My IT projects

Lately, I was traveling across the United States, I went from Miami to the big apple stopping here in there when there was something to visit, anyway during the trip I saw a fair amount of security issues that are well know, but I thought they would all be fixed by now, but nope ! so I decided that it would be a good idea to describe them again here. This post does not describe something new, and most of the issues have been there for ages but considering the fact that I was staying  ‘nice’ hotels, I was impressed that those flaws were still out there.

Security Issue Nº1

The first security issue I came across were the plethora of open WiFis in hotels and all over the country. As a Security aficionado and Ethical Hacker I always have a script  running to check for Man In The Middle (MITM) on the network I’m using, (basically I’m also using a VPN) but I’m a very curious person as well, and in two of the hotels I was staying I got a MITM alert. This means that twice my data could have been stolen by someone.

Security Issue Nº2

The second WiFi security issue happened in an hotel as well. To log in, the user had to enter his registration name and his corresponding room number, this was a good start, unfortunately everybody could connect to the hotspot and send the data of the form handled by a GET method.

The data sent where the following :

As you can see, the name was included in the GET method as well as the room number, the time unit requested, the total in dollars and finally, if a discount had been given to the user. I found it appalling since the software used by the hotel came from a company advertising as well for security services.

Security Issue Nº3

The third issue discovered was more based on social engineering and biometry. If you guys have ever been to Universal Studios in Orlando, and that you tried the biggest attraction of the parc (the wizzarding world  of Harry Potter) you should remember the following.

In the middle of the queue you are ask to put your bags in a locker (for safety during the ride), to open and close the locker you have to  use a finger print, and I did it as well, unfortunately for me, at the end of the ride, with the 90ºF, and the greasiness of the fingers of all the people using the biometric finger reader, I wasn’t able to open my locker.

I then asked myself how to open it, and wondered if, when asking the agent responsible for the lockers he would ask me some “security” questions such as :

• What does the locker contains ?
• Do you have an ID ?
• Can you try to open the locker again ?

Security Issue Nº4

The last issue I found, has been covered via multiple youtube video and almost all the hotels i was staying in had that problem.

Each hotel room usually contains a SAFE   and usually  every customer is able to reset the password by pressing a key such as ‘*’ then enter a new code (4 to 6-8 digits) and press another key to lock such as ‘#’, unfortunatelly what the manual and the hotel does not tell you, is that the default code to open the safe is usually one of these :

1. 1111
2. 0000
3. 1234
4. 123456

So, now I just have to hope that next time, things will have changed  (Mouhahaha)