Vulnerabilities / Threats
7/13/2016
02:30 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

AirbnBreach: How Networks At Short-Term Rentals Are Wide Open To Attack

New age of community lodging opens the door for old-school network hacks, putting hosts and guests at risk of cyberattacks and stolen personal information.

Security researcher Jeremy Galloway calls it the APT, or “Average Paperclip Threat,” where a nefarious guest at an Airbnb or other community-driven rental property resets the home router there and gains full control of all of the network traffic by merely inserting a paper clip into the device.

Galloway, who at Black Hat USA next month will demonstrate how these hacks would work at an Airbnb, HomeAway, or other short-term home rental services, says the potential attack surface on these networks is massive given that there are some 36,000 Airbnb listings in New York City alone, for example. Compare that to the total number of Starbucks locations worldwide at 23,000, he says.

Given the push for business travelers to book these community hospitality spaces in lieu of traditional hotel stays, enterprises also are at risk if an employee is hit by a similar local network attack.

“We’ve been doing wireless attacks for over 20 years—what could possibly be left?” he says. The simple yet potentially massive risk of attacks on wireless networks in the “sharing economy” became painfully obvious to Galloway while staying at some of these lodging properties. Like sharing enterprises like Uber and Lyft, the operation relies on trust on both ends of the transaction. “You trust that no one will ruin [your] place,” he says. “But there’s no camera on me … there’s too much trust when it comes to [the] network security.”

It comes down to the simple fact that an attacker could have physical access to the home router, which is a notoriously low-security device, in any case. But even if the device uses default credentials, all an attacker would have to do is hit the reset button with a paper clip and then he or she owns that device (even after checkout time) --and the network--by taking over the administrative interface. No zero-day or hacking required.

“If you can put your hands on the router in a home you are no longer just like another attacker on the network – you control the network and anyone who subsequently connects to it, goes to you first,” Galloway says.

“That single reset button on a router removes all security, and [introduces] a new point of attack: attacks coming from the network versus from another user on the network,” he says.

An attacker could wage man-in-the middle attacks on the network and sniff traffic, or execute DNS hijacking and force a client’s online banking session to the attacker’s own site in order to grab credentials and other personal information.

“If there’s an update for software, you can hijack their software updates and add your own malicious software in there,” too, he says.

And unlike some attacks, this one is cross-platform: because it’s a network-based attack, Windows and OS X laptops, iPhones, Androids, and other devices all are in the bullseye.

Still, Galloway says such physical hacking at Airbnb and other properties doesn’t currently pose a high risk, but given the volume of properties hosting strangers every day in their homes, it could become a widespread concern. Airbnb, for example, currently has some 2 million property listings: “It’s a numbers game because there are so many” possible targets, he says.

What can an Airbnb or other hosts do to protect their router from sabotage? Don’t leave the router sitting out in the open in a rental unit: either keep it in the main house outside the guest’s reach, or in a locked room or closet. If it has to be in plain sight, secure it with a lockbox, he says.

Black Hat USA returns to the fabulous Mandalay Bay in Las Vegas, Nevada July 30 through Aug. 4, 2016. Click for information on the conference schedule and to register.

“It’s about keeping people honest and stopping the easy attack,” he says.

Galloway says he doesn’t know of any real-world attacks as yet; just his own research. “I would not be surprised in the least” if such attacks had occurred, he says.

A rental host wouldn’t easily be able to detect a reset router since it’s unlikely they review their router logs, for instance, he says.

When it comes to security, Airbnb, HomeAway and other similar services tend to focus more on concerns about physical damage to a host's home, he says. A network hacker isn’t on high their radar screens. “Best case, what they could do is suggest that people [hosts] either lock their router using specific hardware, or put the router in a secure location,” he says.

Galloway's Black Hat talk, "AirBnBeware: Short Term Rentals, Long Term Pwnage," is on August 4.

Related Black Hat 2016 Content:

 

 

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "I've seen worse.  Last week Tim had a dragon."
Current Issue
Security Operations and IT Operations: Finding the Path to Collaboration
A wide gulf has emerged between SOC and NOC teams that's keeping both of them from assuring the confidentiality, integrity, and availability of IT systems. Here's how experts think it should be bridged.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.