Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

7/13/2016
02:30 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

AirbnBreach: How Networks At Short-Term Rentals Are Wide Open To Attack

New age of community lodging opens the door for old-school network hacks, putting hosts and guests at risk of cyberattacks and stolen personal information.

Security researcher Jeremy Galloway calls it the APT, or “Average Paperclip Threat,” where a nefarious guest at an Airbnb or other community-driven rental property resets the home router there and gains full control of all of the network traffic by merely inserting a paper clip into the device.

Galloway, who at Black Hat USA next month will demonstrate how these hacks would work at an Airbnb, HomeAway, or other short-term home rental services, says the potential attack surface on these networks is massive given that there are some 36,000 Airbnb listings in New York City alone, for example. Compare that to the total number of Starbucks locations worldwide at 23,000, he says.

Given the push for business travelers to book these community hospitality spaces in lieu of traditional hotel stays, enterprises also are at risk if an employee is hit by a similar local network attack.

“We’ve been doing wireless attacks for over 20 years—what could possibly be left?” he says. The simple yet potentially massive risk of attacks on wireless networks in the “sharing economy” became painfully obvious to Galloway while staying at some of these lodging properties. Like sharing enterprises like Uber and Lyft, the operation relies on trust on both ends of the transaction. “You trust that no one will ruin [your] place,” he says. “But there’s no camera on me … there’s too much trust when it comes to [the] network security.”

It comes down to the simple fact that an attacker could have physical access to the home router, which is a notoriously low-security device, in any case. But even if the device uses default credentials, all an attacker would have to do is hit the reset button with a paper clip and then he or she owns that device (even after checkout time) --and the network--by taking over the administrative interface. No zero-day or hacking required.

“If you can put your hands on the router in a home you are no longer just like another attacker on the network – you control the network and anyone who subsequently connects to it, goes to you first,” Galloway says.

“That single reset button on a router removes all security, and [introduces] a new point of attack: attacks coming from the network versus from another user on the network,” he says.

An attacker could wage man-in-the middle attacks on the network and sniff traffic, or execute DNS hijacking and force a client’s online banking session to the attacker’s own site in order to grab credentials and other personal information.

“If there’s an update for software, you can hijack their software updates and add your own malicious software in there,” too, he says.

And unlike some attacks, this one is cross-platform: because it’s a network-based attack, Windows and OS X laptops, iPhones, Androids, and other devices all are in the bullseye.

Still, Galloway says such physical hacking at Airbnb and other properties doesn’t currently pose a high risk, but given the volume of properties hosting strangers every day in their homes, it could become a widespread concern. Airbnb, for example, currently has some 2 million property listings: “It’s a numbers game because there are so many” possible targets, he says.

What can an Airbnb or other hosts do to protect their router from sabotage? Don’t leave the router sitting out in the open in a rental unit: either keep it in the main house outside the guest’s reach, or in a locked room or closet. If it has to be in plain sight, secure it with a lockbox, he says.

Black Hat USA returns to the fabulous Mandalay Bay in Las Vegas, Nevada July 30 through Aug. 4, 2016. Click for information on the conference schedule and to register.

“It’s about keeping people honest and stopping the easy attack,” he says.

Galloway says he doesn’t know of any real-world attacks as yet; just his own research. “I would not be surprised in the least” if such attacks had occurred, he says.

A rental host wouldn’t easily be able to detect a reset router since it’s unlikely they review their router logs, for instance, he says.

When it comes to security, Airbnb, HomeAway and other similar services tend to focus more on concerns about physical damage to a host's home, he says. A network hacker isn’t on high their radar screens. “Best case, what they could do is suggest that people [hosts] either lock their router using specific hardware, or put the router in a secure location,” he says.

Galloway's Black Hat talk, "AirBnBeware: Short Term Rentals, Long Term Pwnage," is on August 4.

Related Black Hat 2016 Content:

 

 

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Navigating Security in the Cloud
Diya Jolly, Chief Product Officer, Okta,  12/4/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19642
PUBLISHED: 2019-12-08
On SuperMicro X8STi-F motherboards with IPMI firmware 2.06 and BIOS 02.68, the Virtual Media feature allows OS Command Injection by authenticated attackers who can send HTTP requests to the IPMI IP address. This requires a POST to /rpc/setvmdrive.asp with shell metacharacters in ShareHost or ShareNa...
CVE-2019-19637
PUBLISHED: 2019-12-08
An issue was discovered in libsixel 1.8.2. There is an integer overflow in the function sixel_decode_raw_impl at fromsixel.c.
CVE-2019-19638
PUBLISHED: 2019-12-08
An issue was discovered in libsixel 1.8.2. There is a heap-based buffer overflow in the function load_pnm at frompnm.c, due to an integer overflow.
CVE-2019-19635
PUBLISHED: 2019-12-08
An issue was discovered in libsixel 1.8.2. There is a heap-based buffer overflow in the function sixel_decode_raw_impl at fromsixel.c.
CVE-2019-19636
PUBLISHED: 2019-12-08
An issue was discovered in libsixel 1.8.2. There is an integer overflow in the function sixel_encode_body at tosixel.c.