Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[martinuzz]

Meanwhile in Austria, hackers made some money of a luxury hotel by invalidating all it's entrance passes and locking all doors in the height of tourist season, with all of the hotel's 180 rooms fully booked.
Faced with the horror of having to make his guests wait 24h to be let in or out of their rooms (that's how long it would take for a tech guy to reset the system and make new passes for everyone), the hotel management decided to not wait for that, but instead pay the hackers their ransom demand of 1500 euros (dang, that's peanuts, must have been some small fry hacker to ask so little money). The Hotel had been hit before by ransomware, and that time it had cost them 3500 euros in technician wages and new passes, which had not been reimbursed by insurance, because the perpetrators were not caught. So paying the ransom wasn't just faster, but also cheaper.
The hotel apparently wasn't the only company affected. When they called the police, they heard they were 'one of many'.

To prevent this happening in the future, hotel management has decided to get rid of their hightech entrance pass system, and replace it with old fashioned locks with keys.

[Neonivek]

Or you know... these places COULD just stop putting their vital systems on the network OR limit the data that is allowed to be transferred.

Then again a good tech person is hard to come by... and speaking to a good tech person, people tend to sort of mess things over for them "Why can't I surf porn at work? Tech guy! increase my privileges!"

[Silverthrone]

Keys sound like a marvellous idea. They could possibly work if the power is out, too. I have always wondered at the strange compulsion to jam a computer in just about anything, and then making sure they are hooked up to a vulnerable network, presumably for a lark. Surely, there are things that do not strictly speaking needs to be computerised, and more to the point, does not need to be left to fend for itself on a network.
I must confess that I worry for a near future in which those supposedly smart houses have become the norm and you are jolly well stuck with them, whether you want them or not. It sounds like a terrible ordeal, having to pay ransom to get access to your own fridge back. I suppose it could be somewhat convenient to use your mobile to change the heating or switch the lights on, but I have a decent pair of arms and legs, I can already do that. None of those things have any need to be on any sort of network, thank you very much.

[Avis-Mergulus]

There are certain benefits to a properly secured passcard system, though, especially if you are an establishment that uses many similar keys. For example, if a key is lost or not returned, you have to assume the lock is not secure until you have changed it; worse than that, duplicates of keys can be easily made in any corner shop (you can duplicate passcards, but that is less convenient). But if a passcard is not returned or registered as lost, you can just disable it. In the same vein, replacing lost keys requires you to physically manufacture the relevant key, while to replace a passcard, you can just make a new one if you keep a stock of blanks.

There are cases in which the benefits outweigh the drawbacks, is what I'm saying. At least if your security staff know what they're doing.

[Flying Dice]

Or they could, y'know, get hybrid locks. Keycards for guests under normal circumstances, but with physical keys for emergency use. Probably expensive, but more so than paying ransoms or dealing with comping customers?

[martinuzz]

Tbh I think they could pay 100 of those ransoms of 1500 euros and still be cheaper off than installing a whole new hybrid system.

[Silverthrone]

Well, true. There are certainly benefits, but there is an odd tendency to trade reliability for what seems like convenience at the time. It does hinge on the security staff, and they seem quite woeful in many cases. Passcards are excellent, and they are simply better than ordinary keys, for instance, but I wonder why it would be necessary to link them all together on a network that outsiders can tamper with. That said, I am unsure of how such a system works, so it might very well be impossible to manage it any other way, but it cannot be beyond the wit of men to develop something more simple and robust. There are far better methods than keys, but I do believe quite a few establishments cannot really manage those systems, and were over-eager to switch.

Still, a business worth its name will have a security staff, and at least some sort of protection. An ordinary household overrun by this wretched "internet of things" jiggerypokery will likely not.

Tbh I think they could pay 100 of those ransoms of 1500 euros and still be cheaper off than installing a whole new hybrid system.

It depends, though, if the perpetrator keeps to that rate, or if the surrounding costs does not mount up higher nonetheless. Not to mention, getting known as a hotel with security difficulties and faulty doors now and then is a different sort of cost that will still end up quite painful with time.

[Lord Shonus]

Put simply, a passcard system *must* be networked, otherwise you'll have to go program every individual door whenever you need a new card. This is not only inconvienient, but having the doors be directly programmable is a massive security flaw. It is possible to have this system on a separate airgapped system from your booking and management network, but this is not only more expensive but makes it much more complex (and thus more prone to errors) to assign keys to guests and such, so it is just easier to have everything on the same system. This could be separated from your overarching corporate system, but it is really handy to have corporation-wide data on the performance of the hotel, and transferring that data manually invites a lot of potential errors. You could keep this corporate system isolated from what customers access to book online, but then you'd still have to have somebody taking the information from one computer to another.

Networking everything together is just the most practical of options. Doing so with proper security isn't an impossible task -modern slot machines are all internetworked within a casino, and can be remotely polled to make sure they're paying out what they're supposed to be, for example- but we're just now exiting the Wild West age of the Internet when such things weren't a given.

[Silverthrone]

Ah, I see. That is true, that sort of handiness is quite irresistable. I am happy I am not a hotel owner, though. I believe I would probably go 'Oh, hang it all', and hire a good, in-house locksmith instead. Which is one amongst many good reasons as to why I should not be a hotel owner.

It is odd that slot machines and modern casino network work as well as they do. Well, thinking of it, it is not odd at all. The casino business have no doubt invested an awful lot into these systems, hired the very best and made sure that the convenience never comes to the cost of security and liability. I know that if I were a competent network security specialist, I would be happy to work for them.

[TempAcc]

The internet of things won't actualy be a thing until stronger security measures (something something quantum encryption) are developed and fully implemented. We still live in the world in which a dedicated hacker can do stuff like this and get away with it.

[Silverthrone]

The internet of things won't actualy be a thing until stronger security measures (something something quantum encryption) are developed and fully implemented. We still live in the world in which a dedicated hacker can do stuff like this and get away with it.

Even so, I do hope it will be possible to opt out. It will no doubt become harder for ordinary Sunday hackers to break into private home networks in the future (or so I hope), but nonetheless, I do not like the idea of a computerised coffee brewer or table lamp. It seems awfully needless, and I would rather my appliances remain all dead plastic and copper, somehow. I suppose it would have its uses, though, in larger households or for the elderly. Still, even if it is no doubt mostly in my head, I do not want to be in a situation where I mistrust my own toaster.

[TheBiggerFish]

The internet of things won't actualy be a thing until stronger security measures (something something quantum encryption) are developed and fully implemented. We still live in the world in which a dedicated hacker can do stuff like this and get away with it.

And yet there are already massive botnets full of IoT devices DDoSing stuff.

Sadly, the security-conscious aren't driving this.

[EnigmaticHat]

The internet of things won't actualy be a thing until stronger security measures (something something quantum encryption) are developed and fully implemented. We still live in the world in which a dedicated hacker can do stuff like this and get away with it.

More powerful computers means more powerful hacking.  I'm sure one of those old WW2 code machines would be awful for hacking a modern website, doesn't mean the website is safe.

[Teneb]

The internet of things won't actualy be a thing until stronger security measures (something something quantum encryption) are developed and fully implemented. We still live in the world in which a dedicated hacker can do stuff like this and get away with it.

More powerful computers means more powerful hacking.  I'm sure one of those old WW2 code machines would be awful for hacking a modern website, doesn't mean the website is safe.

The solution is clear then: we must return to punch card computers! Only then we will be safe.

[itisnotlogical]

What about arm's-length doodling networks though? I hear there's a new hack out there called "Ripping the paper" that looks pretty scary too. We should just go back to drawing on the wall of our caves.