Slashdot Mirror
Hackers Who Attended Black Hat and DefCon Conferences Say Hotel Security Personnel Demanded Access To Their Rooms (the-parallax.com)
More than two dozen hackers and security experts who attended security events last week say security personnel at the Mandalay Bay, Luxor, Caesars Palace, Flamingo, Aria, Cromwell, Tuscany, Linq, or Mirage hotels had entered their rooms. Security news site The Parallax reports: Except for Tuscany, which is independent, all of these hotels are owned by either Caesars Entertainment or MGM Resorts International. And of the three hotel companies, only Caesars returned a request for comment. Richard Broome, executive vice president of communications and government relations for Caesars Entertainment, whose Caesars Palace is co-hosting DefCon this year with the Flamingo, said that following the deadliest mass shooting in U.S. history last year, "periodic" hotel room checks are now standard operating procedure in Las Vegas. On October 1, 2017, from his room at the Mandalay Bay, Stephen Paddock used semiautomatic weapons he'd outfitted with bump stocks to kill 58 people and wound at least 527 others attending a gated country music concert on the Strip below. [...] Two apparent Caesars security officers wearing hotel name tags displaying only the first names "Cynthia" and "Keith," respectively, as well as sheriff's style badges that looked like they came out of a Halloween costume kit, visited my room while I was writing this story. Cynthia told me that they are instructed to refer to the front desk guests who decline to allow their room to be searched.
After Cynthia and Keith declined to disclose their last names to me, I asked what they intended to do in the room. They told me that they would enter it, type a code into the room's phone line to signal that it's been checked, and then do a visual spot check. When I asked what they would be looking for, Cynthia replied, "WMDs -- that sort of thing." Other conference attendees reported similar but less pleasant interactions. Katie Moussouris, CEO of Luta Security, wrote on Twitter that two hotel security personnel were "banging" on her room door and "shouted" at her. She also said the hotel's security team supervisor "dismissed" her concerns over how the hotel was treating single, female travelers. Google security engineer Maddie Stone tweeted that a man wearing a light-blue shirt and a walkie-talkie entered her Caesars Palace room with a key, but without knocking, while she was getting dressed. "He left when I started screaming," she wrote, adding that a hotel manager, upon her request, said Caesars would look into whether the man was actually an employee. Stone tweeted that she left DefCon early because of the incident.
After Cynthia and Keith declined to disclose their last names to me, I asked what they intended to do in the room. They told me that they would enter it, type a code into the room's phone line to signal that it's been checked, and then do a visual spot check. When I asked what they would be looking for, Cynthia replied, "WMDs -- that sort of thing." Other conference attendees reported similar but less pleasant interactions. Katie Moussouris, CEO of Luta Security, wrote on Twitter that two hotel security personnel were "banging" on her room door and "shouted" at her. She also said the hotel's security team supervisor "dismissed" her concerns over how the hotel was treating single, female travelers. Google security engineer Maddie Stone tweeted that a man wearing a light-blue shirt and a walkie-talkie entered her Caesars Palace room with a key, but without knocking, while she was getting dressed. "He left when I started screaming," she wrote, adding that a hotel manager, upon her request, said Caesars would look into whether the man was actually an employee. Stone tweeted that she left DefCon early because of the incident.
Shooting the guy who entered while she was dressing would have helped educate him and others for the future...
Simple - Why on earth would you use that place to host your customers if that's how they're going to be treated.
I'd get the f*ck out of there and never come back.
Unfortunately, it isn't clear whether the hotel was inspecting the rooms of all guests or just Defcon/BlackHat attendees. I'm assuming the former, since the Vegas shooter wasn't involving in the CompSec scene. Since this hasn't been reported widely, it could be just selectively enforced as most security theater.
Google security engineer Maddie Stone tweeted that a man wearing a light-blue shirt and a walkie-talkie entered her Caesars Palace room with a key, but without knocking, while she was getting dressed.
Before I saying anything, to be clear:
1. Ms. Stone did nothing wrong.
2. The man entering the room was absolutely criminal in entering a room like that without knocking.
That said, when you're in your room, lock your doors. Use the deadbolt, use the little chain, and anything else available.
Normally, the deadbolt alone will prevent the key card from working.
While the chain is nearly useless from keeping someone from breaking in, it gives a few seconds of delay to the intruder, giving you time to respond.
Same category as leaving your laptop in the passenger seat of a car. You don't deserve to have your window smashed and laptop stolen, and it is NOT your fault if someone does it.
It still is a better idea to put it out of sight, though.
Grammer Nazis - I mod you "troll" unless you actually add something on-topic. Yes, I know I have mispellings in my sig.
If it starts to dip because no one wants to be subjected to this shit, the venue will soon be changed.
Nah, we're more the passive-aggressive type. We FUBAR your card-based hotel room locks to retaliate.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
I usually leave an USB key or two lying about in my hotel room. If you're lucky, you steal the one with the malware. If you're unlucky, you steal that one.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
When that shooter was allowed to carry all that hardware, unchecked, and massacred all those innocent people, that was a hotel fuck-up.
It's not like the guy was just strolling through the lobby with a couple AR-15s with 100-rd drum mags slung over his shoulder. He brought them in in bags. Even the number of bags he used, if they could even passively track how many bags he actually had, isn't excessive for Vegas with all the conventions, meetings, etc. So unless you think hotels need to start doing bag checks or xraying everything there's not much they can do.
