Language Selection

English French German Italian Portuguese Spanish

Hacking the hotel through the TV

Filed under
Security

When Adam Laurie stays at hotels, he says he can hack his way around paying for premium TV channels, the minibar and phone calls.

What's more, by connecting his laptop to certain modern hotel TV systems, Laurie says he can spy on other guests. He can't look into their rooms (yet), but depending on the system he can see what they are watching on their TV, look at their guest folios, change the minibar bill and follow along as they browse the Internet on the hotel TV.

To tease his fellow guests, he can also check them out of their room and set early wake up calls via the TV.

Laurie can do all this because of what he calls the "inverted security model" of the systems. "The TV is controlling which content I get to see. The hotel in most cases is streaming all content without any control," Laurie said in a presentation Saturday at the Defcon event for security professionals and enthusiasts here.

By plugging the hotel TV cable into a USB TV tuner connected to a laptop computer, Laurie can hack his way into the back-end systems controlling the entertainment and other convenience features found in modern hotels, he said in his presentation.

He found that many of those systems give access to information depending on an ID associated with the room's TV. By changing that ID, he said that he was able to access information for other rooms. Many of such hotel systems show guest bills, phone and room service records and offer video check-out.

Laurie found that the hotel TV systems also have special controls for hotel employees. Housekeeping staff can report a room as clean, for example. Additionally, he found that some systems let room service staff input billing for the minibar, which he now controlled.

"Sometimes you can actually control physical devices," Laurie said. In one Holiday Inn hotel he found the system controlled an electronic lock on the minibar.

While staying at a Hilton hotel in Paris, Laurie automated his hack and placed a camera in front of the TV. He snapped pictures of every screen and found out the occupancy rate of the hotel, the names of the guests, what they were paying, where they were calling and how long they had been at the hotel. He showed the pictures at Defcon, but obscured the guest names.

Full Story.

More in Tux Machines

System76's Pop!_OS Linux to Get a Beta Release Next Week with HiDPI Improvements

System76 is getting ready to unleash the first Beta release of their upcoming Pop!_OS Linux distribution, which should be available to download next week based on the Ubuntu 17.10 Final Beta. It appears that System76's development team recently dropped focus on the Pop!_OS Installer, which they develop in collaboration with the elementary OS team, to concentrate on fixing critical bugs and add the final touches to the Beta release. They still need to add some patches to fix backlight brightness issues on Nvidia GPUs. Read more

Server: Red Hat, Security, Samba, Docker, Microsoft Canonical and MongoDB

PocketBeagle and Android

Desktop: AKiTiO Node, Ubuntu Podcast, Vivaldi, Chromium and HUION PenTablet

  • AKiTiO Node: Testing NVIDIA eGPU Support in Ubuntu 17.10
    Ever since the announcement of Intel’s Thunderbolt 3 technology there has been external graphics card (eGPU) support. Unfortunately for most of last year, including with Intel’s own Skull Canyon NUC, putting this solution to use was challenging at best. Most motherboards didn’t fully support the technology and those that did typically required a system that was far more expensive. For example, the Skull Canyon NUC at release was $700, unconfigured. Adding SSDs and RAM usually bumped that up well over $1000.
  • Ubuntu Podcast from the UK LoCo: S10E29 – Adamant Terrible Hammer
    It’s Season Ten Episode Twenty-Nine of the Ubuntu Podcast! Alan Pope, Martin Wimpress, Marius Quabeck, Max Kristen, Rudy and Tiago Carrondo are connected and speaking to your brain.
  • Vivaldi 1.12 Web Browser Debuts with Highly Requested Features, Improvements
    Vivaldi, the Chromium-based web browser designed with the power user in mind, has been recently updated to version 1.12, a release that introduces highly requested features and a whole lot of under-the-hood improvements. There are three big new features implemented in Vivaldi 1.12. The first is a built-in Image Properties feature that works when you right-click on an image on the Web, showing you a bunch of useful information, such as camera model, depth of field, ISO sensitivity, focal length, exposure, histogram, time and date, and white balance.
  • Chromium Will Soon Let You Browse the Web in VR with a Daydream View Headset
    Chromium evangelist François Beaufort posted today on his Google+ profile information regarding the VR (Virtual Reality) capabilities of the open-source web browser, which is the base of Chrome OS and Google Chrome. It would appear that the Chromium team is working on a set of new virtual reality features for the web browser, which means that more VR goodies are coming to popular Chromium-based web browsers like Opera, Vivaldi, and Google Chrome.
  • libinput and the HUION PenTablet devices
    HUION PenTablet devices are graphics tablet devices aimed at artists. These tablets tend to aim for the lower end of the market, driver support is often somewhere between meh and disappointing. The DIGImend project used to take care of them, but with that out of the picture, the bugs bubble up to userspace more often.