Language Selection

English French German Italian Portuguese Spanish

Hacking the hotel through the TV

Filed under
Security

When Adam Laurie stays at hotels, he says he can hack his way around paying for premium TV channels, the minibar and phone calls.

What's more, by connecting his laptop to certain modern hotel TV systems, Laurie says he can spy on other guests. He can't look into their rooms (yet), but depending on the system he can see what they are watching on their TV, look at their guest folios, change the minibar bill and follow along as they browse the Internet on the hotel TV.

To tease his fellow guests, he can also check them out of their room and set early wake up calls via the TV.

Laurie can do all this because of what he calls the "inverted security model" of the systems. "The TV is controlling which content I get to see. The hotel in most cases is streaming all content without any control," Laurie said in a presentation Saturday at the Defcon event for security professionals and enthusiasts here.

By plugging the hotel TV cable into a USB TV tuner connected to a laptop computer, Laurie can hack his way into the back-end systems controlling the entertainment and other convenience features found in modern hotels, he said in his presentation.

He found that many of those systems give access to information depending on an ID associated with the room's TV. By changing that ID, he said that he was able to access information for other rooms. Many of such hotel systems show guest bills, phone and room service records and offer video check-out.

Laurie found that the hotel TV systems also have special controls for hotel employees. Housekeeping staff can report a room as clean, for example. Additionally, he found that some systems let room service staff input billing for the minibar, which he now controlled.

"Sometimes you can actually control physical devices," Laurie said. In one Holiday Inn hotel he found the system controlled an electronic lock on the minibar.

While staying at a Hilton hotel in Paris, Laurie automated his hack and placed a camera in front of the TV. He snapped pictures of every screen and found out the occupancy rate of the hotel, the names of the guests, what they were paying, where they were calling and how long they had been at the hotel. He showed the pictures at Defcon, but obscured the guest names.

Full Story.

More in Tux Machines

SUSE Leftovers

  • OBS got the power!
    Old build workers, rack mounted Old build workers, rack mounted One year after introducing a new kind of Open Build Service worker machines, the “lambkins”, the openSUSE Build Service got a big hardware refresh. The new machines, sponsored by SUSE, are equipped with: 2,8GHz AMD Opteron Processors (6348) 256 GB RAM one 120 GB SSD Four of them are located in a chassis with a height of 2 units and run 12-16 workers on them (virtual machines, that are building packages). That new build power allowed us to remove some of old machines from the pool. The unified hardware makes the management of the machines a lot easier now, even if there are still the most powerful old machines left.
  • openSUSE Heroes December meeting – final results
    While we had some fun and good food and drinks, we also managed to discuss a lot during the three days in the Nuremberg headquarter. This was needed because this was the first time that the Heroes came together in their current form. In the end, we managed to do no coding and even (nearly) no administration – but instead we started to discuss our (internal and external) policies and work flows – and did some decisions regarding the next steps and the future of the openSUSE infrastructure.
  • New and improved Inqlude web site
    During last year's Summer of Code I had the honor of mentoring Nanduni Indeewaree Nimalsiri. She worked on Inqlude, the comprehensive archive of third party Qt libraries, improving the tooling to create a better structured web site with additional features such as categorization by topic. She did an excellent job with it and all of her code ended up on the master branch. But we hadn't yet made the switch to change the default layout of the web site to fully take advantage of all her work. As part of SUSE's 15th Hack Week, which is taking place this week, I took some time to change that, put up some finishing touches, and switch the Inqlude web site to the new layout. So here we are. I proudly present the new improved home page of Inqlude.

Benchmarks Of Ubuntu 17.04 Beta vs. Antergos, Clear Linux, openSUSE Tumbleweed

For those curious how Ubuntu 17.04 is shaping up, considering this week was the "beta" release for participating flavors, I decided to take a fresh Ubuntu 17.04 x86_64 daily ISO and see how its performance compares to Ubuntu 17.10, Clear Linux 13600, Antergos 17.2, and openSUSE Tumbleweed. Read more

DebianDog Is a Useful Pocket Pup

The earlier versions of DebianDog work flawlessly, but the latest release seems to suffer from some work-in-progress flaws. I had very little trouble running the default software as-is. When I changed system settings or configured applications a certain way, those changes either did not work or were accompanied by a variety of glitches. I also had some trouble getting the persistent memory options to work. A related problem was setting up the personal save storage file. These issues cropped up or did not appear at all, depending on the hardware I was using. I used the same boot CD and bootable DVD drive on all of my test computers. DebianDog Linux is a good alternative for Linux users looking for something different. It is a very good OS choice if you work on multiple computers or travel around to various work locations and want all your work files on the same OS configuration that you carry in your pocket. DebianDog can be a very workable alternative to lugging a laptop around. Read more

Princeton University’

Missouri vs Ole Miss Live Streaming Minnesota vs Penn St. Live Streaming Villanova vs Creighton Live Streaming Miami (OH) vs Bowling Green Live Streaming Robert Morris vs Sacred Heart Live Streaming Cleveland St. vs Youngstown St. Live Streaming Louisiana Monroe vs Appalachian St Live Streaming