Hotel Experience With Android Lightswitches (dreamwidth.org) 111
jones_supa writes: The hotel in which Matthew Garrett was staying at, had decided that light switches are unfashionable and replaced them with a series of Android tablets. In his tour to the system, one was quickly met with a glitch message "UK_bathroom isn't responding." Anyway, two of the tablets had convenient-looking ethernet cables plugged into the wall, so MacGyver began hacking. He managed to borrow a couple of USB ethernet adapters, set up a transparent bridge and then stick his laptop between the tablet and the wall. Tcpdump showed traffic, and Wireshark revealed that it was Modbus over TCP. Modbus is a pretty trivial protocol, and does not implement authentication. The Pymodbus tool could be used to control lights, turn the TV on/off, and even close and open the curtains. Then he noticed something. His room number was 714. The IP address he was communicating with was 172.16.207.14. They wouldn't, would they? Indeed, he could access the control systems on every floor and query other rooms to figure out whether the lights were on or not, which strongly implies that he could control them as well.
A solution in search of a problem.. (Score:2)
It just seems daft to me that this is just pointless complexity.
The software will only need to be tested once! (Score:1)
To the engineer's credit, at least he used a platform that won't require testing due to software updates!
Re: (Score:2)
Re: (Score:2)
But pretty much every one of those sensors doesn't work as advertised, and instead starts turning things off because you sat still in bed for too long.
power shutdown in hotels (Score:1)
In a lot of hotels in Europe, you have to shove your key card into a receptacle near the door which turns on the power to the room.
(of course, most don't care what card you use, so if you want to leave the lights on when you leave, you use a keycard from some other place)
Re: (Score:2)
But most annoyingly, shutting off the power means i can't leave something charging in the room while i go out somewhere.
Re: (Score:1)
Or a bottle of rec wine sitting on the air conditioner to properly chill (cellar temp) for dinner.
(One of those combined A/C and heater units, with a convenient horizontal grill. And I set it up at lunchtime, after the room had been cleaned - the maids were trained to turn the A/Cs off).
Re: (Score:2)
You're right. Maybe they could issue something to their guests that they can use to tell the system they're in the room. Maybe they could even be used to open the door!
Oh, wait, you're not right after all. You're just reinventing the hotel keycard switch, but with added complexity and dubious benefits.
Re: (Score:2)
Most of the those switches activate when you stick anything at all into them...which totally defeats the purpose.
Re: (Score:3)
"Totally" is a severe exaggeration. Smartasses are never easy to deal with, but they do solve the problem 99% of times.
Also, most people don't just carry around random credit card-sized cards that they're willing to leave behind for a little added convenience.
Re: (Score:2)
Also, most people don't just carry around random credit card-sized cards that they're willing to leave behind for a little added convenience.
Are you sure about that? Every wallet or purse I've ever peaked into is full of pointless shit, mostly credit card sized. And every holiday I've ever been on we've always had a spare card to jam in the socket.
Re: (Score:2)
Most of the those switches activate when you stick anything at all into them...which totally defeats the purpose.
They don't unlock the door unless the correct thing is stuck into them. Pretty simple to tie it into the same computer system.
Re: (Score:2)
The vast majority of switches is dumb. Just a card-sized slot and a switch.
Re: (Score:2)
Re: (Score:2)
Not the door locks, the room's master light switch.
Door locks are a whole different thing that is only tangentially related.
Re: (Score:3)
That's a ~95% solved problem and has been for decades. Room key on thick plastic block, block goes in a cradle inside the door, activating power to the room. Pull the key to leave and everything goes off.
Worked in the 90's at least when I started traveling for work, and it wasn't just in big city hotels then. Perspex blocks don't have to be smudge-free, don't need extra power of their own, won't break down, are significantly cheaper, can't be trivially hacked to screw with every other room in the hotel - no
Re: (Score:2)
Room key on thick plastic block, block goes in a cradle inside the door, activating power to the room. Pull the key to leave and everything goes off.
Do you know that most hotels in the US (I know TFA was London) use cheap magnetic credit cards (with a different encoding) as keys? I haven't seen an actual room key since at least a decade ago. I don't think attaching a brick to the key card will go over well with hotel guests or even the hotels themselves. Also, you can't use the key to tell when the room is occupied. If there are two guests in the room, and one goes out with the key, are you going to shut off TV and lights for the one staying behind?
