Feeds

Infrared exploits open the door to hotel hacking

Free smut - do not disturb

  • alert
  • submit to reddit

5 things you didn’t know about cloud backup

Insecure hotel infra-red systems create a means for hackers to read other guest's emails, watch porno films for free and put false charges onto other guest's accounts. Adam Laurie, technical director at secure hosting outfit The Bunker, was able to demonstrate the attacks to Wired prior to giving a talk on the vulnerabilities at last week's DefCon conference in Las Vegas.

Using only a laptop and a USB TV tuner, Laurie was able to use an infrared connection to a hotel's web-enabled TV to tune into data that the backend system is broadcasting but he shouldn't be able to receive. In this way he was able to view premium content, access backend billing systems and view emails of guests who accessed web mail services via their TV. He was also able to access the desktop of backend computers and launch applications. "No one thinks about the security risks of infrared because they think it's used for minor things like garage doors and TV remotes," Laurie said. "But infrared uses really simple codes, and they don't put any kind of authentication (in it)... If the system was designed properly, I shouldn't be able to do what I can do."

"As far as the hotel is concerned, you're the only person who can see (your bill). But they're sending your confidential data over the air through a broadcast system. It's the equivalent of running an open wireless access point. If I tune my TV to your channel, then I get to see what you're doing," Laurie told Wired.

Infrared systems are used throughout hotels in air conditioning systems, vending machines and many other pieces of equipment but it's their use in hotel TV systems that connect to backend and billing systems that represent the greatest scope for mischief. Laurie said that many hotel infrared systems are rolled out with password controls or back-end authentication that would frustrate exploitation. Data is commonly stored and transmitted in the clear without protection from encryption. Because most hotel use similar systems from a small number of suppliers, Laurie has been able to replicate the attack across the world over the last two years.

Laurie discovered the security loophole when he was "mucking about with hotel TVs to get the porn channel without paying for it". Tuning into content that's been broadcast but a hotel TV is not configured to receive is one thing - and might be carried out by tuning in a VCR - but Laurie was able to take this further by deciphering the codes transmitted from a remote control device to a TV. Laurie has created a program to analyse and map the codes and a script to test out their effect when sent to his TV. He did this for research purposes and doesn't plan to release the tools.

As more devices become network enabled the scope for hacking increases. Laurie's work shows the issue is not just confined to devices connected to the web. Infra-red (and conceivably Bluetooth) connected systems might also be exploited. ®

Related stories

Bluetooth is attack vector for mobile phones
Security researchers nibble at Bluetooth
Cisco retails networked hotel vision
The digital home cometh, says Intel

Next gen security for virtualised datacentres

More from The Register

next story
Microsoft: We plan to CLEAN UP this here Windows Store town
Paid-for apps that provide free downloads? Really
Snowden on NSA's MonsterMind TERROR: It may trigger cyberwar
Plus: Syria's internet going down? That was a US cock-up
Who needs hackers? 'Password1' opens a third of all biz doors
GPU-powered pen test yields more bad news about defences and passwords
e-Borders fiasco: Brits stung for £224m after US IT giant sues UK govt
Defeat to Raytheon branded 'catastrophic result'
Hear ye, young cyber warriors of the realm: GCHQ wants you
Get involved, get a job and then never discuss work ever again
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
Microsoft cries UNINSTALL in the wake of Blue Screens of Death™
Cache crash causes contained choloric calamity
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 10 endpoint backup mistakes
Avoid the ten endpoint backup mistakes to ensure that your critical corporate data is protected and end user productivity is improved.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Rethinking backup and recovery in the modern data center
Combining intelligence, operational analytics, and automation to enable efficient, data-driven IT organizations using the HP ABR approach.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.