6 ms·

In a large hotel/resort, there are literally hundreds of people with access to your hotel room at any given time. There's a reason hotel room doors have deadbo

In a large hotel/resort, there are literally hundreds of people with access to your hotel room at any given time. There's a reason hotel room doors have deadbolts and chains in addition to the keycard - they've never been considered 'secure'...

duxup 9y ago
Physical access dynamics area always interesting. I used to visit data centers with high security to work on some equipment. I almost always had more access to more areas than the local employees. I had the magic hand that could open all doors. Many server guys couldn't physically access the data center floor, but I could, and I didn't even work for the company. The only guys who had more access than I did.... their $15 an hour security guys and ... the janitors. Every room had a garbage can somewhere, someone had to get it... funny how that works.
- jschwartzi 9y ago
  At one company I worked at we had to take our garbage cans outside the room if we wanted them emptied because the janitor did not have access to our office.
  - duxup 9y ago
    That seems like a better thought out policy.
    - dylan604 9y ago
      until you work in a unionized shop that is over-serious about it. i made the mistake of moving the trashcan outside the door, and then had to sit through a union lecture about doing someone else's job. didn't work for that company any longer than it took to find a new job
      - rahimnathwani 9y ago
        I was on a flight recently (I think on United), and noticed that the trash can in one of the washrooms was full and, judging by the paper towels around, had been full for some time. I told one of the attendants when I went to get a snack. She told me they couldn't empty the trash can. I didn't push, but it seemed strange that they were willing to leave a full trash can in one of a very limited number of washrooms on a full plane.
  - antonvs 9y ago
    That's how it worked at my last position. Some of these basic issues are not that difficult to address, it's just that most companies don't care enough to bother with it.
- Osiris 9y ago
  In college I worked as a janitor and I had access to every room in the building, including the off-limits President's room. It's no wonder that in TV and movies the good guys always infiltrate by dressing up as janitors.
  - mabbo 9y ago
    I was the IT guy at a government intelligence agency in Canada as an intern one summer. I had access to darned near the entire building. I had secret level clearance, but I could get into rooms that required top secret. And I was allowed to wear jeans to work because IT guys need to get down on the floor frequently!
    - heavenlyblue 9y ago
      What's the chance they've hired you only because they were also reading all of your communications?
      - mabbo 9y ago
        If they were reading all of my communications, they probably wouldn't have hired me.
- sbuttgereit 9y ago
  :-) In the early 00's we were looking for data centers to host our infrastructure and I remember a couple of the tours we took. On all the tours we saw the man-traps and the fancy hand scanning bio-metric locks as they touted how seriously they took the security of our servers... ...but as we were touring one of the facilities, a large back door was wide open to the outside directly into the main server room. As far as we could see it was unattended. To be fair, I'm sure there was someone around... somewhere... and that the door couldn't have been left open like that for long (forget about access controls, environmental controls were compromised by that one, too!) At another facility during that same RFP, the sales guy was trying to get us into a room and the fancy hand scanner wasn't accepting his hand for entry. So in a fit of frustration he just opened the door... it actually wasn't locked at all. Ah... good times...
- stuffedBelly 9y ago
  ha, this reminds me of once I left my badge at home and snuck into my office from the mailroom entrance instead of the actual front-door entrance with badge scanners and security guards.
- wlll 9y ago
  > The only guys who had more access than I did.... their $15 an hour security guys and ... the janitors. The invisible work force!
VikingCoder 9y ago
And the deadbolts don't work that great, either: https://twitter.com/sehnaoui/status/978339459208007686?lang=en https://twitter.com/sehnaoui/status/978339459208007686?lang=...
- et-al 9y ago
  Small aside, but that door isn't deadbolted. This shimming vulnerability has always been there for any non-deadbolt style latch.
TheCraiggers 9y ago
Deadbolts and chains don't help if you're not in the room, since you can't lock those on the way out. I suppose this is why many rooms have safes as well, although I'm sure those are riddled with security defects too, like everything else.
- emodendroket 9y ago
  I'm sure there's a way for the hotel management to just open those regardless of your passcode.
  - dogma1138 9y ago
    Many of them don’t have a back or the back slides out the only thing you need is to unscrew a few screws often wood screws since hotels love screwing them to a shelf in the closet. Master passkeys also work on most safes.
- teagoat 9y ago
  Usually as easy as trying the default master password https://gizmodo.com/5837561/can-000000-secretly-open-your-hotel-safe https://gizmodo.com/5837561/can-000000-secretly-open-your-ho... https://www.independent.co.uk/travel/news-and-advice/hotel-room-safes-master-code-default-override-hack-security-thieves-use-a8177831.html https://www.independent.co.uk/travel/news-and-advice/hotel-r...
toomanybeersies 9y ago
It's the same story when people get high quality locks for their house. If a thief wants to get in, they'll just break the window. I've also seen it before with high grade padlocks on a chain link fence, often with razor wire on top. Bolt cutters may not be able to cut the lock, but they could cut the chain link like butter. Security is only as strong as its weakest link. This is why social engineering has always been such an effective method of hacking.
- bcook 9y ago
  I think the better reasoning behind using high-end locks in your home is that you have a much better chance of knowing your house has been broken in to. With standard locks, a thief can quickly and easily gain access without the homeowner knowing. (I agree with the gist of your post though.)
  - 52-6F-62 9y ago
    > With standard locks, a thief can quickly and easily gain access without the homeowner knowing. Too true. Especially cheap ones with tumblers only on one side. In [more than] one of my old apartments I remember having to sit at the mailbox picking the lock so I could open it and replace it because the previous tenants left with all of the mail keys. It was funny to have people walk in and just say hello as if nothing was happening. "It could have been your mailbox. I just entered mine with my girlfriends bobby pin while you were standing there. Somehow yours is never vulnerable." Of course I wouldn't say that— but oh that I would... ;P
    - amag 9y ago
      > just say hello as if nothing was happening I think the psychology here is that if you behave as if what you're doing is ok and not suspicious, most people will accept that. Same thing for instance when I've gone and picked up my wife's locked bike at her job and put in the car. Most people assume that if I'm doing it publicly, I'm not doing anything shady.
    - roywiggins 9y ago
paxys 9y ago
It is also ridiculously easy to get a new keycard for a hotel room from the front desk. They don't even check ID most of the time.
- dylan604 9y ago
  "I left my key in my room as well as my wallet, so I don't have ID" is so effective when they do ask for it. Social Engineering has always been an effective method for getting around security.
  - lotsofpulp 9y ago
    And hotel guests complain about hotels taking copies of their photo ID at check in to avoid the above scenario.
rando444 9y ago
Keycard manipulation was used in the assassination of Mahmoud Al-Mabhouh.. for anyone doesn't remember that crazy story. https://en.wikipedia.org/wiki/Assassination_of_Mahmoud_Al-Mabhouh https://en.wikipedia.org/wiki/Assassination_of_Mahmoud_Al-Ma...

