8 ms·

Hackers claim it only took a 10-minute phone call to shut down MGM Resorts

90 points by jimt1234 3y ago

sbate1987 3y ago
[dead]
JohnMakin 3y ago
Humans are always the biggest weakness in any system. I completely believe this, and it's a major reason why I don't keep my linkedin or other social profiles current.
mikece 3y ago
Wouldn't real hackers post evidence and not just claims?
- lcnPylGDnU4H9OF 3y ago
  If I had made some significant negative impact on a company's operations such that my antics made national news, I would likely choose to avoid providing evidence of my actions.
mannyv 3y ago
Hacker: "Ugh, I just lost my laptop. Can you reset my password?" Helpdesk: "Sure!" Hacker: "Thanks! What mail server should I use again? And what's the VPN IP? I need to RDP to fix some kind of outage." Helpdesk: "[redacted]" Hacker: "Thanks so much! Have a nice day!"
- withinboredom 3y ago
  I remember reading one of the earlier editions of "Art of Deception" which has lots of these types of examples. Like simply calling up the local county clerk to figure out when the police officer is on vacation for your traffic ticket, then getting a continuance for that day. The police officer doesn't show up, and you get off the hook. So many good stories. RIP.
  - ARandomerDude 3y ago
    When I worked for the government, my coworkers and I half joked that if you dressed nicely, wore a lanyard, and carried around a clipboard and a stopwatch, you could probably get into a lot of facilities you didn’t have access to. None of us were brave enough to try it.
    - aftbit 3y ago
      Or a ladder. Nobody stops a pair of people dressed like laborers carrying a ladder.
      - SoftTalker 3y ago
        Or just a high-vis vest, a hardhat, and a toolbox or belt.
        Freak_NL 3y ago
        Security minded types might still stop you, especially since these are the kind of well-known scenarios that might get used in security training. You want invisible? Be female, 40+, short but otherwise average build, any skin colour but white, black hair, generic cleaning staff outfit, and one of those carts with mops and buckets. Now you're invisible (racist, classist, and misogynistic biases exist, might as well use them). (As a 2m tall person I can't blend in anywhere.)
        withinboredom 3y ago
        Or just be very pregnant while carrying boxes, anybody will open the door for you. Pro-tip: prothesis pregnant belly full of tools.
        rthomas6 3y ago
        If you smoke a few Marlboros in a cleaning staff outfit, get some Walmart shoes, get a $30 phone, and get a mop and bucket, I feel like it might work pretty well.
- deleted 3y ago
  [deleted]
- mannyv 3y ago
  Posing as an IT person is the best way. I remember when NationsBank bought Bank of America (yes, it wasn't a merger) a friend bet another friend that he could get BofA root access. He called the branch manager saying he was from NationsBank IT and was going to do a pre-merger inspection. He showed up, asked for the root passwords of the boxes in the branch, logged in, left a MOTD message, then left. Needless to say they beefed up the training on that once the merger closed.
petercooper 3y ago
They should put the MGM Grand's front desk staff in charge.. Their car park machine ate one of my room keys so I popped to the desk on the way to the pool. As I wasn't carrying ID (just my other room key) they gave me a very thorough interrogation of the exact layout of the room, how much my upgrades cost, and other details before they'd issue a second key. Then they flat out refused to put parking charges onto my tab without ID. Yet if I had gone back to the room and merely pulled a single drink out of the minibar, I could have run up a $60 charge no problem!
- e40 3y ago
  > Yet if I had gone back to the room and merely pulled a single drink out of the minibar, I could have run up a $60 charge no problem! Please tell me that was a mini bottle of aged whisky and not Diet Coke.
  - petercooper 3y ago
    It was ridiculous. So a bottle of water, say, was something like $7 in the mini bar, and then there was a "$50 restocking fee" on top if you took anything out of the minibar in a certain day. Naturally, all minibar use was immediately banned when I discovered this ;-)
    - floren 3y ago
      Mandalay Bay has a little sign on the minibar indicating that if you even pick something up, you're liable to get charged -- they claim to have weight sensors, presumably so you can't drink a $15 bottle of water, then run down to CVS an hour later and buy a replacement. This might just be bullshitting, but I took great care not to even touch the damn thing... which is exactly what you want on your vacation, a little zone of the room that'll cost you money if you touch it.
      - Nextgrid 3y ago
        They indeed have weight sensors - that’s how the mini fridge detects that something has been taken so it can charge you. The concept isn’t evil in itself, it’s just that the pricing applied to it is predatory. The warning is there for your convenience more than anything else and is often out of an abundance of caution. I’ve seen similar ones where you can pick up and put it back within a certain time and not be charged - I’m pretty sure all these machines have a grace period to avoid spurious charges in case it gets bumped/etc, so it is safe to pick up items and put them back within a reasonable timeframe. In practice feel free to pick up (and even replace items, if it’s literally the same and they won’t be able to tell) and just play dumb and contest the charges at the front desk, they’ll have to waive them if they can’t decisively prove you actually took any items.
SoftTalker 3y ago
The hackers may regret it when Vinny and Tony pay them a visit.
- freeopinion 3y ago
  Vinny and Tony were the hackers.
soared 3y ago
> Customer anecdotes report issues making reservations, using ATM machines, playing certain games and mobile key entry into hotel rooms, but Engadget has not independently confirmed these reports. Will be very curious to see what systems were affected
- andy800 3y ago
  Quite a few systems were likely pulled offline as a preventive measure, though it may be indistinguishable to a customer from a "hack"
  - cardiffspaceman 3y ago
    These responses may have been a goal of the attack.
andy800 3y ago
If MGM refuses to pay up then it must have confidence that they have sufficient backups and can get everything up and running again. I had (still have) serious doubts that they have the expertise and discipline (as well as all the vendor systems it relies on) but I will have to give them credit if true and they can get back to 100% without paying a ransom. At the same time, the source of this article may be completely fabricating all his/her claims, there's obviously no confirmation of any of it at this point.
workfromspace 3y ago
https://archive.ph/Lvu84 https://archive.ph/Lvu84
lfpeb8b45ez 3y ago
Really looking forward to hearing a thirty second clip from this call in a 2028 episode of Darknet Diaries. “THESE are true stories from the dark side of the internet… I’m Jachary Sider.”
- brokenodo 3y ago
  I love seeing your spelling of his name! It took me years to realize that his first name is Jack, not Jackery. It’s Jack Rhysider.

