10 ms·

Booking.com hackers increase attacks on customers

150 points by edward 3y ago

OtherShrezzing 3y ago
Seems like a problem booking.com could instantly eliminate by enforcing 2FA for hoteliers.
- tmsbrg 3y ago
  Not really. In the article it says hackers are getting malware onto the hotel's computers using social engineering. That's really hard to counteract. They could steal cookies, or also just control the existing session using the malware. 2fa won't help if you're already logged in and the hacker hacks your computer.
  - mr_mitm 3y ago
    Then why is only booking affected? Surely many of these hotels are also affiliated with hotels.com and similar portals.
    - jacquesm 3y ago
      Every big hospitality broker is under these kinds of attacks. Hotels.com data got exposed en-masse through one of their service providers.
    - smueller1234 3y ago
      Booking is the largest and thus a juicy target for both attackers and articles. Having worked there, I know that competitors had the same problems though.
  - commonenemy 3y ago
    you can always do geo and browser signature checks aginst sessions
    - yourusername 3y ago
      If you have malware on the hotel computers presumably you could make the malware make the request. You can't get too aggressive with your geo/browser checks because there are probably a lot of legitimate logins where the owner is doing some work from home or from a different location.
      - commonenemy 3y ago
        I mean if the malware has total control of the computer, there is nothing you can do. But if it’s just stealing cookies, then there’s already a lot of existing technologies to prevent that.
  - jacquesm 3y ago
    And 'after hours' if you happen to come by the front desk it isn't all that rare to see the computers up and running but unattended because the desk clerk stepped away for a moment.
- deleted 3y ago
  [deleted]
- kotaKat 3y ago
  This begets a new problem. The hotel gets "an" account for Booking. We now need to provide a 2FA credential that essentially needs to be accessed by any hotel front desk/office staff. What methods do we use for "many 2FA, one account"? (And then, how do all those second-factors get secured? Email accounts? Shared phones? Shared token? Shared Authenticator?). It's probably bad enough the password's probably on a post-it under the front desk keyboard, but I don't think the average hotelier is going to be standing up something like Delinea Secret Server. ;)
  - dietrichepp 3y ago
    The ideal solution is that each of the front desk / office staff use their work credentials to access booking.com. One customer accounts, many user accounts. Use OIDC so you’re not entering your work password on booking.com. I know it’s not gonna happen industry-wide. But this is how we do things everywhere I’ve worked for the past many years.
  - isotopp 3y ago
    "We" don't. "We" need to create individual accounts for each eligible staff member and provide each with a 2FA system, for example a Fido key or a TOTP auth app, or an app that uses push notifications and asks for a "yes".
- deleted 3y ago
  [deleted]
AndyMcConachie 3y ago
A Booking.com spokesman said: "While this breach was not on Booking.com, we understand the seriousness for those impacted, which is why our teams work diligently to support our partners in securing their systems as quickly as possible and helping any potentially impacted customers accordingly, including with recovering any lost funds." I call BS. It's Booking.com's responsibility to ensure that the people logging into their portal are the actual hoteliers. Time to mandate 2FA.
- brookst 3y ago
  What would 2FA do to stop malware installed on hoteliers' computers?
  - r00fus 3y ago
    Nothing. However 2FA could prevent those hackers from being able to login to booking.com using stolen credentials and perpetrating this scam.
- ponector 3y ago
  Booking responsible only for payments. They will do nothing except of refund if you are scammed by hotel with false advertising.
deanc 3y ago
Did you know that booking.com stores your credit card information and sends it, in plain text to the hotels - allowing them to charge you? [1] [1] https://partner.booking.com/en-us/help/policies-payments/guest-payments/accessing-guests%E2%80%99-credit-card-details https://partner.booking.com/en-us/help/policies-payments/gue...
- czbond 3y ago
  The Phuck - who is that allowed?!!! <after review> Ah - there are some quirks allowed by PCI from device to device (E2E) with TLS.
- jacquesm 3y ago
  That's not Booking.com's fault though. Many hotels are hopelessly behind the times and they don't have the capability to process the charges any other way and so there is quite a bit of pressure on booking.com to keep this functionality alive. This is a problem all over the hospitality industry. At least PCI/DSS compliance ensures that there is some minimum level of security involved and ultimately the merchant that is the recipient of that information is on the hook for all of the charges they make if you should dispute them. Credit cards have more consumer protection built in than most other forms of payment. If they wouldn't send the card information 'in plain text' it would be useless to the hotel. And every time you visit a hotel and hand them your card they tend to make an imprint of the card, the only thing the hotel doesn't have is the CVC and in the normal flow this isn't exposed, only when you escalate to some level of exception (and I'm not sure what the criteria are for that).
  - jabroni_salad 3y ago