duxup 9y ago

Physical access dynamics area always interesting. I used to visit data centers with high security to work on some equipment. I almost always had more access to more areas than the local employees. I had the magic hand that could open all doors. Many server guys couldn't physically access the data center floor, but I could, and I didn't even work for the company. The only guys who had more access than I did.... their $15 an hour security guys and ... the janitors. Every room had a garbage can somewhere, someone had to get it... funny how that works.

jschwartzi 9y ago
At one company I worked at we had to take our garbage cans outside the room if we wanted them emptied because the janitor did not have access to our office.
- duxup 9y ago
  That seems like a better thought out policy.
  - dylan604 9y ago
    until you work in a unionized shop that is over-serious about it. i made the mistake of moving the trashcan outside the door, and then had to sit through a union lecture about doing someone else's job. didn't work for that company any longer than it took to find a new job
    - rahimnathwani 9y ago
      I was on a flight recently (I think on United), and noticed that the trash can in one of the washrooms was full and, judging by the paper towels around, had been full for some time. I told one of the attendants when I went to get a snack. She told me they couldn't empty the trash can. I didn't push, but it seemed strange that they were willing to leave a full trash can in one of a very limited number of washrooms on a full plane.
- antonvs 9y ago
  That's how it worked at my last position. Some of these basic issues are not that difficult to address, it's just that most companies don't care enough to bother with it.
Osiris 9y ago
In college I worked as a janitor and I had access to every room in the building, including the off-limits President's room. It's no wonder that in TV and movies the good guys always infiltrate by dressing up as janitors.
- mabbo 9y ago
  I was the IT guy at a government intelligence agency in Canada as an intern one summer. I had access to darned near the entire building. I had secret level clearance, but I could get into rooms that required top secret. And I was allowed to wear jeans to work because IT guys need to get down on the floor frequently!
  - heavenlyblue 9y ago
    What's the chance they've hired you only because they were also reading all of your communications?
    - mabbo 9y ago
      If they were reading all of my communications, they probably wouldn't have hired me.
sbuttgereit 9y ago
:-) In the early 00's we were looking for data centers to host our infrastructure and I remember a couple of the tours we took. On all the tours we saw the man-traps and the fancy hand scanning bio-metric locks as they touted how seriously they took the security of our servers... ...but as we were touring one of the facilities, a large back door was wide open to the outside directly into the main server room. As far as we could see it was unattended. To be fair, I'm sure there was someone around... somewhere... and that the door couldn't have been left open like that for long (forget about access controls, environmental controls were compromised by that one, too!) At another facility during that same RFP, the sales guy was trying to get us into a room and the fancy hand scanner wasn't accepting his hand for entry. So in a fit of frustration he just opened the door... it actually wasn't locked at all. Ah... good times...
stuffedBelly 9y ago
ha, this reminds me of once I left my badge at home and snuck into my office from the mailroom entrance instead of the actual front-door entrance with badge scanners and security guards.
wlll 9y ago
> The only guys who had more access than I did.... their $15 an hour security guys and ... the janitors. The invisible work force!

