The Great Hotel Hack Adventures in attacking hospitality industry - - PowerPoint PPT Presentation

▶
the great hotel hack
SMART_READER_LITE
LIVE PREVIEW

The Great Hotel Hack Adventures in attacking hospitality industry - - PowerPoint PPT Presentation

Feb 06, 2023 202 likes •1.12k views

The Great Hotel Hack Adventures in attacking hospitality industry Etizaz Mohsin https://etizazmohsin.com Disclaimer No hotels were harmed during making of this presentation Do not try this at home! Images Courtesy: ANTlabs & INTSIGHTS

slide-1
SLIDE 1

The Great Hotel Hack

Adventures in attacking hospitality industry Etizaz Mohsin https://etizazmohsin.com

slide-2
SLIDE 2

Disclaimer

No hotels were harmed during making of this presentation Do not try this at home!

Images Courtesy: ANTlabs & INTSIGHTS

slide-3
SLIDE 3

What this talk is not about

slide-4
SLIDE 4

What this talk is about

Biggest threats are simple not sophisticated

slide-5
SLIDE 5

Previous Research

slide-6
SLIDE 6

Agenda

  • Why Do hackers attack hotel
  • Attack surface walkthrough
  • Common attack vectors
  • Who are threat actors
  • Notable Data breaches
  • What led to my research
  • Demo NSA style hack
  • Mitigations
slide-7
SLIDE 7

Security Point Products

  • Network Security
  • Endpoint Security
  • Data Security
slide-8
SLIDE 8

“Supreme excellence consists in breaking the enemy's resistance without fighting” – Sun Tzu

slide-9
SLIDE 9
slide-10
SLIDE 10

Why Do Threat Actors attack Hotel ?

  • Second largest number of breaches after retail sector
  • Prominent hotel brands attacked repeatedly
  • Collect sensitive, valuable and varied data
  • Manage large number of financial transactions
  • Uses loyalty programs to encourage repeated visits
slide-11
SLIDE 11

Hotel attack surface

  • Large quantity of diverse endpoints
  • Access to mothership
  • Lack of employee security awareness
  • Undefined security responsibilities
  • High exposure to third parties
slide-12
SLIDE 12
  • Attacks on Point of Sale
  • Spear phishing attacks
  • WIFI network attack
  • DDOS and Botnet attacks
  • Internet of Things attacks
  • Brand Impersonation
  • Customer targeted attacks
  • Ransomware

Attack Vectors

slide-13
SLIDE 13

Threat Actors

  • APT28 Fancy Bear
slide-14
SLIDE 14

Threat Actors

  • Darkhotel APT
slide-15
SLIDE 15

Notable Data Breaches

slide-16
SLIDE 16

Disclaimer Once Again!

slide-17
SLIDE 17

How did this all start?

slide-18
SLIDE 18
slide-19
SLIDE 19
slide-20
SLIDE 20

Disclosure Timeline

  • 2018-10-31: First vendor notification – immediate response
  • 2018-11-12: Technical details sent to vendor
  • 2018-12-10: Vendor questions feasibility
  • 2018-12-15: Proof of concept sent
  • 2018-12-17: Vendor acknowledges vulnerability
  • 2018-12-20: Vendor discusses update plans
  • 2019-04-01: Vendor assures patching
slide-21
SLIDE 21

Hmm ??

slide-22
SLIDE 22

Wi-Fi

slide-23
SLIDE 23

Captive Portal

  • Radius
  • LDAP
  • Voucher
  • SMS
  • PMS
  • Social Login

Billing Feature

  • Credit Card
  • PMS (FIAS)

Management

  • Web portal
  • Role based access
  • DNS server
  • DHCP
  • Firewall
  • Lawful interception
slide-24
SLIDE 24

Target Selection

slide-25
SLIDE 25

Attack Surface

slide-26
SLIDE 26
  • Get private data
  • Subscriber’s details, Network configuration, DHCP, DNS, firewall rules
  • Backup, logs, PMS, Guest details, SSL, SMTP
  • Set every parameter
  • DHCP, DNS, WAN, LAN, Route Configuration
  • Port forwarding, Syslog, SSL
  • Download
  • Configuration, database, backup, logs
  • Upload
  • Backup, Images

