Feeds

Infrared exploits open the door to hotel hacking

Free smut - do not disturb

  • alert
  • submit to reddit

Protecting against web application threats using SSL

Insecure hotel infra-red systems create a means for hackers to read other guest's emails, watch porno films for free and put false charges onto other guest's accounts. Adam Laurie, technical director at secure hosting outfit The Bunker, was able to demonstrate the attacks to Wired prior to giving a talk on the vulnerabilities at last week's DefCon conference in Las Vegas.

Using only a laptop and a USB TV tuner, Laurie was able to use an infrared connection to a hotel's web-enabled TV to tune into data that the backend system is broadcasting but he shouldn't be able to receive. In this way he was able to view premium content, access backend billing systems and view emails of guests who accessed web mail services via their TV. He was also able to access the desktop of backend computers and launch applications. "No one thinks about the security risks of infrared because they think it's used for minor things like garage doors and TV remotes," Laurie said. "But infrared uses really simple codes, and they don't put any kind of authentication (in it)... If the system was designed properly, I shouldn't be able to do what I can do."

"As far as the hotel is concerned, you're the only person who can see (your bill). But they're sending your confidential data over the air through a broadcast system. It's the equivalent of running an open wireless access point. If I tune my TV to your channel, then I get to see what you're doing," Laurie told Wired.

Infrared systems are used throughout hotels in air conditioning systems, vending machines and many other pieces of equipment but it's their use in hotel TV systems that connect to backend and billing systems that represent the greatest scope for mischief. Laurie said that many hotel infrared systems are rolled out with password controls or back-end authentication that would frustrate exploitation. Data is commonly stored and transmitted in the clear without protection from encryption. Because most hotel use similar systems from a small number of suppliers, Laurie has been able to replicate the attack across the world over the last two years.

Laurie discovered the security loophole when he was "mucking about with hotel TVs to get the porn channel without paying for it". Tuning into content that's been broadcast but a hotel TV is not configured to receive is one thing - and might be carried out by tuning in a VCR - but Laurie was able to take this further by deciphering the codes transmitted from a remote control device to a TV. Laurie has created a program to analyse and map the codes and a script to test out their effect when sent to his TV. He did this for research purposes and doesn't plan to release the tools.

As more devices become network enabled the scope for hacking increases. Laurie's work shows the issue is not just confined to devices connected to the web. Infra-red (and conceivably Bluetooth) connected systems might also be exploited. ®

Related stories

Bluetooth is attack vector for mobile phones
Security researchers nibble at Bluetooth
Cisco retails networked hotel vision
The digital home cometh, says Intel

Reducing the cost and complexity of web vulnerability management

More from The Register

next story
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
Jihadi terrorists DIDN'T encrypt their comms 'cos of Snowden leaks
Intel bods' analysis concludes 'no significant change' after whistle was blown
Home Depot: 56 million bank cards pwned by malware in our tills
That's about 50 per cent bigger than the Target tills mega-hack
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
China hacked US Army transport orgs TWENTY TIMES in ONE YEAR
FBI et al knew of nine hacks - but didn't tell TRANSCOM
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.