4 ms·

Personally, even the remotest possibility of someone broadcasting "evacuate your rooms, there is a fire/active shooter in the building" seems worth spending a f

Personally, even the remotest possibility of someone broadcasting "evacuate your rooms, there is a fire/active shooter in the building" seems worth spending a few hours protecting against.

gambiting 4y ago
....why? No, honestly, why? Would you protect against someone running down the corridor shouting the same thing?
- petertodd 4y ago
  It's a lot more official if it's coming from the elevator speakers. It's also a lot harder to track down who did it.
  - deleted 4y ago
    [deleted]
- paisawalla 4y ago
  > Would you protect against someone running down the corridor shouting the same thing? ...yes? Do you think hotels aren't protected, to some extent, against any random person putting on a blazer and announcing an emergency?
  - gambiting 4y ago
    >>Do you think hotels aren't protected, to some extent How are they protected against that, exactly? You can literally walk up to any fire emergency button on any wall on any floor, press a button and evacuate the entire hotel, why bother with this UDP streaming nonsense?
    - password11 4y ago
      > How are they protected against that, exactly? You can literally walk up to any fire emergency button on any wall Cameras near fire alarms and it's a crime in the U.S. to give a false alarm.
      - gambiting 4y ago
        Right, that protects the hotel from liability, but it does nothing to protect the hotel from such false alarm happening in the first place.
        password11 4y ago
        The threat to the perpetrator -- of 90 days prison time and a permanent criminal record of being a mischief-maker -- prevents people from pulling the alarm. Same way sheepdogs herd sheep.
        gambiting 4y ago
        Sure, and to circle all the way back to the original point several posts up - why is this a deterrent to someone pulling a fire alarm but not for someone sending a fake UDP broadcast? The penalty will be exactly the same.
        password11 4y ago
        Harder to track down the person. Unless the hotel is logging every packet on its network and paying to archive the TBs of encrypted video streaming data that goes through every day. And it's a purely local network, so not like the NSA can help out. Edit: "Unauthorized" computer access is a serious federal crime under the CFAA, and that you did it as a joke is not a legal defense. Famous examples: (1) https://en.m.wikipedia.org/wiki/Aaron_Swartz https://en.m.wikipedia.org/wiki/Aaron_Swartz (2) the Florida man who social engineered Twitter (https://en.m.wikipedia.org/wiki/Graham_Ivan_Clark https://en.m.wikipedia.org/wiki/Graham_Ivan_Clark) (3) the Mirai botnet guys (https://en.m.wikipedia.org/wiki/Mirai_(malware) https://en.m.wikipedia.org/wiki/Mirai_(malware)), etc. So the penalty will actually be much worse if you get caught.
    - paisawalla 4y ago
      If a hotel could spend a few hours and definitively prevent misuse of the fire emergency button, they would do that.
Salgat 4y ago
It'd be far more trivial to put a wireless speaker in an elevator than it would be to reverse engineer this.
- paisawalla 4y ago
  Hotels are reasonably protected to such an attack. There are almost always cameras in the elevator, and the electronics are typically, to some extent, tamper-resistant.
  - Salgat 4y ago
    It's not hard to subtly stick a small flat wireless speaker to the wall, and by the time they notice it the attack is already complete.
    - paisawalla 4y ago
      1. It's easier to connect to the wifi from across the street, without setting foot on the premises or showing your face on camera. 2. I'm not claiming that all attacks will be mitigated, but that this is an easy win from a cost:benefit analysis.
      - Salgat 4y ago
        The difficulty isn't in connecting to their wifi, but rather reverse engineering this bizarre backdoor just to project your voice in the elevator.
interstice 4y ago
This feels like one of those hypothetical attack vectors that has probably never happened. Although I could be wrong!
- paisawalla 4y ago
  There are certainly people out there who are motivated to trigger false alarms in hotels: https://profootballtalk.nbcsports.com/2017/01/22/police-apprehend-boston-man-for-false-alarm-at-steelers-hotel/amp/ https://profootballtalk.nbcsports.com/2017/01/22/police-appr...

