Sponsored By

Cyberattackers Make Waves in Hotel Swimming Pool ControlsCyberattackers Make Waves in Hotel Swimming Pool Controls

Pool controllers exposed to the Internet with default passwords let threat actors tweak pool pH levels, and potentially more.

Dark Reading Staff

September 19, 2022

1 Min Read
Woman on tablet with legs over a hotel pool
Source: Antonio Santos via Alamy

After the hacktivist group GhostSec bragged it had breached a hotel pool controller in Israel, a team of researchers decided to take a deep dive. 

The cyberattack group didn't provide details about the operational technology (OT) breach, but researchers at Otorio found two Aegis II controllers exposed to the Internet with default passwords. The Aegis II controller is used to control the chemical concentration in water in locations such as pools. 

Last week, GhostSec first claimed it breached 55 Berghof programmable logic controllers (PLCs) across Israel. On Sept. 10, the group claimed it had control over an unidentified hotel's pool water system. 

GhostSec warned in a posted message that while it has control of the pool's pH and chlorine levels, it wasn't interested in using the access to harm innocent people. The threat actors simply wanted to demonstrate the kind of damage they could do, the post added. 

"Our research found two pool controllers that could be affected," the Otorio report said. "While we do not know for certain, it appears that the most likely aim of the breach was for the attackers to demonstrate that they had the ability to control the water's pH in the hotel's pools as GhostSec's Telegram message alleged."

The researchers noted that the incident underscores the potential dangerous real-world implications of OT cyberattacks. 

About the Author(s)

Dark Reading Staff

Dark Reading

Dark Reading is a leading cybersecurity media site.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like

More Insights