Slashdot Mirror
Tencent Security Researcher Fined For Hacking Hotel WiFi and Publishing Internal Network Credentials Online (zdnet.com)
Catalin Cimpanu, writing for ZDNet: Singapore authorities have fined a Chinese security researcher with SGD$5,000 (USD$3,600) for hacking into a local hotel's WiFi system without authorization and then publishing a blog post about it, revealing passwords for the hotel's internal network. The incident took place at the end of August, this year, when Zheng Dutao, 23, of China, visited Singapore to attend the Hack In The Box conference that took place in the city. Zheng took it upon himself, without asking for permission first, to hack into the WiFi network of a Fragrance Hotel branch, where he checked in for the conference's duration. The researcher, who works for Chinese internet giant Tencent, hacked into the hotel's internet gateway system, an AntLabs IG3100 device that controls access to the WiFi network for staff and guests alike. He discovered that the device was using a factory default Telnet password, which he used to gain access to a limited shell on the device. [...] The researcher didn't report the security issues to the hotel but instead wrote a blog post about his findings, which he later shared online.
Time to change the default configuration so that if you want Telnet you have to manually enable it.
So trying a default password on a device is "hacking" now? That makes me sad.
There was no good reason for that. That's the point where it turned criminal for me. For others the point might have come earlier (I assume that he didn't cause any damage before that).
Bad passwords are no excuse for hacking. It may be a reason to put blame on the hacked organisation as well, especially if they are supposed to keep stuff safe. But primarily it's the hacker's fault, no matter how easy it was.
Aaron Schwartz.
"to hack into the WiFi network of a Fragrance Hotel branch"
If you tell it like that.
No need for exaggeration. He'd definitely be charged with a crime for unauthorized access and face jail time if he were in the US, and that's bad enough.
https://www.eff.org/https-everywhere
This took place in Singapore and, as anyone who's ever worked in Singapore knows, almost everything is illegal and punishable by fines, canings, beatings or imprisonment. The authorities fine you $500 for carrying a Durian fruit on the subway...
Tencent, along with QQ, represents the shithole of the internet. I've had to block their entire assignment of IP addresses because nothing but intrusion and spam-sending attempts come from them. Good riddance!
No need for exaggeration. He'd definitely be charged with a crime for unauthorized access and face jail time if he were in the US, and that's bad enough.
Why is that bad? He obtained login credentials that he wasn't authorized to have and posted them for the rest of the world to take advantage of, without telling the hotel that they had a problem.
Had he stopped at telling the hotel and let them fix it, that would be one thing. He didn't even bother telling them, but he told all his "hacker friends" so they could take advantage of the system.
I'll be there in a couple of months, so I've been researching in advance.
Must not import chewing gum!
The potential for harm to the customer service of that hotel, if not fully informed about the lack of security on the hotel network, outweighs the concern for the hotel who was negligent in securing their IT.
Correction. The customers served by the hotel
and no link to blog post so I can decide myself if that was a hack or just using the default password.