Hackers random hotel by locking guests in rooms | Hacker News Reader

Hackers random hotel by locking guests in rooms

thelocal.at

9 pointsCarolineW7 comments

Open articleView on HN

Please fix the title so it matches the actual article (and also so it makes sense). "Ransom" not "Random". Thx

Yes, the moderators should intercede and change the title. I wonder if the OP is no longer able to.

Indeed - you can thank "auto-corrupt" and having to post things from a phone.

Sorry.

Ah yes, the proverbial "ottokorrekt" as I call it. I am still on the fence about whether it is a blessing or a curse.

I'm not seeing the part explaining how guests are locked in their rooms. Is it that they don't feel they can leave or their belongings will be locked in a room they can no longer access, or is it some literal situation where the doors won't open unless the hotel's key system is restored?

If it's the former, it's more than a little melodramatic to say they're locked in. The situation would be resolved when the hotel paid the ransom (which they'd done twice before). And they don't really even have to leave their things in the hotel room; guests could pack up their belongings and move to another hotel if they really feel like the situation won't be resolved in a timely manner. I assume European laws would guarantee customers a refund (or at least a prorated refund) in a case like this, wouldn't they?

If it's the latter, then what kind of hyper-secure system is this hotel using, and more importantly why?

Hotel management said that they have now been hit three times by cybercriminals who this time managed to take down the entire key system. The guests could no longer get in or out of the hotel rooms and new key cards could not be programmed.

Oh dear god, three times? Bump this up your priority list, fellas.

Brandstaetter said: "We are planning at the next room refurbishment for old-fashioned door locks with real keys. Just like 111 years ago at the time of our great-grandfathers."

Ok. Or couldn't you just disconnect it from the net and secure local access? Have a mechanical override mechanism? I feel like there are many solutions here.

It's crazy that there wasn't a mechanical override to exit. I'd think that would be required by fire code in the US.

>Or couldn't you just disconnect it from the net and secure local access?

There are lots of ways this could work without internet access, and "secure local access" is easier said than done for a network which must extend through spaces where random people off the street have access and privacy.

Electronic physical security vendors are not exactly shining beacons of top-notch security engineering. Researchers have found extremely careless, serious vulnerabilities in systems such as HID iClass [0] and your average hotel is probably using something much less sophisticated.

Denial of service is probably much easier than unauthorized entry, and unauthorized entry isn't exactly hard.

[0] https://krebsonsecurity.com/2014/08/how-secure-is-your-secur...

Reply on news.ycombinator.com