    Kinda is their fault... the recipient might be the dictator but the sender can choose not to play or can display a checkbox to consumers authorizing an unsafe transmission so they can make an informed decision. Instead they just do it and you assume the store is secure because isn't store security mostly a solved problem at this point? Those of us who transact directly with the hotel instead of booking agents stay winning I guess.
kubectl_h 3y ago
Within the last few days I booked a hotel on Booking.com and then got a call the next day from the hotel saying they actually don't use the Booking.com anymore (and that their account is inactive so they can't log in) and that I needed to cancel the stay through booking.com (the booking was pay on arrival but I still entered a CC). I re-booked with the hotel directly through their site (small independently owned hotel in a ski town). The whole process felt _shady_ but also it seems like the owner couldn't find a way to get their Booking.com listing removed. I am regretting not using a virtual card number for the initial booking through Booking.com.
- seabass-labrax 3y ago
  Is this 'virtual card number' something that Booking.com provides as an option to you, or do you have a third-party service for this?
  - ben_w 3y ago
    I don't know what kubectl_h does, but I have a virtual card from Revolut
  - lakpan 3y ago
    A lot of banks offer those nowadays. Wise has virtual cards and Revolut even has single-use cards, just to mention the most popular ones.
  - swozey 3y ago
    Privacy.com has a 1password integration so I have it create cards instead of filling in my real card https://blog.1password.com/privacy-virtual-cards/ https://blog.1password.com/privacy-virtual-cards/
    - flutas 3y ago
      Just an FYI, Privacy won't help you out if something gets charged fraudulently to a card. Had a place triple charge me, place ignored all CS attempts from me. Privacy refused to help basically saying all three must have been valid and "they have policies with banks" that meant they "couldn't chargeback".
ISL 3y ago
In my industry, we are seeing skillful phishing attempts compromising experienced and well-connected businesses. Those connections are immediately leveraged to strike again. The MO is the same as described in the article -- a well-crafted email with a link to a file in a respected cloud host. Is there a centralized place (FBI ?) to report these attacks? The bad actors will be obvious in aggregate.
gumballindie 3y ago
[flagged]
kyleblarson 3y ago
I work in this industry and the rate of fraud from bcom bookings is massively higher than other channels.
jwally 3y ago
>Criminals then send a Google Drive link to the staff saying that it contains an image of the passport. Instead the link downloads malware on to staff computers and automatically searches the hotel computers for Booking.com access. How does clicking a link install and run an executable?
- skinner927 3y ago
  PDF exploit
onetokeoverthe 3y ago
[dead]
justin808 3y ago
There are many scams in vacation rentals, of which Booking has many. However, there are fewer scams when booking via the big sites, Airbnb, Vrbo, and Booking. https://HiChee.com https://HiChee.com lets hosts "verify" their listings to offer book direct pricing. Plus, guests can pick which platform has the lowest price for a chosen rental.
tomhoward 3y ago
I fell for this, though I realised it was a scam in time and locked my card quickly enough that I didn't lose any money. I'm pretty sure it's the first time, in over 20 years of using the internet, that I've fallen for a phishing scam. It completely gets through your defences because the message is sent via the Booking.com app and is about a legit hotel booking you've made. Very nasty. But very poor of Booking.com to not be better at detecting these messages. The first consumer reports I can find about this scam go back to January [1], and it shouldn't need very sophisticated text classification to recognise and block them. More details about the scam here [2]. [1] https://insideflyer.co.uk/2023/01/beware-of-this-booking-com-phishing-scam/ https://insideflyer.co.uk/2023/01/beware-of-this-booking-com... [2] https://perception-point.io/blog/booking-com-customers-hit-by-phishing-campaign-delivered-via-compromised-hotels-accounts/ https://perception-point.io/blog/booking-com-customers-hit-b...
- spike021 3y ago
  I got one like the second link you posted a few months ago. Had a trip booked to Japan, multiple hotels reserved with booking and Agoda. At some point I received one of those messages, which arrived directly through Booking's system. As mentioned in the article it's not even though SMS -- technically it did come to my email but just as an email copy of the message from their system. The oddest thing was that a couple days later I got a follow-up message with a profile icon matching the hotel, but a message written as if from a customer, and they said something about trying the spam link, putting their CC info in, and nothing happening. I wasn't sure if that was the scammer trying to impersonate a customer or if somehow another customer was attached to my message thread. If the latter, I'd surmise that Booking's message underlying system is email and somehow when the scam was sent out, it was done with cc or bcc to a set of customers rather than only me. If the former, it doesn't really make sense to act like it didn't work otherwise the targeted customer is less likely to try it. So odd.
- dakial1 3y ago
  Well if it is through Booking.com message system it’s their problem not yours. The card would promptly get you a chargeback if they charged you
MichaelPayne 3y ago
[flagged]

