Slashdot Mirror
Lock Out: the Austrian Hotel That Was Hacked Four Times (bbc.com)
AmiMoJo shares a BBC report: Christoph Brandstatter is managing director of the four-star Seehotel, Jagerwirt, in Austria's Alps. His hotel's electronic door locks and other systems were hacked for ransom four times, between December 2016 and January 2017. "We got a ransomware mail which was hidden in a bill from Telekom Austria." His hotel's door keys became unusable after he clicked on a link to his bill. So was his hard drive. "Actually, as a small business you do not really think that anybody's interested in you for hacking, so we had no plan what to do," he recalls. He paid a ransom of two bitcoins, saying "at that time it was about $1,882." He has now installed firewalls and new antivirus software, and has trained his staff to recognise phishing emails that may seem genuine but actually contain malware. And he's moved back to traditional metal keys.
all who want everything they have online, for no or trivial reasons, are asking for it. feel no sympathy for such idiots.
Many electronic locks contain an old school relay. These can almost all be opened by putting a good strong magnet it the right spot.
Hotels should keep a supply of rare earth magnets, as backup keys.
John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
not connecting his email reading Internet browsing PC to his hotel door lock system?
If the telecom company is so incompetent that they managed to send out bills with viruses, it's probably time to find another telecom company... OR if you are too incompetent to tell the difference between a legitimate telecom bill and a virus, you probably shouldn't have doors on the internet.
https://teambaphai.com/
He paid a ransom of two bitcoins, saying "at that time it was about $1,882."
There's your mistake. Once your hack results in profit, it's easier to keep a 'customer' than find new ones
just wait for some to copy the metal key and some bad to happen.
His hotel's door keys became unusable after he clicked on a link to his bill.
So once again, we see another addition to the endless list of security clusterfucks enabled by running javascript by default from any source.
Clicking on a link does not infect your PC if you are using plain web pages. It only does that if you allow the other side to execute things in your browser, which it can then break out of.
You have to be a massive idiot to let any site you connect to do that.
Once again, WHITELIST a few sites you trust. Do not execute javascript by default. This is basic web security 101.
. . . . to date, since 2012, the US gov't and private sector has been hacked over 3,270,000,000 (> 3 billion 270 million) times - - - and note, I typed OVER! So the exact number is still unknown.
I happen to know this case. And I happen to know security in hotels in general, and even in some in Austria in particular. Here's the problem, you're cordially invited to provide a solution.
You're dealing with people that are total computer illiterates. And I mean total. They maybe learned a thing or two about using them, they might even have managed to navigate an ECDL course which is basically a glorified way of saying "I can turn on a computer without it instantly exploding", but their expertise and actual training is in something completely different. Many of them actually do not like computers AT ALL. They much prefer dealing with people, else they would not have chosen that occupation.
These people are now chronically understaffed, overworked and stressed. They're supposed to greet people, hand them their keys, do bills, handle the phone and of course email. And no, simply hiring more people isn't possible, there are no more people you could hire. We're talking about a highly seasonal business where there are either too many or too few people available, hence no more want to go into the profession while at the same time during season you can't get anyone. Not even for obscene amounts of money.
On top of all this, you're dealing with ... how do I put this nicely... a rather mafia-like system in place that keeps the number of companies that could actually offer solutions low. Most hotel software is crap. And most hotels would gladly choose something else, if they could. But for some odd reason those systems that are offered can be offered surprisingly cheap (it MIGHT have to do with some semi-public agencies (an Austrian concept, don't ask) that curiously prefer to fund and subsidize those products), while you would certainly not qualify for such subsidies. The cynic in me would add "at least 'til you find the right politician to pay the kickback to", but no, there is no corruption in Europe. None at all. Maybe in Italy, Spain and Greece, but certainly not in the "good" states in central Europe.
So, now you have the basics in, let the rest sink in too. Like a fluctuation that's CRAZY. Average tenure of your workers is measured in weeks. Months if you're lucky. Training them is money you throw into the chimney, for the benefit of whoever they work for next. So if you think that you could raise awareness and give your workers an idea what to look for, ponder whether you'll still have that receptionist after the season is over. There is zero security awareness among your workers.
Then the fact that you pretty much HAVE TO open every email you get, and that crappy spelling is something that doesn't faze you anymore because you're dealing with people from all over the planet, many of them wanting to boast just how well they speak your language when they actually don't. Some of them required to actually send you attachments for legal reasons, with the oddest formats you will ever encounter. In other words, the chance that some viewer for an esoteric format is installed and WAY out of date because nobody had a minute of time to update it in the past 3 months is likely.
The situation is not easy and I was actually involved in a similar case where pretty much every solution we came up with ended up being shot down for one of these reasons (and some more, but I don't want to bore you more than necessary). Hotels are rather complicated beasts to secure. Twice so in Austria with its very ... special circumstances, legal oddities and seasonal requirements.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
If you want mine your own crypto currency, you need a motherboard with 19 PCIe 1X slots to plug in 19 GPUs and a couple of 1200W PSUs.