In
Re: (Score:2)
I've stayed in a room where you had to put one of the cardkeys in a slot on the inside of the door to have power to the room.
Re: (Score:3)
Re: (Score:2)
Hotels will usually give me an extra keycard when I ask, just so I can leave the room powered up when I'm not there. If I forget, a business card usually works well, too. Most of them don't have sensors; I'm assuming its a simple microswitch.
Re: (Score:2)
Re: (Score:2)
The Travelodge in Clapham Junction used (uses?) Ving card which have a random combination of 100 holes in them.
Re: (Score:2)
Wow, are they still around? I remember ving cards in the 90s but haven't seen one in probably 15 years.
Re: (Score:2)
But doing it like that requires significant investment in extra wiring and zoning ordinances which depending on your electric code may not necessarily be either easy or cheap to implement/retrofit. Retrofitting some COTS "smart" switches on an Android would cost ~500-1000/room including labor, running new electric will cost at least 5-10x as much.
Re: (Score:1)
And in most cases,
Re: (Score:2)
Imagine having scrolling messages displayed on the outside of the hotel as different combinations of room lights went on and off. Even more fun if they used those smart LED lightbulbs that can be pre-programmed with a particular color out of range of 4096.
Re: (Score:1)
Re: (Score:2)
Re: (Score:1)
http://www.hubbell-automation.... [hubbell-automation.com]
Many of these protocols come from a long history in industrial automation where every source was basically "Trusted". It's going to take years for i
Re: (Score:2)
Luddite!
BTW, if I understand the situation correctly, the reason that we need IPv6 is so that we can all enjoy this and similar advanced technologies and can control our household lighting and curtains from anywhere on the planet.
The 1960s are looking better and better.(excepting that Vietnam thing of course).
Re: (Score:2)
Re: (Score:2)
I would be more concerned with the room lights being used for displaying giant messages on the hotel's facade with one room per pixel.
Could be used to shame the hotel for sure.
The end scene of the movie Hackers comes to mind.
Re: (Score:2)
I'm all for avoiding needless complexity, but here are the tangible benefits:
1) Energy savings. You could ensure lights are not left on by housekeeping etc. when rooms are not occupied. Maybe a small benefit, but easy to automate.
2) You can turn on lights when someone checks in to make the room more welcoming.
3) Customers can turn off all the lights in the room from the bed. Maybe a bit of laziness, but helpful for someone not familiar with the layout of various light switches in the room.
4) Safety: in a
A timothy by any other name ... (Score:4, Funny)
He should check his bill in case they charged him twice.
Re: (Score:2)
Oh. This guy? https://mjg59.dreamwidth.org/ [dreamwidth.org]
The one who forked the linux kernel in 'solidarity' with sarah sharp?
Wow (Score:2, Insightful)
Re: (Score:1)
Hotel Cheaped out. (Score:3)
If they used a REAL control system this would not be the issue. but instead they tried to do it as cheap as possible using consumer crap.
Tablets at the light switches is insanely stupid as well. real automation lighting systems still have physical buttons at entryways and doorways for the lights.
Whoever sold this system to the hotel needs to be outed and publicly shamed.
Re: (Score:2)
"If they used a REAL control system this would not be the issue."
That's becoming interesting.
Are you implying they were using an UNREAL control system? Kindof... I don't know... Ghost in the Shell's Section 9?
"instead they tried to do it as cheap as possible using consumer crap."
Ohh... I see! But, you know, that doesn't make it an unreal control system, but a very REAL one.
"Whoever sold this system to the hotel needs to be outed and publicly shamed."
You know what a free market is, don't you? It is not ab
Re: (Score:2)
I wonder whether someone like the FSB is the one that is selling the thing. It could make eavesdropping on people so much easier.
But as you say - the hotel was dumb enough to actually buy it.
Re: (Score:2)
>>It's a slapdash bunch of crap stuck together
That's the definition of a system.
Re:Hotel Cheaped out. (Score:5, Insightful)
No, they should win salesman of the year. The shaming should go to whoever at the hotel didn't do due diligence, and bought the system.