150 points by edward 3y ago

OtherShrezzing 3y ago

Seems like a problem booking.com could instantly eliminate by enforcing 2FA for hoteliers.

tmsbrg 3y ago
Not really. In the article it says hackers are getting malware onto the hotel's computers using social engineering. That's really hard to counteract. They could steal cookies, or also just control the existing session using the malware. 2fa won't help if you're already logged in and the hacker hacks your computer.
- mr_mitm 3y ago
  Then why is only booking affected? Surely many of these hotels are also affiliated with hotels.com and similar portals.
  - jacquesm 3y ago
    Every big hospitality broker is under these kinds of attacks. Hotels.com data got exposed en-masse through one of their service providers.
  - smueller1234 3y ago
    Booking is the largest and thus a juicy target for both attackers and articles. Having worked there, I know that competitors had the same problems though.
- commonenemy 3y ago
  you can always do geo and browser signature checks aginst sessions
  - yourusername 3y ago
    If you have malware on the hotel computers presumably you could make the malware make the request. You can't get too aggressive with your geo/browser checks because there are probably a lot of legitimate logins where the owner is doing some work from home or from a different location.
    - commonenemy 3y ago
      I mean if the malware has total control of the computer, there is nothing you can do. But if it’s just stealing cookies, then there’s already a lot of existing technologies to prevent that.
- jacquesm 3y ago
  And 'after hours' if you happen to come by the front desk it isn't all that rare to see the computers up and running but unattended because the desk clerk stepped away for a moment.
deleted 3y ago
[deleted]
kotaKat 3y ago
This begets a new problem. The hotel gets "an" account for Booking. We now need to provide a 2FA credential that essentially needs to be accessed by any hotel front desk/office staff. What methods do we use for "many 2FA, one account"? (And then, how do all those second-factors get secured? Email accounts? Shared phones? Shared token? Shared Authenticator?). It's probably bad enough the password's probably on a post-it under the front desk keyboard, but I don't think the average hotelier is going to be standing up something like Delinea Secret Server. ;)
- dietrichepp 3y ago
  The ideal solution is that each of the front desk / office staff use their work credentials to access booking.com. One customer accounts, many user accounts. Use OIDC so you’re not entering your work password on booking.com. I know it’s not gonna happen industry-wide. But this is how we do things everywhere I’ve worked for the past many years.
- isotopp 3y ago
  "We" don't. "We" need to create individual accounts for each eligible staff member and provide each with a 2FA system, for example a Fido key or a TOTP auth app, or an app that uses push notifications and asks for a "yes".
deleted 3y ago
[deleted]

AndyMcConachie 3y ago

A Booking.com spokesman said: "While this breach was not on Booking.com, we understand the seriousness for those impacted, which is why our teams work diligently to support our partners in securing their systems as quickly as possible and helping any potentially impacted customers accordingly, including with recovering any lost funds." I call BS. It's Booking.com's responsibility to ensure that the people logging into their portal are the actual hoteliers. Time to mandate 2FA.

brookst 3y ago
What would 2FA do to stop malware installed on hoteliers' computers?
- r00fus 3y ago
  Nothing. However 2FA could prevent those hackers from being able to login to booking.com using stolen credentials and perpetrating this scam.
ponector 3y ago
Booking responsible only for payments. They will do nothing except of refund if you are scammed by hotel with false advertising.

deanc 3y ago

Did you know that booking.com stores your credit card information and sends it, in plain text to the hotels - allowing them to charge you? [1] [1] https://partner.booking.com/en-us/help/policies-payments/guest-payments/accessing-guests%E2%80%99-credit-card-details https://partner.booking.com/en-us/help/policies-payments/gue...