Personally, even the remotest possibility of someone broadcasting "evacuate your rooms, there is a fire/active shooter in the building" seems worth spending a few hours protecting against.

gambiting 4y ago

....why? No, honestly, why? Would you protect against someone running down the corridor shouting the same thing?

petertodd 4y ago
It's a lot more official if it's coming from the elevator speakers. It's also a lot harder to track down who did it.
- deleted 4y ago
  [deleted]
paisawalla 4y ago
> Would you protect against someone running down the corridor shouting the same thing? ...yes? Do you think hotels aren't protected, to some extent, against any random person putting on a blazer and announcing an emergency?
- gambiting 4y ago
  >>Do you think hotels aren't protected, to some extent How are they protected against that, exactly? You can literally walk up to any fire emergency button on any wall on any floor, press a button and evacuate the entire hotel, why bother with this UDP streaming nonsense?
  - password11 4y ago
    > How are they protected against that, exactly? You can literally walk up to any fire emergency button on any wall Cameras near fire alarms and it's a crime in the U.S. to give a false alarm.
    - gambiting 4y ago
      Right, that protects the hotel from liability, but it does nothing to protect the hotel from such false alarm happening in the first place.
      - password11 4y ago
        The threat to the perpetrator -- of 90 days prison time and a permanent criminal record of being a mischief-maker -- prevents people from pulling the alarm. Same way sheepdogs herd sheep.
        gambiting 4y ago
        Sure, and to circle all the way back to the original point several posts up - why is this a deterrent to someone pulling a fire alarm but not for someone sending a fake UDP broadcast? The penalty will be exactly the same.
        password11 4y ago
        Harder to track down the person. Unless the hotel is logging every packet on its network and paying to archive the TBs of encrypted video streaming data that goes through every day. And it's a purely local network, so not like the NSA can help out. Edit: "Unauthorized" computer access is a serious federal crime under the CFAA, and that you did it as a joke is not a legal defense. Famous examples: (1) https://en.m.wikipedia.org/wiki/Aaron_Swartz https://en.m.wikipedia.org/wiki/Aaron_Swartz (2) the Florida man who social engineered Twitter (https://en.m.wikipedia.org/wiki/Graham_Ivan_Clark https://en.m.wikipedia.org/wiki/Graham_Ivan_Clark) (3) the Mirai botnet guys (https://en.m.wikipedia.org/wiki/Mirai_(malware) https://en.m.wikipedia.org/wiki/Mirai_(malware)), etc. So the penalty will actually be much worse if you get caught.
  - paisawalla 4y ago
    If a hotel could spend a few hours and definitively prevent misuse of the fire emergency button, they would do that.

Salgat 4y ago

It'd be far more trivial to put a wireless speaker in an elevator than it would be to reverse engineer this.

paisawalla 4y ago
Hotels are reasonably protected to such an attack. There are almost always cameras in the elevator, and the electronics are typically, to some extent, tamper-resistant.
- Salgat 4y ago
  It's not hard to subtly stick a small flat wireless speaker to the wall, and by the time they notice it the attack is already complete.
  - paisawalla 4y ago
    1. It's easier to connect to the wifi from across the street, without setting foot on the premises or showing your face on camera. 2. I'm not claiming that all attacks will be mitigated, but that this is an easy win from a cost:benefit analysis.
    - Salgat 4y ago
      The difficulty isn't in connecting to their wifi, but rather reverse engineering this bizarre backdoor just to project your voice in the elevator.

interstice 4y ago

This feels like one of those hypothetical attack vectors that has probably never happened. Although I could be wrong!

paisawalla 4y ago
There are certainly people out there who are motivated to trigger false alarms in hotels: https://profootballtalk.nbcsports.com/2017/01/22/police-apprehend-boston-man-for-false-alarm-at-steelers-hotel/amp/ https://profootballtalk.nbcsports.com/2017/01/22/police-appr...