The only thing necessary for evil to triumph is for it to be pitted against a slightly greater evil
Well, back in McCarthy's time people at least folded when asked "have you no shame, have you no decency?"
Today, they'd simply say "nope" and carry on.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
It's hotel property that they agreed to rent to you. There are laws governing this agreement, among them being hotel staff can't barge in to your room whenever they like.
https://www.gsblaw.com/duff-on-hospitality-law/guest-room-privacy-and-the-fourth-amendment
That link only discusses the 4th amendment expiations of a hotel gest. Hotels may not allow searches of a room without a warrant, but hotel employees may enter rooms for cleaning and maintenance. So they can fix and clean stuff, but they may not allow Police access w/o a warrant.
The question here is one of self defense. Are you afforded your 2nd amendment rights in a hotel room? The answer basically is that you have all the same rights you would have if the room was your home. So, if you can legally shoot an intruder entering your home in the local jurisdiction, you can do the same in your hotel room under the same circumstances.
In NV, had the guy been shot entering a guests room, there would be serious legal issues for the shooter. The shooter would have to justify their belief that deadly force was required (as opposed to less force) and it would be a hard hill to climb. But this is NV where you have to justify the use of force. In other states, the assumption would be in favor of the shooter, where the state would have the burden of proof that the shooting was unjust.
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
That's why I always have 2 wedges in my baggage, to put under the hotel door, blocking it, so that nobody can enter while I'm in the room, key or no key, cleaning, security or robbers.
Comment removed based on user account deletion
They don't want you anyway.
The few attendees who s tweet bloody murder about this were in rooms with signs "Don't disturb" hanging for days, and had gotten in with large cases of who knows what. In modern Murricah, that's an invitation for a check. Nobody wants to be the next place where the mass murderer shoots from.
So many comments from people who don't go to Las Vegas often.
After the shooting, hotel policies changed at ALL hotels on the Strip, among all companies. As someone who stays at Caesars properties heavily and at MGM properties occasionally, I can tell you that the "Do Not Disturb sign is a thing of the past. DefCon attendees in particular should be aware of this, and caterwauling on Slashdot is a sign of their own obliviousness. The Strip hotel I'm staying at now says "Room Occupied" on the front -- not "Do Not Disturb". No one has "Do Not Disturb" any more, and it says right there on the sign in not-quite-fine-print:
While you are actively in the room, if you wish for privacy, you should lock the deadbolt and engage the latch. If security is making a check, that allows you to have them not walk in on you naked, but it doesn't mean they won't ask to be let in to do a verification.
As with police (who don't have a warrant), if you have concern about their identification, call down to the Operator/Front Desk to verify that they're an employee before letting them in.
To re-iterate, after the Vegas shooting this is standard policy across the board at ALL HOTELS. In case anyone missed it, MGM got a lot of flack for missing the signs here, where a security check might have caught something obvious. One might argue that they should have made this more explicit via a press release, but if you're here a lot it's obvious already what's changed. As to whether DefCon attendees were more singled out in particular, it would be hard to say. If I were hotel security, I'd have more reason to suspect them of ripping apart the Ethernet jacks or something and trying to hack into the hotel security system than anything with weapons -- an elevated stance is probably expected.
Hire a Linux system administrator, systems engineer,
Well done, that comment is a pretty good example of modern discourse.
"My opponent is in favor of letting people barge into rooms and rape the occupants. My opponent opposes people defending themselves from rape."
Yeah, I'm sure you really accurately captured the essence of that argument. Great job.
"Our two-party system is like a bowl of shit looking at itself in a mirror." - Lewis Black
Now you're proposing that hotel security employees are going to force their way through a privacy lock that a) conclusively demonstrates that someone is in the room, and b) conclusively demonstrates they have made a conscious decision to enforce their privacy.
At that point, the hotel employees do deserve to be shot and killed for forcing their way in.
This isn't about attendees illegally breaking into each other's rooms at a hacker conference to rape their teddy bears. This is about hotel security employees inspecting rooms without notice. Try to pay attention.
You can let them in, but you don't have to be nice or polite. "You done yet, guy?" "OK, now get the fuck out of my room." "See you tomorrow, lady."
If everyone was abrasive and abusive to hotel suckurity "just doin' their jobs, doot de doot de doot" then there would be fewer people willing to do the job. Or at least they'd make the checks more cursory and faster, since no one enjoys being the target of rudeness and anger.
Gee, I can't imagine why some techies get bad reputations as complete douchebags *eyeroll*
Just because someone has a job you dislike, doesn't mean being a complete dick about it is the proper response. I stay in Vegas a lot and I've *never* had an unprofessional experience, nor one that lasted longer than 30 seconds at most. Long enough to look around, confirm I hadn't trashed the place, confirm I didn't have 10 suitcases with me for no apparent reason, and confirm wasn't currently recreating Lain Iwakawa's bedroom, then dial a code to confirm entry and that was that.
If you have a problem, bring it up with management maybe. Don't bring it up with the lady just doing her job. Do you yell at Chick-fil-A drive-through employees too?
Hire a Linux system administrator, systems engineer,
Just out of curiosity, why did you feel the need to mention the shooter's race three times?
"Our two-party system is like a bowl of shit looking at itself in a mirror." - Lewis Black