Slashdot Mirror
Tencent Security Researcher Fined For Hacking Hotel WiFi and Publishing Internal Network Credentials Online (zdnet.com)
Catalin Cimpanu, writing for ZDNet: Singapore authorities have fined a Chinese security researcher with SGD$5,000 (USD$3,600) for hacking into a local hotel's WiFi system without authorization and then publishing a blog post about it, revealing passwords for the hotel's internal network. The incident took place at the end of August, this year, when Zheng Dutao, 23, of China, visited Singapore to attend the Hack In The Box conference that took place in the city. Zheng took it upon himself, without asking for permission first, to hack into the WiFi network of a Fragrance Hotel branch, where he checked in for the conference's duration. The researcher, who works for Chinese internet giant Tencent, hacked into the hotel's internet gateway system, an AntLabs IG3100 device that controls access to the WiFi network for staff and guests alike. He discovered that the device was using a factory default Telnet password, which he used to gain access to a limited shell on the device. [...] The researcher didn't report the security issues to the hotel but instead wrote a blog post about his findings, which he later shared online.
Time to change the default configuration so that if you want Telnet you have to manually enable it.
So trying a default password on a device is "hacking" now? That makes me sad.
he'd have been charged with life in prison for being a terrorist and whatever else.
There was no good reason for that. That's the point where it turned criminal for me. For others the point might have come earlier (I assume that he didn't cause any damage before that).
Bad passwords are no excuse for hacking. It may be a reason to put blame on the hacked organisation as well, especially if they are supposed to keep stuff safe. But primarily it's the hacker's fault, no matter how easy it was.
Give them better passwords.
"to hack into the WiFi network of a Fragrance Hotel branch"
If you tell it like that.
Just sayin...
Organizations don't like looking stupid in public.
Especially when they are stupid.
This was why the state of Georgia in the USA was trying to push through a new cyber security law this year - because someone accessed state voting information by changing a URL from HTTPS to HTTP. They (the state's lawyers) called that "hacking." It was more about making the Secretary of State look stupid. We tried to work with the representatives to make a good law, but they refused. That's putting it nicely. They didn't want to discuss any options or changes at all. The new law was written by the state's attorneys. They wanted a yes/no vote in the two houses and got it approved. That Dog that the governor, who is leaving office, refused to sign it into law. Sadly, the next governor will be the SoS who setup the voting systems and has been screwing over Georgians. And he's the better choice on the ballot.
The law got backing from companies in the state, because it would make any access, even without "hacking" for things that weren't meant to be available, a crime. Delete an "S", be convicted of a crime. Total BS.
Don't embarrass organizations, even when that is the only way to get any movement towards security from them.
Sad, so sad.
Tencent, along with QQ, represents the shithole of the internet. I've had to block their entire assignment of IP addresses because nothing but intrusion and spam-sending attempts come from them. Good riddance!
What the Fuck with these people being called, "researchers"?
That's like calling a burglar a Security Consultant.
Fuck you. Execute this Piece of shit and hang his body from a bridge.
I don't get the people talking of "what about the poor hotel?"
What about the poor customers? What about the thousands upon thousands of people who are at greater risk to theft and extortion because of the hotel's gross negligence?
I agree that the researcher making a public blog post without informing the hotel was a tacky thing to do, but the only victim of bad security isn't the business. The business isn't even the main victim. It's the many, many consumers who the business advertises its services to.
and no link to blog post so I can decide myself if that was a hack or just using the default password.