Web Management Portal

slide-27
SLIDE 27

Web Server

slide-28
SLIDE 28
slide-29
SLIDE 29
slide-30
SLIDE 30
slide-31
SLIDE 31
slide-32
SLIDE 32
slide-33
SLIDE 33
slide-34
SLIDE 34

TLS Certificates

slide-35
SLIDE 35

Database

slide-36
SLIDE 36

Read Write

slide-37
SLIDE 37

Firewall rules

slide-38
SLIDE 38

Configuration

slide-39
SLIDE 39

Guest Details

slide-40
SLIDE 40

Guest WIFI Configuration

slide-41
SLIDE 41

Session Riding

slide-42
SLIDE 42

Plain Text Credentials

slide-43
SLIDE 43

Enumerating Users

slide-44
SLIDE 44

SSH

slide-45
SLIDE 45

System

slide-46
SLIDE 46

Tools

slide-47
SLIDE 47

Configuration

slide-48
SLIDE 48

Owning DNS

  • HTTP/S Downgrade
  • Sniff plain text credentials
  • FakeDNS
  • WPAD abuse
  • Hash capture (http_ntlm)
  • Beef Hooks
  • Browser autopwn2
  • Evilgrade
  • BDFProxy
slide-49
SLIDE 49

User Reset

slide-50
SLIDE 50

Management Portal

slide-51
SLIDE 51

Active Users

slide-52
SLIDE 52

Mac Addresses

slide-53
SLIDE 53

User Details

slide-54
SLIDE 54

DHCP Configuration

slide-55
SLIDE 55

DNS Configuration

slide-56
SLIDE 56

DNS Enteries

slide-57
SLIDE 57

DYNDNS Configration

slide-58
SLIDE 58

Network Configuration

slide-59
SLIDE 59

Routes

slide-60
SLIDE 60

Network Configuration Review

slide-61
SLIDE 61

Port Forwarding

slide-62
SLIDE 62

SSL Overview

slide-63
SLIDE 63

Subnets

slide-64
SLIDE 64

Interception

slide-65
SLIDE 65

Firewall rules

slide-66
SLIDE 66

Logs

slide-67
SLIDE 67

Guest Details

slide-68
SLIDE 68

PMS

slide-69
SLIDE 69

Backup

slide-70
SLIDE 70

SMTP

slide-71
SLIDE 71
slide-72
SLIDE 72

GUESS WHAT ?

slide-73
SLIDE 73

DEMO

slide-74
SLIDE 74
slide-75
SLIDE 75

So, Who is Vulnerable ?

slide-76
SLIDE 76

Once, we own the main box!

  • PMS
  • Corporate network
  • Electronic door locks
  • Alarm
  • HVAC
  • Guests devices
  • IOT devices
  • CCTV
  • In fact anything connected to the gateway
slide-77
SLIDE 77

Mitigations for Guests

slide-78
SLIDE 78

Mitigations for Guests

slide-79
SLIDE 79

Mitigations for Guests

slide-80
SLIDE 80

Mitigations for Guests

slide-81
SLIDE 81

Mitigations for Guests

slide-82
SLIDE 82

Mitigation for Guests

slide-83
SLIDE 83

Mitigation for Guests

slide-84
SLIDE 84

Mitigation for Owners

  • Train and re-train your staff
  • It takes one click on wrong link
  • Train employees on best practices and

common attack vectors

slide-85
SLIDE 85

Mitigation for Owners

  • Strengthen your infrastructure
  • Avoid easy to guess passwords on POS
  • Use 2FA authentication
  • Ensure end point protection is up to date
  • Separate POS network from other
  • Filter remote access for POS controller
  • Segment WIFI Networks
slide-86
SLIDE 86

Mitigation for Owners

  • Regulate vendors
  • Ensure vendor meets compliance standard
  • Regularly assess the risk of their vendors and partners
slide-87
SLIDE 87

Mitigations for Owners

  • Threat hunt inside your network
  • Hackers move around to find valuable data
  • Monitor network traffic to identify suspicious

activity and discover unauthorized access

slide-88
SLIDE 88

Mitigations for Owners

  • Create a incident response plan to

speed up mitigation process.

slide-89
SLIDE 89

Conclusion

  • Stay aware while traveling
  • Use VPN or 4G LTE
  • Advanced persistent threats are devastating
  • Biggest threats are simple not sophisticated
  • No sign that attacks will slow down across any industry
slide-90
SLIDE 90

Thank You

https://www.linkedin.com/in/aitezaz/