proper electronic lock must by law fail open, so that would be the type found in hotels.
The only exemptions are for prison locks, which fail closed, and those models are subject to strict controls, only available to bona fide law enforcement or prison purchasing agents, not the general public.
In this case the locks probably hadn't failed so much as were programmed to operate in a closed manner. I wonder if (voluntarily) cutting power could have opened the doors? That would take some effort ... almost certainly the hotel had backup generators that would have to be defeated, so definitely a job for the hotel support staff, but from there it should result in open doors.
> "Common sense" is not very "common" at all when it comes to electronic systems, and it's even less common when it comes to computer security. The vast majority of people -- even those running big businesses -- simply have no clue how computers or networks or whatever work in any detail.
Which is why it's a great idea for absolutely everyone to be writing code for these internet-connected devices. Security? What's that? Who cares, I just wrote a Facebook app to connect my fire sprinklers to my Facebook!
In what world is it considered a sane design decision that it is possible for guests to be locked in a hotel room? It seems like the sort of thing that should be a fire code violation at least.
"We were hacked, but nobody was locked in or out," said the hotel's Managing Director Christopher Brandstaetter. "For one day we were not able to make new keycards." "Since the locking system must work even in the event of power failure, the guests in the hotel almost did not notice the incident," the manager also added. "We simply could not issue new keycards because the computers were encrypted."
"First they came for the slanderers and i said nothing."
I call BS on this one. Locking guests out of their rooms, sure. Locking guests into their rooms? Uh no. Basic fire code requires that all electronic locks always allow egress, regardless of their lock state or powered/unpowered. Basically, the mechanical locking mechanism can always be opened from the inside, regardless of how the electronic locks are hacked or malfunction.
If you disagree, please post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like
Really? If that is the case someone really screwed up here and its a death trap. This hotel needs to be shut down, as is their supplier of door locks.
It makes no sense for a lot of things to be electronic or connected to a computer. A good example of this IS A FUCKING DOOR KEY. Why in the world you accept all the risks involved in having something that is near freely hackable by anyone, from anywhere prone to electrical failures. At least with a physical key you have A) Somebody trying to pick the lock *publicly* cameras rolling in the hallway or B) Someone kicking the door down.*publicly* cameras rolling in the hallway.
I got locked out of my hotel room on one of these electronic card readers. They had to unscrew it from the door so I could get in. Makes absolutely ZERO F****** sense to not even allow a physical key to open it. People. Are. Becoming. More. Stupid.
And why the fuck is infrastructure like this connected to the Internet in the first place?
All these insecure systems need to be attacked and exposed for the garbage that they are. Everyone that knows about computer systems or security has been screaming that IoT systems are bad and are not to be trusted. Despite all of this, plenty of fools in management went ahead because they are arrogant pricks who don't give a shit about what other people think. At this point, getting hit with ransomware is your wage, as in, you have gone out of your way to earn it.
You reap what you sow.
Anons need not reply. Questions end with a question mark.
>""on the fourth attempt the hackers had no chance because the computers had been replaced and the latest security standards integrated, and some networks had been decoupled." The 111-year-old hotel is now planning to remove all their electronic locks, "
Yeesh. If you decide to not go back to physical keys, at least consider these next time:
1) Don't connect your door/key system to the Internet, at all.
2) Isolate the machine on your network to just the needed functionality.
3) Isolate the machine physically- nobody but specialized staff should have physical access.
4) Restrict root/admin access to the machine.
5) If possible, get a system not run by any MS-Windows machines.
6) Make, test, and retain good, redundant, and incremental backups.
7) Perhaps hire or contract with I.T. staff that can set up and maintain your systems properly.
Computer systems are not like ice makers or or other appliances at a hotel. They need to be designed, setup, and maintained properly to work well. And, unfortunately, they are rarely a one-time expense. This, more than anything, is what gets companies into trouble. These types of failures being reported are more about management failure than failures of technology.
You can't secure a crappy system.
Rubbish. I've never stayed in a hotel with key cards where the inside handle didn't override/bypass the lock.
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
If the system is air gaped, there would have to be a stand alone terminal for programing the locks. Have none of you been to a big hotel? There might be 12 clerks checking people in continuously. That one airdropped terminal would be a huge bottleneck, adding significant minutes to checking in each guest. So you're talking about adding many stand alone terminals, which is not just the computers, it's also the desk space and power outlets and network drops and IT maintenance ... it's no small increase in cost. Initial and ongoing. Compared to the cost of just keeping an image of the 'server' and a good backup of the database, I can't blame a hotel for going that route.
The real lack of common sense in the story, is not having a way to recover quickly from the infection.
Whst dumbass connected the electronic keys to the Internet? They don't need regular keys, they just need an actual 4 pin keypad and set it up so when the password is entered incorrectly 3 or more times, the desk gets alerted. A hotel like that could put a guard on each floor. The maids and security could have a master pin that resets every 6 hours. Or, the guest could have the option as well and have the code texted to them. Put an old fashioned deadbolt in each one for those that are sleeping in their rooms. Problem solved.
We have electronic locks at work, and they are on the Internet. They are VLAN'd and firewalled off but they are still on the Internet because the company that administers them is remote. You can argue we should do it our self and I'd agree, but that is the arrangement. However every single one can be overridden on the inside the the handle. The locking mechanism is just that it basically unlocks the door frame so you can push it open from the outside with the electronic lock. Inside, you can always use the handle to override.
The reason is, as you say, fire code. All our doors always open towards the outside, no matter what. Old lock and key doors are the same. You will find a door with a Medeco lock on the outside that can't be permanently unlocked, only turned to move the bolt, but on the inside ti is just a bar you push to open it up. No matter where you are in the building, you can always get out just by following the doors that will open manually with no key/code. The locks are for locking people out, not in.
I was seriously wondering how people could get locked in their rooms. I mean that is such a massive fire code violation and commercial buildings care, a lot, about fire code because you can be sued in to oblivion.
Incorrect clickbait headline. Now that makes much more sense :D.
The little server running the key card system back where I worked was connected to four things: three key makers with numeric pads and the wall power outlet. After the installer finished setting it up, he hauled off the keyboard and monitor. So there wasn't any hacking the database unless the hacker brought his own IO devices. Presumable the same applied to a repair tech but the thing just worked.
My Gosh, you'd have thought that after the 1st time this happened they'd have gone out and bought a backup or set of backup HDD's. It's not rocket science.
I wonder if the system is running XP?
Supposedly the keyserving-system could be air-gapped; but medium and large hotels usually have plenty more systems (and often only one computer/monitor in the lobby). Hotels have online bookings, they must be able to check/import those into their billing/accounting systems; the lobby nightshift is supposed to scan Tripadvisor and such sites for comments.
There's often a separate system to monitor minibar-usage and another for non-free TV entertainment channels (read pr0n), both of which have info dumped straight into the billing system. Information and images from movement sensors and surveillance cameras may also pop up on the lobby monitor.
How would you separate such critical systems (critical for hotel management)?
We don't need the government regulating IoT devices. What we do need is legal recourse when IoT devices fail.
A EULA should never indemnify the manufacturer from the liability of manufacturing a defective product. A EULA should not be permitted to restrict your rights to sue for damages.
This is how IoT gets fixed. Hold manufacturers responsible for the crap they produce.