VikingCoder 9y ago

And the deadbolts don't work that great, either: https://twitter.com/sehnaoui/status/978339459208007686?lang=en https://twitter.com/sehnaoui/status/978339459208007686?lang=...

et-al 9y ago
Small aside, but that door isn't deadbolted. This shimming vulnerability has always been there for any non-deadbolt style latch.

TheCraiggers 9y ago

Deadbolts and chains don't help if you're not in the room, since you can't lock those on the way out. I suppose this is why many rooms have safes as well, although I'm sure those are riddled with security defects too, like everything else.

emodendroket 9y ago
I'm sure there's a way for the hotel management to just open those regardless of your passcode.
- dogma1138 9y ago
  Many of them don’t have a back or the back slides out the only thing you need is to unscrew a few screws often wood screws since hotels love screwing them to a shelf in the closet. Master passkeys also work on most safes.
teagoat 9y ago
Usually as easy as trying the default master password https://gizmodo.com/5837561/can-000000-secretly-open-your-hotel-safe https://gizmodo.com/5837561/can-000000-secretly-open-your-ho... https://www.independent.co.uk/travel/news-and-advice/hotel-room-safes-master-code-default-override-hack-security-thieves-use-a8177831.html https://www.independent.co.uk/travel/news-and-advice/hotel-r...

toomanybeersies 9y ago

It's the same story when people get high quality locks for their house. If a thief wants to get in, they'll just break the window. I've also seen it before with high grade padlocks on a chain link fence, often with razor wire on top. Bolt cutters may not be able to cut the lock, but they could cut the chain link like butter. Security is only as strong as its weakest link. This is why social engineering has always been such an effective method of hacking.

bcook 9y ago
I think the better reasoning behind using high-end locks in your home is that you have a much better chance of knowing your house has been broken in to. With standard locks, a thief can quickly and easily gain access without the homeowner knowing. (I agree with the gist of your post though.)
- 52-6F-62 9y ago
  > With standard locks, a thief can quickly and easily gain access without the homeowner knowing. Too true. Especially cheap ones with tumblers only on one side. In [more than] one of my old apartments I remember having to sit at the mailbox picking the lock so I could open it and replace it because the previous tenants left with all of the mail keys. It was funny to have people walk in and just say hello as if nothing was happening. "It could have been your mailbox. I just entered mine with my girlfriends bobby pin while you were standing there. Somehow yours is never vulnerable." Of course I wouldn't say that— but oh that I would... ;P
  - amag 9y ago
    > just say hello as if nothing was happening I think the psychology here is that if you behave as if what you're doing is ok and not suspicious, most people will accept that. Same thing for instance when I've gone and picked up my wife's locked bike at her job and put in the car. Most people assume that if I'm doing it publicly, I'm not doing anything shady.
  - roywiggins 9y ago

paxys 9y ago

It is also ridiculously easy to get a new keycard for a hotel room from the front desk. They don't even check ID most of the time.

dylan604 9y ago
"I left my key in my room as well as my wallet, so I don't have ID" is so effective when they do ask for it. Social Engineering has always been an effective method for getting around security.
- lotsofpulp 9y ago
  And hotel guests complain about hotels taking copies of their photo ID at check in to avoid the above scenario.

rando444 9y ago

Keycard manipulation was used in the assassination of Mahmoud Al-Mabhouh.. for anyone doesn't remember that crazy story. https://en.wikipedia.org/wiki/Assassination_of_Mahmoud_Al-Mabhouh https://en.wikipedia.org/wiki/Assassination_of_Mahmoud_Al-Ma...