90 points by jimt1234 3y ago

sbate1987 3y ago

[dead]

Humans are always the biggest weakness in any system. I completely believe this, and it's a major reason why I don't keep my linkedin or other social profiles current.

mikece 3y ago

Wouldn't real hackers post evidence and not just claims?

lcnPylGDnU4H9OF 3y ago
If I had made some significant negative impact on a company's operations such that my antics made national news, I would likely choose to avoid providing evidence of my actions.

mannyv 3y ago

Hacker: "Ugh, I just lost my laptop. Can you reset my password?" Helpdesk: "Sure!" Hacker: "Thanks! What mail server should I use again? And what's the VPN IP? I need to RDP to fix some kind of outage." Helpdesk: "[redacted]" Hacker: "Thanks so much! Have a nice day!"

withinboredom 3y ago
I remember reading one of the earlier editions of "Art of Deception" which has lots of these types of examples. Like simply calling up the local county clerk to figure out when the police officer is on vacation for your traffic ticket, then getting a continuance for that day. The police officer doesn't show up, and you get off the hook. So many good stories. RIP.
- ARandomerDude 3y ago
  When I worked for the government, my coworkers and I half joked that if you dressed nicely, wore a lanyard, and carried around a clipboard and a stopwatch, you could probably get into a lot of facilities you didn’t have access to. None of us were brave enough to try it.
  - aftbit 3y ago
    Or a ladder. Nobody stops a pair of people dressed like laborers carrying a ladder.
    - SoftTalker 3y ago
      Or just a high-vis vest, a hardhat, and a toolbox or belt.
      - Freak_NL 3y ago
        Security minded types might still stop you, especially since these are the kind of well-known scenarios that might get used in security training. You want invisible? Be female, 40+, short but otherwise average build, any skin colour but white, black hair, generic cleaning staff outfit, and one of those carts with mops and buckets. Now you're invisible (racist, classist, and misogynistic biases exist, might as well use them). (As a 2m tall person I can't blend in anywhere.)
        withinboredom 3y ago
        Or just be very pregnant while carrying boxes, anybody will open the door for you. Pro-tip: prothesis pregnant belly full of tools.
        rthomas6 3y ago
        If you smoke a few Marlboros in a cleaning staff outfit, get some Walmart shoes, get a $30 phone, and get a mop and bucket, I feel like it might work pretty well.
deleted 3y ago
[deleted]
mannyv 3y ago
Posing as an IT person is the best way. I remember when NationsBank bought Bank of America (yes, it wasn't a merger) a friend bet another friend that he could get BofA root access. He called the branch manager saying he was from NationsBank IT and was going to do a pre-merger inspection. He showed up, asked for the root passwords of the boxes in the branch, logged in, left a MOTD message, then left. Needless to say they beefed up the training on that once the merger closed.

