Feeds

Infrared exploits open the door to hotel hacking

Free smut - do not disturb

  • alert
  • submit to reddit

The Power of One eBook: Top reasons to choose HP BladeSystem

Insecure hotel infra-red systems create a means for hackers to read other guest's emails, watch porno films for free and put false charges onto other guest's accounts. Adam Laurie, technical director at secure hosting outfit The Bunker, was able to demonstrate the attacks to Wired prior to giving a talk on the vulnerabilities at last week's DefCon conference in Las Vegas.

Using only a laptop and a USB TV tuner, Laurie was able to use an infrared connection to a hotel's web-enabled TV to tune into data that the backend system is broadcasting but he shouldn't be able to receive. In this way he was able to view premium content, access backend billing systems and view emails of guests who accessed web mail services via their TV. He was also able to access the desktop of backend computers and launch applications. "No one thinks about the security risks of infrared because they think it's used for minor things like garage doors and TV remotes," Laurie said. "But infrared uses really simple codes, and they don't put any kind of authentication (in it)... If the system was designed properly, I shouldn't be able to do what I can do."

"As far as the hotel is concerned, you're the only person who can see (your bill). But they're sending your confidential data over the air through a broadcast system. It's the equivalent of running an open wireless access point. If I tune my TV to your channel, then I get to see what you're doing," Laurie told Wired.

Infrared systems are used throughout hotels in air conditioning systems, vending machines and many other pieces of equipment but it's their use in hotel TV systems that connect to backend and billing systems that represent the greatest scope for mischief. Laurie said that many hotel infrared systems are rolled out with password controls or back-end authentication that would frustrate exploitation. Data is commonly stored and transmitted in the clear without protection from encryption. Because most hotel use similar systems from a small number of suppliers, Laurie has been able to replicate the attack across the world over the last two years.

Laurie discovered the security loophole when he was "mucking about with hotel TVs to get the porn channel without paying for it". Tuning into content that's been broadcast but a hotel TV is not configured to receive is one thing - and might be carried out by tuning in a VCR - but Laurie was able to take this further by deciphering the codes transmitted from a remote control device to a TV. Laurie has created a program to analyse and map the codes and a script to test out their effect when sent to his TV. He did this for research purposes and doesn't plan to release the tools.

As more devices become network enabled the scope for hacking increases. Laurie's work shows the issue is not just confined to devices connected to the web. Infra-red (and conceivably Bluetooth) connected systems might also be exploited. ®

Related stories

Bluetooth is attack vector for mobile phones
Security researchers nibble at Bluetooth
Cisco retails networked hotel vision
The digital home cometh, says Intel

Designing a Defense for Mobile Applications

More from The Register

next story
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
Four fake Google haxbots hit YOUR WEBSITE every day
Goog the perfect ruse to slip into SEO orfice
Putin: Crack Tor for me and I'll make you a MILLIONAIRE
Russian Interior Ministry offers big pile o' roubles for busting pro-privacy browser
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.