Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

7/13/2016
02:30 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

AirbnBreach: How Networks At Short-Term Rentals Are Wide Open To Attack

New age of community lodging opens the door for old-school network hacks, putting hosts and guests at risk of cyberattacks and stolen personal information.

Security researcher Jeremy Galloway calls it the APT, or “Average Paperclip Threat,” where a nefarious guest at an Airbnb or other community-driven rental property resets the home router there and gains full control of all of the network traffic by merely inserting a paper clip into the device.

Galloway, who at Black Hat USA next month will demonstrate how these hacks would work at an Airbnb, HomeAway, or other short-term home rental services, says the potential attack surface on these networks is massive given that there are some 36,000 Airbnb listings in New York City alone, for example. Compare that to the total number of Starbucks locations worldwide at 23,000, he says.

Given the push for business travelers to book these community hospitality spaces in lieu of traditional hotel stays, enterprises also are at risk if an employee is hit by a similar local network attack.

“We’ve been doing wireless attacks for over 20 years—what could possibly be left?” he says. The simple yet potentially massive risk of attacks on wireless networks in the “sharing economy” became painfully obvious to Galloway while staying at some of these lodging properties. Like sharing enterprises like Uber and Lyft, the operation relies on trust on both ends of the transaction. “You trust that no one will ruin [your] place,” he says. “But there’s no camera on me … there’s too much trust when it comes to [the] network security.”

It comes down to the simple fact that an attacker could have physical access to the home router, which is a notoriously low-security device, in any case. But even if the device uses default credentials, all an attacker would have to do is hit the reset button with a paper clip and then he or she owns that device (even after checkout time) --and the network--by taking over the administrative interface. No zero-day or hacking required.

“If you can put your hands on the router in a home you are no longer just like another attacker on the network – you control the network and anyone who subsequently connects to it, goes to you first,” Galloway says.

“That single reset button on a router removes all security, and [introduces] a new point of attack: attacks coming from the network versus from another user on the network,” he says.

An attacker could wage man-in-the middle attacks on the network and sniff traffic, or execute DNS hijacking and force a client’s online banking session to the attacker’s own site in order to grab credentials and other personal information.

“If there’s an update for software, you can hijack their software updates and add your own malicious software in there,” too, he says.

And unlike some attacks, this one is cross-platform: because it’s a network-based attack, Windows and OS X laptops, iPhones, Androids, and other devices all are in the bullseye.

Still, Galloway says such physical hacking at Airbnb and other properties doesn’t currently pose a high risk, but given the volume of properties hosting strangers every day in their homes, it could become a widespread concern. Airbnb, for example, currently has some 2 million property listings: “It’s a numbers game because there are so many” possible targets, he says.

What can an Airbnb or other hosts do to protect their router from sabotage? Don’t leave the router sitting out in the open in a rental unit: either keep it in the main house outside the guest’s reach, or in a locked room or closet. If it has to be in plain sight, secure it with a lockbox, he says.

Black Hat USA returns to the fabulous Mandalay Bay in Las Vegas, Nevada July 30 through Aug. 4, 2016. Click for information on the conference schedule and to register.

“It’s about keeping people honest and stopping the easy attack,” he says.

Galloway says he doesn’t know of any real-world attacks as yet; just his own research. “I would not be surprised in the least” if such attacks had occurred, he says.

A rental host wouldn’t easily be able to detect a reset router since it’s unlikely they review their router logs, for instance, he says.

When it comes to security, Airbnb, HomeAway and other similar services tend to focus more on concerns about physical damage to a host's home, he says. A network hacker isn’t on high their radar screens. “Best case, what they could do is suggest that people [hosts] either lock their router using specific hardware, or put the router in a secure location,” he says.

Galloway's Black Hat talk, "AirBnBeware: Short Term Rentals, Long Term Pwnage," is on August 4.

Related Black Hat 2016 Content:

 

 

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Commentary
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
Edge-DRsplash-11-edge-ask-the-experts
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
News
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-35196
PUBLISHED: 2021-06-21
** DISPUTED ** Manuskript through 0.12.0 allows remote attackers to execute arbitrary code via a crafted settings.pickle file in a project file, because there is insecure deserialization via the pickle.load() function in settings.py. NOTE: the vendor's position is that the product is not intended fo...
CVE-2010-1433
PUBLISHED: 2021-06-21
Joomla! Core is prone to a vulnerability that lets attackers upload arbitrary files because the application fails to properly verify user-supplied input. An attacker can exploit this vulnerability to upload arbitrary code and run it in the context of the webserver process. This may facilitate unauth...
CVE-2010-1434
PUBLISHED: 2021-06-21
Joomla! Core is prone to a session fixation vulnerability. An attacker may leverage this issue to hijack an arbitrary session and gain access to sensitive information, which may help in launching further attacks. Joomla! Core versions 1.5.x ranging from 1.5.0 and up to and including 1.5.15 are vulne...
CVE-2010-1435
PUBLISHED: 2021-06-21
Joomla! Core is prone to a security bypass vulnerability. Exploiting this issue may allow attackers to perform otherwise restricted actions and subsequently retrieve password reset tokens from the database through an already existing SQL injection vector. Joomla! Core versions 1.5.x ranging from 1.5...
CVE-2010-0413
PUBLISHED: 2021-06-21
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none.