Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

7/13/2016
02:30 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

AirbnBreach: How Networks At Short-Term Rentals Are Wide Open To Attack

New age of community lodging opens the door for old-school network hacks, putting hosts and guests at risk of cyberattacks and stolen personal information.

Security researcher Jeremy Galloway calls it the APT, or “Average Paperclip Threat,” where a nefarious guest at an Airbnb or other community-driven rental property resets the home router there and gains full control of all of the network traffic by merely inserting a paper clip into the device.

Galloway, who at Black Hat USA next month will demonstrate how these hacks would work at an Airbnb, HomeAway, or other short-term home rental services, says the potential attack surface on these networks is massive given that there are some 36,000 Airbnb listings in New York City alone, for example. Compare that to the total number of Starbucks locations worldwide at 23,000, he says.

Given the push for business travelers to book these community hospitality spaces in lieu of traditional hotel stays, enterprises also are at risk if an employee is hit by a similar local network attack.

“We’ve been doing wireless attacks for over 20 years—what could possibly be left?” he says. The simple yet potentially massive risk of attacks on wireless networks in the “sharing economy” became painfully obvious to Galloway while staying at some of these lodging properties. Like sharing enterprises like Uber and Lyft, the operation relies on trust on both ends of the transaction. “You trust that no one will ruin [your] place,” he says. “But there’s no camera on me … there’s too much trust when it comes to [the] network security.”

It comes down to the simple fact that an attacker could have physical access to the home router, which is a notoriously low-security device, in any case. But even if the device uses default credentials, all an attacker would have to do is hit the reset button with a paper clip and then he or she owns that device (even after checkout time) --and the network--by taking over the administrative interface. No zero-day or hacking required.

“If you can put your hands on the router in a home you are no longer just like another attacker on the network – you control the network and anyone who subsequently connects to it, goes to you first,” Galloway says.

“That single reset button on a router removes all security, and [introduces] a new point of attack: attacks coming from the network versus from another user on the network,” he says.

An attacker could wage man-in-the middle attacks on the network and sniff traffic, or execute DNS hijacking and force a client’s online banking session to the attacker’s own site in order to grab credentials and other personal information.

“If there’s an update for software, you can hijack their software updates and add your own malicious software in there,” too, he says.

And unlike some attacks, this one is cross-platform: because it’s a network-based attack, Windows and OS X laptops, iPhones, Androids, and other devices all are in the bullseye.

Still, Galloway says such physical hacking at Airbnb and other properties doesn’t currently pose a high risk, but given the volume of properties hosting strangers every day in their homes, it could become a widespread concern. Airbnb, for example, currently has some 2 million property listings: “It’s a numbers game because there are so many” possible targets, he says.

What can an Airbnb or other hosts do to protect their router from sabotage? Don’t leave the router sitting out in the open in a rental unit: either keep it in the main house outside the guest’s reach, or in a locked room or closet. If it has to be in plain sight, secure it with a lockbox, he says.

Black Hat USA returns to the fabulous Mandalay Bay in Las Vegas, Nevada July 30 through Aug. 4, 2016. Click for information on the conference schedule and to register.

“It’s about keeping people honest and stopping the easy attack,” he says.

Galloway says he doesn’t know of any real-world attacks as yet; just his own research. “I would not be surprised in the least” if such attacks had occurred, he says.

A rental host wouldn’t easily be able to detect a reset router since it’s unlikely they review their router logs, for instance, he says.

When it comes to security, Airbnb, HomeAway and other similar services tend to focus more on concerns about physical damage to a host's home, he says. A network hacker isn’t on high their radar screens. “Best case, what they could do is suggest that people [hosts] either lock their router using specific hardware, or put the router in a secure location,” he says.

Galloway's Black Hat talk, "AirBnBeware: Short Term Rentals, Long Term Pwnage," is on August 4.

Related Black Hat 2016 Content:

 

 

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/13/2020
Omdia Research Launches Page on Dark Reading
Tim Wilson, Editor in Chief, Dark Reading 7/9/2020
Russian Cyber Gang 'Cosmic Lynx' Focuses on Email Fraud
Kelly Sheridan, Staff Editor, Dark Reading,  7/7/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-14300
PUBLISHED: 2020-07-13
The docker packages version docker-1.13.1-108.git4ef4b30.el7 as released for Red Hat Enterprise Linux 7 Extras via RHBA-2020:0053 (https://access.redhat.com/errata/RHBA-2020:0053) included an incorrect version of runc that was missing multiple bug and security fixes. One of the fixes regressed in th...
CVE-2020-14298
PUBLISHED: 2020-07-13
The version of docker as released for Red Hat Enterprise Linux 7 Extras via RHBA-2020:0053 advisory included an incorrect version of runc missing the fix for CVE-2019-5736, which was previously fixed via RHSA-2019:0304. This issue could allow a malicious or compromised container to compromise the co...
CVE-2020-15050
PUBLISHED: 2020-07-13
An issue was discovered in the Video Extension in Suprema BioStar 2 before 2.8.2. Remote attackers can read arbitrary files from the server via Directory Traversal.
CVE-2020-10987
PUBLISHED: 2020-07-13
The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary system commands via the deviceName POST parameter.
CVE-2020-10988
PUBLISHED: 2020-07-13
A hard-coded telnet credential in the tenda_login binary of Tenda AC15 AC1900 version 15.03.05.19 allows unauthenticated remote attackers to start a telnetd service on the device.