Hacking Your Hotel Room

It sounds so convenient.

Using just an iPad 2, guests at the St. Regis Shenzhen in China could control the heat in their room, turn on the TV, or even open the blinds.

But that convenience, as security researcher Jesus Molina discovered, came with a bit of a price. According to Molina, it was possible for an attacker to exploit a lack of security to remotely take control of virtually every appliance in the hotel.

At the upcoming Black Hat USA security conference in Las Vegas, Molina will walk through exactly how a hacker could do exactly that. At the center of the issue, Molina explained, is the lack of security in the implementation of home automation protocols, in this case KNX/IP.

"All these home automation protocols -- except ZigBee, which is kind of recent -- they are very old, but they are very extended so you cannot get rid of them," says Molina.

This may be good for businesses looking to create the type of super remote control that was used at the St. Regis Shenzhen, but the lack of authentication and encryption makes it good for attackers as well. According to Molina, the hotel - which took down the system after he presented hotel management with his findings - used the same wireless network for sending commands from the iPad that guests used to surf the Internet.

"The attacker needs software that [talks] KNX protocol," he says. "There are some open source options... but it's easy to implement the protocol in a small program. The attacker needs to know the address of each room and device."

At the St. Regis Shenzhen, the iPads had a static address, and sent a UDP packet with their room number periodically, he says.

"I changed rooms, and blindly tried to change the channel of that room with my laptop," Molina says. "But also, the outside lights were used to make sure I had the right address for the room. As I could make the 'Do Not Disturb' light heartbeat, I could make sure I had the right address for the room."

The attack, he notes, could be launched for anywhere; the hacker need not be in the vicinity of the hotel, or even in the country for that matter.

During his talk, he plans to offer details on the anatomy of the attack and explain the reverse engineering of the KNX/IP protocol as well as a description of deployment flaws and how to create an iPad Trojan to send commands outside the hotel.

He stumbled onto the issue during a business trip in China last year. During the trip, he stayed at the hotel and, intrigued by the idea of the iPad, began to record its traffic. At the time he did nothing with the information. However, in a separate visit to the hotel months later, he decided to experiment.

"The actual collecting of information and figuring out what are all the codes took me a couple of days," he says.

"The problem with hotels in particular is right now there really is no standard for securing [them]; there is no standard for how to deploy these things," he says. "And this kind of reflects the current status of the Internet of Things. Everybody deploys home automation in their own way. "