Big Vulnerability In Hotel Wi-Fi Router Puts Guests At Risk 40
An anonymous reader writes Guests at hundreds of hotels around the world are susceptible to serious hacks because of routers that many hotel chains depend on for their Wi-Fi networks. Researchers have discovered a vulnerability in the systems, which would allow an attacker to distribute malware to guests, monitor and record data sent over the network, and even possibly gain access to the hotel's reservation and keycard systems. The vulnerability, which was discovered by Justin W. Clarke of the security firm Cylance, gives attackers read-write access to the root file system of the ANTlabs devices. The discovery of the vulnerable systems was particularly interesting to them in light of an active hotel hacking campaign uncovered last year by researchers at Kaspersky Lab. In that campaign, which Kaspersky dubbed DarkHotel.
Re: (Score:2)
In that campaign, which Kaspersky dubbed DarkHotel.
I think Slashdot is trying to woo the beat poetry crowd.
Cookie authenticated or open WiFi is insecure? (Score:4, Insightful)
Isn't it sort of obvious that hotel networks are a free-for-all security wise?
Use a VPN and SSL.
Re: (Score:1)
Isn't it sort of obvious that unencrypted connections over the internet are a free-for-(smart people or big organizations) security wise?
That's why I always use https://slashdot.org [slashdot.org]
Re:Cookie authenticated or open WiFi is insecure? (Score:5, Interesting)
An encrypted VPN might not help you in this case. Most hotel WiFi setups require you to go through a landing page first (captive portal), before internet access is released. This would still expose you to the same vulnerabilities.
Re:Cookie authenticated or open WiFi is insecure? (Score:5, Informative)
Isn't it sort of obvious that hotel networks are a free-for-all security wise?
Use a VPN and SSL.
RTFA; that won't help.
The problem is that before you can connect out to use your VPN, you first have to get provisioned by the hotel's wifi. This involves at a minimum checking a box that says "I won't try to hack or do bad things," along with either authorizing a charge, giving the webpage your hotel frequent traveler info/name and room number, or authorizing a charge for the Internet access. Those pages are what put you at risk; the attacker hacks the router that serves up the page, adds a nice little bit of extra code to serve up malware (that he also uploads to the router itself, so no need for outside Internet to get it), and boom...everyone with a vulnerable system that connects in that hotel gets pwned.
And that's beyond the risk of the machine serving as a jump-point for deeper penetration into the hotel itself. How is your using a VPN going to protect the hotel's keycard system from being hacked? Or protect your private information that resides in the reservation system?
Re: (Score:2)
everyone with a vulnerable system that connects in that hotel gets pwned.
Everyone with a vulnerable system gets pwned anyway.
Re: (Score:3)
Isn't it sort of obvious that hotel networks are a free-for-all security wise?
Of course, it is obvious. If we ponder a little bit further, we would know that the main purpose of hotel is for temporarly stay, not Internet services. So can't expect the latter service quality to be secured. ;)
Re: (Score:2)
What you use is noscript, and then you allow only the scripts necessary to get the portal working, and you don't run any flash or java from the portal, etc etc. And you keep your browser updated. It's not rocket surgery. It's not foolproof, but it's best to act as little like a fool as possible.
Tom Bodette will leave the wifi on for you (Score:3)
Re:Tom Bodette will leave the wifi on for you (Score:4, Insightful)
And? (Score:5, Interesting)
Hotel wireless is already a risk anyway.
Let's assume the wireless is open. Then anyone and everyone in an adjoining room can sniff everything you do over it anyway.
Let's assume that you are given the key to join the network. Anyone else who has the same key - same thing. AP isolation doesn't save you against someone recording your traffic and having access to the key used to encrypt it.
Wireless is UNTRUSTED. Even wired is UNTRUSTED. You do not know who's pushing that Facebook DNS entry to you, nor that the Facebook TLS is properly signed if you can't rely on the DNS entry.
When you're not using your own networks, use a VPN. That way you don't even have to care if someone bothered to put even WEP on the connection - the VPN gives you the security for your data. However, be sure that if you're doing this, you have a firewall (you are STUPID if you don't) as anything else can send you traffic in these instances too, no encryption, WEP, WPA, WPA2, it doesn't matter.
Every time someone says "join my wireless", replace it mentally with "just plug this cable that connects to all my local machines and also every guest that's ever had the same offer, into your laptop".
Firewall it. VPN it. Then you don't even need to care that it's an open network. And, shockingly, the same config will work with cabled networks.
And if it doesn't work? You don't want to use that connection. Any hotel that breaks your VPN is one that's almost certainly providing some poor replacement for it.
Re: (Score:2)
I've used a range of options over the years depending on circumstances from VPN, to my access point hardwired to their network to MiFi. While it's likely all/most readers here can do those things and more, that's not the point.
