AirbnBreach: How Networks At Short-Term Rentals Are Wide Open To Attack

Security researcher Jeremy Galloway calls it the APT, or “Average Paperclip Threat,” where a nefarious guest at an Airbnb or other community-driven rental property resets the home router there and gains full control of all of the network traffic by merely inserting a paper clip into the device.

Galloway, who at Black Hat USA next month will demonstrate how these hacks would work at an Airbnb, HomeAway, or other short-term home rental services, says the potential attack surface on these networks is massive given that there are some 36,000 Airbnb listings in New York City alone, for example. Compare that to the total number of Starbucks locations worldwide at 23,000, he says.

Given the push for business travelers to book these community hospitality spaces in lieu of traditional hotel stays, enterprises also are at risk if an employee is hit by a similar local network attack.

“We’ve been doing wireless attacks for over 20 years—what could possibly be left?” he says. The simple yet potentially massive risk of attacks on wireless networks in the “sharing economy” became painfully obvious to Galloway while staying at some of these lodging properties. Like sharing enterprises like Uber and Lyft, the operation relies on trust on both ends of the transaction. “You trust that no one will ruin [your] place,” he says. “But there’s no camera on me … there’s too much trust when it comes to [the] network security.”

It comes down to the simple fact that an attacker could have physical access to the home router, which is a notoriously low-security device, in any case. But even if the device uses default credentials, all an attacker would have to do is hit the reset button with a paper clip and then he or she owns that device (even after checkout time) --and the network--by taking over the administrative interface. No zero-day or hacking required.

“If you can put your hands on the router in a home you are no longer just like another attacker on the network – you control the network and anyone who subsequently connects to it, goes to you first,” Galloway says.

“That single reset button on a router removes all security, and [introduces] a new point of attack: attacks coming from the network versus from another user on the network,” he says.

An attacker could wage man-in-the middle attacks on the network and sniff traffic, or execute DNS hijacking and force a client’s online banking session to the attacker’s own site in order to grab credentials and other personal information.

“If there’s an update for software, you can hijack their software updates and add your own malicious software in there,” too, he says.

And unlike some attacks, this one is cross-platform: because it’s a network-based attack, Windows and OS X laptops, iPhones, Androids, and other devices all are in the bullseye.

Still, Galloway says such physical hacking at Airbnb and other properties doesn’t currently pose a high risk, but given the volume of properties hosting strangers every day in their homes, it could become a widespread concern. Airbnb, for example, currently has some 2 million property listings: “It’s a numbers game because there are so many” possible targets, he says.

What can an Airbnb or other hosts do to protect their router from sabotage? Don’t leave the router sitting out in the open in a rental unit: either keep it in the main house outside the guest’s reach, or in a locked room or closet. If it has to be in plain sight, secure it with a lockbox, he says.

Black Hat USA returns to the fabulous Mandalay Bay in Las Vegas, Nevada July 30 through Aug. 4, 2016. Click for information on the conference schedule and to register.

“It’s about keeping people honest and stopping the easy attack,” he says.

Galloway says he doesn’t know of any real-world attacks as yet; just his own research. “I would not be surprised in the least” if such attacks had occurred, he says.

A rental host wouldn’t easily be able to detect a reset router since it’s unlikely they review their router logs, for instance, he says.

When it comes to security, Airbnb, HomeAway and other similar services tend to focus more on concerns about physical damage to a host's home, he says. A network hacker isn’t on high their radar screens. “Best case, what they could do is suggest that people [hosts] either lock their router using specific hardware, or put the router in a secure location,” he says.

Galloway's Black Hat talk, "AirBnBeware: Short Term Rentals, Long Term Pwnage," is on August 4.

Related Black Hat 2016 Content: