I stayed in a hotel with Android lightswitches and it was just as bad as you'd imagine

[mjg59]

I'm in London for Kubecon right now, and the hotel I'm staying at has decided that light switches are unfashionable and replaced them with a series of Android tablets.

One was embedded in the wall, but the two next to the bed had convenient looking ethernet cables plugged into the wall. So.

I managed to borrow a couple of USB ethernet adapters, set up a transparent bridge (brctl addbr br0; brctl addif br0 enp0s20f0u1; brctl addif br0 enp0s20f0u2; ifconfig br0 up) and then stuck my laptop between the tablet and the wall. tcpdump -i br0 showed traffic, and wireshark revealed that it was Modbus over TCP. Modbus is a pretty trivial protocol, and notably has no authentication whatsoever. tcpdump showed that traffic was being sent to 172.16.207.14, and pymodbus let me start controlling my lights, turning the TV on and off and even making my curtains open and close. What fun!

And then I noticed something. My room number is 714. The IP address I was communicating with was 172.16.207.14. They wouldn't, would they?

I mean yes obviously they would.

It's basically as bad as it could be - once I'd figured out the gateway, I could access the control systems on every floor and query other rooms to figure out whether the lights were on or not, which strongly implies that I could control them as well. Jesus Molina talked about doing this kind of thing a couple of years ago, so it's not some kind of one-off - instead, hotels are happily deploying systems with no meaningful security, and the outcome of sending a constant stream of "Set room lights to full" and "Open curtain" commands at 3AM seems fairly predictable.

We're doomed.

(edited: this previously claimed I could only access systems on my own floor, but it turns out that each floor is a separate broadcast domain and I just needed to set a gateway to access the others)

(further edit: I'm deliberately not naming the hotel. They were receptive to my feedback and promised to do something about the issue.)

Comments

[(Anonymous)]

My coworker asks whether you can control the channels. Can you set all of your neighbours' TVs to pay-per-view while they're out?

[(Anonymous)]

If this is the hotel I believe it is, there is no pay per view. Everything is free, even the porn.

[(Anonymous)]

The ability send your own porn to everyone's screens would be even better. The people would be aghast at the shemales and excrement.

Modbus?

[(Anonymous)]

I worked on Modbus networking software in the 1980's at Modicon. Why would anyone use that for controlling IoT in 2016? It is baffling.

Re: Modbus?

[(Anonymous)]

Maybe because their setup is a bit older than 2016 ? ;)

Re: Modbus?

[(Anonymous)]

because every SnakeOilCorp. thinks that they could sell old things if they name it IoT... Indeed i think there is no IoT anyway, just renamed old things... ;-)

Hotel name?

[(Anonymous)]

This practice will never improve if hotels that do it remain anonymous. They have absolutely no incentive to fix their security.

Re: Hotel name?

[(Anonymous)]

Sure. Tripadvisor should have a checkbox
"Hotel lighting system hackable to blinkenlights" nearby the info "free wifi"

Hotel wifi?

[(Anonymous)]

Did you check to see if that range was visible from the hotel wifi?

Re: Hotel wifi?

[mjg59]

I did! It isn't.

Even worse?

[(Anonymous)]

I swear this is just me "thinking like an attacker", but: what a really nasty attacker would do would be to send the "open curtains" command to all rooms, wait 30 seconds, and then send the "set room lights to full" command, all the time training one or more high-resolution video cameras at the hotel from the outside or a building opposite.

I wonder what percentage of hotel guests sleep naked?

I wonder how much business such a hotel would get in the ensuing 12 months?

Re: Even worse?

[(Anonymous)]

That's more thinking like a voyeur.

You know what to do

[(Anonymous)]

Lightswitch rave!

Re: You know what to do

[(Anonymous)]

Wooo WOOO Wooo WOOO

THE SYSTEM IS DOWN!
THE SYSTEM IS DOWN!

Could be worse

[(Anonymous)]

At least I hope the fire control wasn't on the same modbus ....

Leaking Behavior

[(Anonymous)]

Your post seems to imply that being able to control another room's lights is the greatest security threat. It isn't: reading other room's settings is.

While it would be annoying to have the lights turn on in the middle of the night, it would only be that (annoying). On the other hand, being able to read the current state of another room's lights leaks information about human behavior. It would be pretty trivial to get a statistical profile of the rooms to determine which rooms have occupants that have either departed or are asleep. These rooms then become targets for theft, vandalism or worse.

Re: Leaking Behavior

[(Anonymous)]

You could also do this by watching from across the road for any length of time, the old fashioned way. You could get every floor too if you were high enough.