The point is most of the general public doesn't understand. Yes we can, and prolly do laugh and snicker at the luddites, unwashed and ignorant. In truth what hurts them, hurts us. Calling them "stupid" doesn't help, most of them are ignorant not stupid anyway. Is it really that u
Re: (Score:1)
laugh and snicker at the luddites
The Luddites will be just fine in these hotels of which you speak, readng their paperback novels and engaging in other analog activities.
Re: And? (Score:1)
Reading paperback novels is a digital activity. Have you tried holding one open without using your fingers?
Re: (Score:3)
nor that the Facebook TLS is properly signed if you can't rely on the DNS entry.
TLS doesn't depend on DNS working properly and not being corrupted. Its job, is in fact, to alert you of the fact that things like DNS corruption are taking place, or that someone is intercepting your traffic.
Re: (Score:2)
Wireless is UNTRUSTED. Even wired is UNTRUSTED.
The Internet is untrusted. Period.
Even an intranet should generally be untrusted. Every machine needs to be responsible for defending itself; no machine should assume that other things on the network are good actors.
I just skip the "free" wifi (Score:3)
There is a reason why I generally use LTE through my phone instead of "free" wifi when traveling. Not only is the LTE usually faster and less geographically constrained, but I don't have nearly as many security or connectivity problems 99% of the time. I've been behind the scenes at some restaurants and hotels and the "security" setup pretty much convinced me that free wifi is generally not worth the risk if you have a viable alternative. I assure you that many hotels and probably most restaurants do not have a crack IT staff maintaining their system. It's about as basic and insecure as you can possibly imagine. I've even had to point out to a franchised restaurant that they had the free wifi on the same subnet as their internal computers with zero protection of any kind.
Re: (Score:2)
And Marriot wanted the ability to block you from using your mobile hotspot, forcing you on the hotel's wireless network for "security reasons." Thankfully, they withdrew the request when it became apparent that a) it wouldn't be granted and b) there was a ton of bad PR being generated by this move. Still, this insecure hotel wi-fi story makes that request even more laughable.
You have got to be shitting me? (Score:1)
You have got to be shitting me? Folks, you would think the designers of these 'secure' base stations would have wondered how to protect against cell site spoofing. Besides which, it is currently illegal in the EU to sell mobile phones that cannot be intercepted regardless of the level of 'security'
'Stingrays Go Mainstream: 2014 in Review [eff.org]'
Looking for the least worst solution (Score:2)
You have got to be shitting me?
Not in the slightest. I've seen the hardware and setup for a few hotels and and a lot of restaurants with my own eyes. While I'm sure there are plenty of security issues with LTE, I know for a fact that plenty of public free wifi is about as clean as a $2 hooker.
Folks, you would think the designers of these 'secure' base stations would have wondered how to protect against cell site spoofing.
Please point me to a single instance of non-governmental cell site spoofing outside of black-hat hacking conferences. This simply is not a significant problem. Highly insecure wifi is a significant problem. Extremely slow and annoying public w
More reasons to worry (Score:2)
Not mentioning how you can also (even more) easily impersonate
Public WiFi == Hostile Network (Score:1)
All hotel networks should be treated as hostile, they typically have no meaningful security.
I routinely sniff hotel networks. After checkin I fire up Driftnet to see what others are up to. I'm really surprised at the LACK of porn. Nearly none in most cases.
Re: (Score:2)
Sniff porn?
Who knew?
Lawfull intercept backdoor? (Score:1)
Lawfull Intercept [antlabs.com]
- Monitoring of Networks
- Comply with legistative requirements
- Local storage of logs
"Gaining access to a guest room through a compromised key lock system wouldn’t just be of interest to thieves. One of the most famous cases involving the subversion of a hotel’s electronic [wired.com]
Last time on vacation (Score:1)
I used the hotel internet just long enough to get on (using the browser to type in the magic word for full access), then RDPing into my home system (and then dealing with somebody who has their own computer, but was still using my home computer), to get what I needed accomplished. Get home, and find out that searches were now hijacked. A scan fixed the problem, but my home system wasn't infested, not that RDP is an attack vector that I'm aware of, and since the only pages I loaded were the hotels, it doe
Re: (Score:1)
not that RDP is an attack vector that I'm aware of
Google RDP MitM to learn about it.
Re: (Score:1)
Interesting. But I know the IP address that I was using, so a MITM attack wasn't really something I was worried about, it was more of an attack from my own machine that I was thinking. Unless somebody really had it out for me and was spoofing my home IP address as well. Of which, one use every few years, that doesn't sound like an attack vector that would be given that much rope just to wait to see if I was RDPing in. I'm much more inclined that to think that it was the ad network.