Re: (Score:3)
"Whoever sold this system to the hotel needs to be outed and publicly shamed." No, they should win salesman of the year. The shaming should go to whoever at the hotel didn't do due diligence, and bought the system.
I hope this is sarcastic because otherwise it sounds like you think every scam should be legalized and the blame put squarely on the victims.
Re: (Score:1)
Re: (Score:2)
Perhaps you should learn the difference between simple incompetence and scamming.
You implied the salesman knowingly sold an insecure system when you said he "should win salesman of the year". Otherwise he was simply incompetent, the buyer was incompetent, and neither should win any prizes.
Re: (Score:2)
I did no such thing. He should win it simply for selling a costly, high tech, high support solution in place of a wall switch.
Re:Hotel Cheaped out. (Score:4, Interesting)
No, they should win salesman of the year. The shaming should go to whoever at the hotel didn't do due diligence, and bought the system.
They did their due diligence. It runs Modbus TCP. That's like an industry standard man. Everyone uses that. It must be good!
Re: (Score:2)
No, they should win salesman of the year. The shaming should go to whoever at the hotel didn't do due diligence, and bought the system.
Same goes for whoever is approving those smart elevator controls, you know the ones where the lift has no buttons, you type in your floor on a panel in the lobby, then get assigned a lift number? They are becoming more and more common and I always have a worse experience with them than the old fashioned up and down buttons with floor buttons in each lift.
Re: (Score:1)
Re:Hotel Cheaped out. (Score:5, Insightful)
Sounds like they picked ModbusTCP since it is an incredibly easy standard to implement on very cheap devices (think 10 cent microcontrollers).
Tons of existing devices support it too so not a bad choice from a technical perspective.. unless you care about security.
Modbus has zero security, why would it? It was built to run on serial lines and the tcp-implementation is for all intents and purposes just using a tcp-socket instead of a serial line to chuck bytes over the line.
It entirely relies on the physical security of the network.
The same thing is also true for KNX/EIB-control which is used for building automation all over the world. The issue here is that what used to be secure by being obscure and inside sockets on the wall is now just being extended onto tablets with no thoughts about how people will poke around in the system.
Having 'killed' a building by mistake (typoed a path....tripped all breakers in the building :p) via KNX, I know the lack of security being very real in 'live' environments.
This is not at all new, it has just not been a focus for anyone until fairly recently.
Google around for KNX hacks and you'll see plenty of evidence of the shitty systems which are considered "industry standard" for building automation. Sigh.
Re: (Score:2)
Re: (Score:3)
Re: (Score:2)
Re: (Score:1)
Re: (Score:2)
DMX512 is no better, being a dumb multi-drop RD-485 serial bus with zero authentication.
I admit that I lack knowledge of BACnet, DALI, or Lonworks, specifically but generally: Industrial control systems don't have authentication.
The chances of the radio console(s) that your local public-safety agencies use of potentially having IP connectivity and default passwords is astonishingly good, for instance.
I saw one instance of this in a town not far from where I live, where the radio system used IP addresses wh
Re: (Score:2)
Bacnet is the standard for commercial lighting. Modbus has NEVER been used for lighting control in commercial.
Indians (Score:2)
Guarantee this was dreamed up by someone from India.
Re: (Score:2)
And implemented by an American in a board room deciding who they need to fire next so they can make their quarterly bonus.
Re: (Score:1)
And by the way, I've used tablets to build HMI screens in industrial areas that work great (B
Re: (Score:2)
Lack of serious products?
Crestron, AMX, Lutron, Hubbell, Leviton ALL make this stuff that is not based on cheap-ass android tablets and half assed networking without any kind of security in place.
And all of those companies have been in business longer than you have been alive. There are tons of "properly more engineered solutions" out there and they have been there for decades.
Re: (Score:2)
If they used a REAL control system this would not be the issue.
You mean a real control system, like a control system used a lot in industry and commercial settings?
Such a control system that is most probably running a protocol like Modbus TCP?
Is that the kind of control system you're talking about?