Those tablets are vulnerable network cameras and microphones

[(Anonymous)]

Installed in multiple places in every room, conveniently indexed by room number. I really doubt they run up to date software. Chances are they can be pwned and turned into bugs.

Criminal offence

[(Anonymous)]

I think you just publically confessed to a criminal offence...?

Re: Criminal offence

[(Anonymous)]

Under what criminal statute exactly?

"You Honour, my client merely tried to get his hotel-room Internet to work."

They would do nothing about it.

[(Anonymous)]

The person who knows about the issue doesn't know what to do with it
The person who can fix the problem would never hear about it
The person in position of power to make it OK doesn't really care

That's usually how the world works, IMO. Did you make sure you got the info to the right people - or - are you sure about no posting the name of the hotel?

Interesting

[(Anonymous)]

An interesting story about how lazy designs can be.

Next question would be - if there are Android tablets, don't they have microphones and speakers? Take the sounds from one room and play them in another would be a nice prank. Especially if it's done by installing that feature as an app on the tablets so you won't need any added computer.

The Hotel will not do a thing until BAD Publicity

[(Anonymous)]

Having worked in many hotels, This lack of security is not a surprise. The automation tells me they were looking for a selling point.

That you pointed it out to the front desk and/or management is good but will do nothing, they will forget about it.

until they get sued for "large amount of money" and bad press.

next stop, cameras everywhere on every door.. NO peepholes.

You realise this has literally nothing to do with Android...

[(Anonymous)]

Android doesn't come with light control software baked into the OS. Someone wrote an app and built controllers with poor security. The weakness is in the light switch software, not in Android.

[hairyears]

Interesting...

A general question: a Very Senior Person at work has a fully automated networked home. Skylights, lighting, aircon, heating.


I asked about the heating, as there's an emerging pattern of drive-bys where script kiddies turn on the hot tub and put the heating on max, in August, while the owners are away.

I've advised this enthusiastic participant in the Internet-of-Things-with-password-Admin to get a security audit...

...But there's nobody I can recommend.

If they take it seriously - and they read your post about lightbulbs - they are senior enough that the corporate security unit might do it as a favour.

Or not; and nobody I would trust to look at a garage-door opener is advertising such a service to homeowners.

I worry that the heating boiler has a Connected maintenance interface for the combustion system, as well as the harmless-but-expensively prankable thermostat.

Data dump?

[(Anonymous)]

Can you publish a tcpdump capture file with the actual data? It may be very interesting for learning about the protocol usage and general organization of that network.

[(Anonymous)]

it's a pretty trivial web search to find the very short list (roughly one element long) of london hotels offering tablet switches. the numerous tripadvisor photos of these tablets on the hotel's page suggest that only tv on/off is available. so more work needed before the porn hack. as well as lights, heating/ac controls, and "please clean up room now".

[(Anonymous)]

First thing that comes to mind (https://s-media-cache-ak0.pinimg.com/236x/af/bb/00/afbb001ddb0a52b9ce775e502252b9a6.jpg)

No big deal

[(Anonymous)]

most people don't know how to bridge their computer in with linux commands. If anyone is so inclined to tamper with security, they could just go outside and pull the power breakers on or off..

This security isn't all that big a deal. Cybersecurity folks love to make any little vulnerability into a big deal..

Re: No big deal

[(Anonymous)]

what you aren't realizing is that with this type of automation starting to gain popularity, but with the general obliviousness of some of its adopters to the security precautions that should be taken, there is more at risk than simply cutting the power. In fact, cutting the power would be a clumsy, last-ditch way to STOP an intrusion. The threat isn't simply being able to turn off peoples lights to annoy them, but that an attacker could not only damage, but EXPLOIT the systems in place, and not always in obvious ways. An obvious way would be to gather personal information about a person by using their security cameras and such to spy on them, and using (or selling) that information for illegal gain. A less obvious one would be gaining access to their personal electronic devices through an unsecured connection to some nifty gadget they use at home, and using it to gain access to every piece of personal information they have by exploiting the insecurity of that connection to get around the other security features of the target's personal devices. By connecting to your smart-lightbulbs or something, you could potentially be handing over all of your bank account information to an attacker, as well as giving them access to your phone's cameras and microphones.

Ever thought about coming back and make a blinkenlights?

[(Anonymous)]

Like:

http://dasalte.ccc.de/xxccc/chaosknoten_hdk_fernsehturm.jpg
http://tim.pritlove.org/images/blinkenlights-reloaded-flyer-huge.png

Germs

[(Anonymous)]

This would drive most germophobes crazy. http://hotelnightmares.com/things-germaphobes-dont-want-to-think-about/