petercooper 3y ago

They should put the MGM Grand's front desk staff in charge.. Their car park machine ate one of my room keys so I popped to the desk on the way to the pool. As I wasn't carrying ID (just my other room key) they gave me a very thorough interrogation of the exact layout of the room, how much my upgrades cost, and other details before they'd issue a second key. Then they flat out refused to put parking charges onto my tab without ID. Yet if I had gone back to the room and merely pulled a single drink out of the minibar, I could have run up a $60 charge no problem!

e40 3y ago
> Yet if I had gone back to the room and merely pulled a single drink out of the minibar, I could have run up a $60 charge no problem! Please tell me that was a mini bottle of aged whisky and not Diet Coke.
- petercooper 3y ago
  It was ridiculous. So a bottle of water, say, was something like $7 in the mini bar, and then there was a "$50 restocking fee" on top if you took anything out of the minibar in a certain day. Naturally, all minibar use was immediately banned when I discovered this ;-)
  - floren 3y ago
    Mandalay Bay has a little sign on the minibar indicating that if you even pick something up, you're liable to get charged -- they claim to have weight sensors, presumably so you can't drink a $15 bottle of water, then run down to CVS an hour later and buy a replacement. This might just be bullshitting, but I took great care not to even touch the damn thing... which is exactly what you want on your vacation, a little zone of the room that'll cost you money if you touch it.
    - Nextgrid 3y ago
      They indeed have weight sensors - that’s how the mini fridge detects that something has been taken so it can charge you. The concept isn’t evil in itself, it’s just that the pricing applied to it is predatory. The warning is there for your convenience more than anything else and is often out of an abundance of caution. I’ve seen similar ones where you can pick up and put it back within a certain time and not be charged - I’m pretty sure all these machines have a grace period to avoid spurious charges in case it gets bumped/etc, so it is safe to pick up items and put them back within a reasonable timeframe. In practice feel free to pick up (and even replace items, if it’s literally the same and they won’t be able to tell) and just play dumb and contest the charges at the front desk, they’ll have to waive them if they can’t decisively prove you actually took any items.

SoftTalker 3y ago

The hackers may regret it when Vinny and Tony pay them a visit.

freeopinion 3y ago
Vinny and Tony were the hackers.

soared 3y ago

> Customer anecdotes report issues making reservations, using ATM machines, playing certain games and mobile key entry into hotel rooms, but Engadget has not independently confirmed these reports. Will be very curious to see what systems were affected

andy800 3y ago
Quite a few systems were likely pulled offline as a preventive measure, though it may be indistinguishable to a customer from a "hack"
- cardiffspaceman 3y ago
  These responses may have been a goal of the attack.

andy800 3y ago

If MGM refuses to pay up then it must have confidence that they have sufficient backups and can get everything up and running again. I had (still have) serious doubts that they have the expertise and discipline (as well as all the vendor systems it relies on) but I will have to give them credit if true and they can get back to 100% without paying a ransom. At the same time, the source of this article may be completely fabricating all his/her claims, there's obviously no confirmation of any of it at this point.

workfromspace 3y ago

https://archive.ph/Lvu84 https://archive.ph/Lvu84

lfpeb8b45ez 3y ago

Really looking forward to hearing a thirty second clip from this call in a 2028 episode of Darknet Diaries. “THESE are true stories from the dark side of the internet… I’m Jachary Sider.”

brokenodo 3y ago
I love seeing your spelling of his name! It took me years to realize that his first name is Jack, not Jackery. It’s Jack Rhysider.