This was a story about someone finding a way to access a Modbus TCP connection to control a building. This is very much not only a "real" control system, but it is also probably the single most widely used protocol for this kind of control in the world, and it's a protocol pr
Re: (Score:2)
If they used a REAL control system this would not be the issue. but instead they tried to do it as cheap as possible using consumer crap.
Tablets at the light switches is insanely stupid as well. real automation lighting systems still have physical buttons at entryways and doorways for the lights.
Whoever sold this system to the hotel needs to be outed and publicly shamed.
The hotel is in the hotel business. They trust the electronic doors, and other security stuff to contractor. It is the contractor that should be liable, if some item was stolen from a room.
Screw control, monitoring more interesting... (Score:5, Insightful)
If he can query the light status, why not polls every room every two minutes or so - and make a note of which rooms had been on, then were turned off implying the owners had left...
Nothing like being able to know a room will have belongings but is unoccupied to make the burglar's work easy.
On a side note I can't really blame them for matching IP to room number, just from a trouble-shooting perspective... the real problem is lacking unique per-room authentication.
Re: (Score:2)
Nothing like being able to know a room will have belongings but is unoccupied to make the burglar's work easy.
That depends on your hotel. Having "lived" in a few hotels (to the point where the concierge of one hotel gave me a house warming present when I left), I can tell you that during the day I didn't use the lights as it was bright enough, and at night while watching a movie or sleeping I didn't use the lights either.
On the other hand walking down a hallway and seeing a couple walk out of the room is a far simpler way of knowing that a room is empty.
Re: (Score:2)
Nothing like being able to know a room will have belongings but is unoccupied to make the burglar's work easy.
Because risking jail for stealing tourist's clothes is worth it for your average IT savvy crook....
Re: (Score:2)
I don't know whey you are stealing clothes when you could have laptops, iPads and jewelry.
Re: (Score:2)
I don't know whey you are stealing clothes when you could have laptops, iPads and jewelry.
Have you ever stayed in a hotel? Most people will have their valuables on them, or if left in the room kept in a safe. I hardly think that renting a hotel room, which you have to present ID and credit card (sure you could fake that but...) only so you can hack the electrical control bus to try and work out when another guest is not in (maybe), so you can somehow break down their door, and pray they have something valuable lying around you can steal (that doesn't have GPS and tracking), and hope there's no c
Re: (Score:2)
Re: (Score:2)
Uhh...no. (Score:1)
Re: (Score:2)
VLAN doesn't do much unless it's also enforced via a smart switch..
Re: (Score:2)
Cost most likely. Or an oblivious implementer.
Lights, cameras, ... (Score:2)
Re: (Score:2)
Re: (Score:2)
I recently stayed in a hotel that provided a tablet in every room for accessing amenities, such as room service. It appeared to be equipped with a camera and microphone, as most tablets are. And I have little doubt the security at that hotel was as bad as what the poster described.
Does anyone know what hotel Erin Andrews is staying in?
the reason for not having nice things (Score:1)
This, exactly this, hacking into it, outing it as cheap crap, saying it's not secure, blah blah blah, keep living in your encrypted utopia and kill yourself yesterday for all our sakes.
why does it have to be ten times the price this hotel already paid for? just fuck you guys, you're all just a bunch of lame ass chatterbugs, not even worthy of any goatse.
have fun with it for a moment, let the hotel know about it, especially the owners of the hotel, and maybe just maybe, karma won't bite you in the electrical
Re: (Score:2)
I'm guessing this was intended as hyperbole, and I don't know what the actual additional cost would have been for the hotel, although I expect a lack of security is common, and it may well have cost the hotel somewhat more to put some kind of security in place.
Where some kind of security is common practice though, I don't think it need cost an
Re: (Score:2)
I would like to use my device to simultaneously flush every toilet in the building. And then after having done that, then I would like to use my device to book a different hotel for the evening.
Because (Score:4, Insightful)
Welcome to the Internet of really gadamned stupid things.
I'm surprise the door locks weren' on the network. (Score:2)
Tetris? (Score:3)
Private VLAN (Score:2)
The solution is pretty simple, setup private vlanning so that only the ports in a given room can talk to each other, and any central server authenticates the connection based on the incoming port.
Sure the traffic is still in the clear but so what? You would be able mitm your own room and turn off your own lights, which you could have done anyway.