UGN Security Forums
My ProfileMember DirectoryLogin
Search our ForumsView our FAQView our Site Rules
View our CalendarView our Active TopicsGo to our Main Page

UGN Security Store
 

Network Sites UGN Security, The GoNix Initiative, Elite Web Gamers, Back of the Web, EveryDay Helper, VNC Web Design & Development
July
Su M Tu W Th F Sa
1 2 3 4 5
6 7 8 9 10 11 12
13 14 15 16 17 18 19
20 21 22 23 24 25 26
27 28 29 30 31
Sponsored Links
Latest Postings
Latest Reviews
Topic Options
Rate This Topic
#34985 - 08/03/05 04:01 AM Infrared exploits open the door to hotel hacking
Digital Geek Offline
UGN Super Poster

Registered: 09/18/02
Posts: 553
Loc: Cluj-Napoca, Romania
Insecure hotel infra-red systems create a means for hackers to read other guest's emails, watch porno films for free and put false charges onto other guest's accounts. Adam Laurie, technical director at secure hosting outfit The Bunker, was able to demonstrate the attacks to Wired prior to giving a talk on the vulnerabilities at last week's DefCon conference in Las Vegas.

Using only a laptop and a USB TV tuner, Laurie was able to use an infrared connection to a hotel's web-enabled TV to tune into data that the backend system is broadcasting but he shouldn't be able to receive. In this way he was able to view premium content, access backend billing systems and view emails of guests who accessed web mail services via their TV. He was also able to access the desktop of backend computers and launch applications. "No one thinks about the security risks of infrared because they think it's used for minor things like garage doors and TV remotes," Laurie said. "But infrared uses really simple codes, and they don't put any kind of authentication (in it)... If the system was designed properly, I shouldn't be able to do what I can do."

"As far as the hotel is concerned, you're the only person who can see (your bill). But they're sending your confidential data over the air through a broadcast system. It's the equivalent of running an open wireless access point. If I tune my TV to your channel, then I get to see what you're doing," Laurie told Wired.

Infrared systems are used throughout hotels in air conditioning systems, vending machines and many other pieces of equipment but it's their use in hotel TV systems that connect to backend and billing systems that represent the greatest scope for mischief. Laurie said that many hotel infrared systems are rolled out with password controls or back-end authentication that would frustrate exploitation. Data is commonly stored and transmitted in the clear without protection from encryption. Because most hotel use similar systems from a small number of suppliers, Laurie has been able to replicate the attack across the world over the last two years.

Laurie discovered the security loophole when he was "mucking about with hotel TVs to get the porn channel without paying for it". Tuning into content that's been broadcast but a hotel TV is not configured to receive is one thing - and might be carried out by tuning in a VCR - but Laurie was able to take this further by deciphering the codes transmitted from a remote control device to a TV. Laurie has created a program to analyse and map the codes and a script to test out their effect when sent to his TV. He did this for research purposes and doesn't plan to release the tools.

As more devices become network enabled the scope for hacking increases. Laurie's work shows the issue is not just confined to devices connected to the web. Infra-red (and conceivably Bluetooth) connected systems might also be exploited.

SOURCE

Top
Sponsored Links
      
#34986 - 08/03/05 11:40 AM Re: Infrared exploits open the door to hotel hacking
Artic Warrior Offline
UGN Member

Registered: 11/12/03
Posts: 478
Loc: My room
My brother was able to download some software onto his mobile and use it as a remote control for practically every telivision that we came across. Including security ones in corner stores and super markets and even the massive plasma screens in pubs and bars and in our Macdonalds.
It was so funny, cause the security ones would go onto static and the footy playing in the pubs would turn into "city of angels".

Infa red technology is so usefull though!
_________________________

Top

Featured Member
Registered: 03/05/02
Posts: 9
Forum Stats
2145 Members
46 Forums
33526 Topics
68693 Posts

Max Online: 1567 @ 04/25/10 10:20 AM
Top Posters
UGN Security 26689
Gremelin 7192
§intå× 3255
SilentRage 1273
Ice 1146
pergesu 1136
Infinite 1041
jonconley 955
Girlie 908
unreal 860
Newest Members
Jimmie Menon, fghijk435948, Devo60, ali, lavos
2147 Registered Users
Who's Online
0 registered (), 715 Guests and 313 Spiders online.
Key: Admin, Global Mod, Mod
Latest News


Donate
  Get Firefox!
Get FireFox!