Many hotels use an internet gateway to deliver WiFi connectivity to their guests, but the gateway is flawed to the point where a malicious actor could access sensitive and personally identifiable information about guests, researchers have found.
During his presentation findings at Hack Cybersecurity Conference in Saudi Arabia, Senior Security Consultant and Researcher Etizaz Mohsin found that the gateway, called Airangel HSMX Gateway, contained passwords that were hardcoded and were therefore “extremely easy to guess.”
This only means that when someone had these passwords, a malicious actor could access the gateway’s database, which contained all the data about guests using the network, including their names, room numbers, and email addresses, and possibly redirect them to other sites.
Consequently, more hotel guests will be vulnerable to cyberattacks.
This researcher concludes that these five vulnerabilities could compromise the gateway, thus, putting users-hotel guests and their endpoints at risk.
After finding out, Mohsin reached out to Airangel for comment, but the company allegedly informed him the device was discontinued in 2018 and is no longer supported, which indicates the bugs remain.
Mohsin concluded that Hotels, malls, as well as convention centers around the world still use the device “widely.”
Moreover, Internet scans show at least 600 accessible devices exist. The final number may be much higher because most hotels at risk are in the United Kingdom, Russia, Germany, and the Middle East.
“Given the level of access that this chain of vulnerabilities offers to attackers, there is seemingly no limit to what they could do,” Mohsin said.
Generally, public WiFi networks, like airports, hotels, cafes, and libraries are considered a security risk.
Throughout the years, cybersecurity researchers have warned that certain activities should not be carried out while connected to these networks, such as paying for services, using social media accounts, or even accessing business email.
Cyberattacks on WiFi Networks
Hotels are not entirely safe from these kinds of incidents, and this will not mark as the last when it comes to targeted cyberattacks.
In 2015, Wired reported that the routers many hotel chains rely on for their WiFi networks are vulnerable to serious hacks, which affect guests at thousands of hotels around the world.
In the same report, researchers discovered that an attacker could be able to spread malware to guests using this vulnerability, monitor and record data transferred over the network, and even access the reservation and keycard systems at the hotel.
Earlier this year, Tech Times reported that nine popular WiFi routers are at risk. Those routers could also be the same as what most hotel chains have.
It is advised that users use virtual private networks (VPNs) when browsing, as they mask the user’s IP address and encrypt the connection, making online actions virtually untraceable, and most importantly, more secure.