czbond 3y ago
The Phuck - who is that allowed?!!! <after review> Ah - there are some quirks allowed by PCI from device to device (E2E) with TLS.
jacquesm 3y ago
That's not Booking.com's fault though. Many hotels are hopelessly behind the times and they don't have the capability to process the charges any other way and so there is quite a bit of pressure on booking.com to keep this functionality alive. This is a problem all over the hospitality industry. At least PCI/DSS compliance ensures that there is some minimum level of security involved and ultimately the merchant that is the recipient of that information is on the hook for all of the charges they make if you should dispute them. Credit cards have more consumer protection built in than most other forms of payment. If they wouldn't send the card information 'in plain text' it would be useless to the hotel. And every time you visit a hotel and hand them your card they tend to make an imprint of the card, the only thing the hotel doesn't have is the CVC and in the normal flow this isn't exposed, only when you escalate to some level of exception (and I'm not sure what the criteria are for that).
- jabroni_salad 3y ago
  Kinda is their fault... the recipient might be the dictator but the sender can choose not to play or can display a checkbox to consumers authorizing an unsafe transmission so they can make an informed decision. Instead they just do it and you assume the store is secure because isn't store security mostly a solved problem at this point? Those of us who transact directly with the hotel instead of booking agents stay winning I guess.

kubectl_h 3y ago

Within the last few days I booked a hotel on Booking.com and then got a call the next day from the hotel saying they actually don't use the Booking.com anymore (and that their account is inactive so they can't log in) and that I needed to cancel the stay through booking.com (the booking was pay on arrival but I still entered a CC). I re-booked with the hotel directly through their site (small independently owned hotel in a ski town). The whole process felt _shady_ but also it seems like the owner couldn't find a way to get their Booking.com listing removed. I am regretting not using a virtual card number for the initial booking through Booking.com.

seabass-labrax 3y ago
Is this 'virtual card number' something that Booking.com provides as an option to you, or do you have a third-party service for this?
- ben_w 3y ago
  I don't know what kubectl_h does, but I have a virtual card from Revolut
- lakpan 3y ago
  A lot of banks offer those nowadays. Wise has virtual cards and Revolut even has single-use cards, just to mention the most popular ones.
- swozey 3y ago
  Privacy.com has a 1password integration so I have it create cards instead of filling in my real card https://blog.1password.com/privacy-virtual-cards/ https://blog.1password.com/privacy-virtual-cards/
  - flutas 3y ago
    Just an FYI, Privacy won't help you out if something gets charged fraudulently to a card. Had a place triple charge me, place ignored all CS attempts from me. Privacy refused to help basically saying all three must have been valid and "they have policies with banks" that meant they "couldn't chargeback".

ISL 3y ago

In my industry, we are seeing skillful phishing attempts compromising experienced and well-connected businesses. Those connections are immediately leveraged to strike again. The MO is the same as described in the article -- a well-crafted email with a link to a file in a respected cloud host. Is there a centralized place (FBI ?) to report these attacks? The bad actors will be obvious in aggregate.

gumballindie 3y ago

[flagged]

kyleblarson 3y ago

I work in this industry and the rate of fraud from bcom bookings is massively higher than other channels.

jwally 3y ago

>Criminals then send a Google Drive link to the staff saying that it contains an image of the passport. Instead the link downloads malware on to staff computers and automatically searches the hotel computers for Booking.com access. How does clicking a link install and run an executable?

skinner927 3y ago
PDF exploit

onetokeoverthe 3y ago

[dead]

justin808 3y ago

There are many scams in vacation rentals, of which Booking has many. However, there are fewer scams when booking via the big sites, Airbnb, Vrbo, and Booking. https://HiChee.com https://HiChee.com lets hosts "verify" their listings to offer book direct pricing. Plus, guests can pick which platform has the lowest price for a chosen rental.

tomhoward 3y ago

I fell for this, though I realised it was a scam in time and locked my card quickly enough that I didn't lose any money. I'm pretty sure it's the first time, in over 20 years of using the internet, that I've fallen for a phishing scam. It completely gets through your defences because the message is sent via the Booking.com app and is about a legit hotel booking you've made. Very nasty. But very poor of Booking.com to not be better at detecting these messages. The first consumer reports I can find about this scam go back to January [1], and it shouldn't need very sophisticated text classification to recognise and block them. More details about the scam here [2]. [1] https://insideflyer.co.uk/2023/01/beware-of-this-booking-com-phishing-scam/ https://insideflyer.co.uk/2023/01/beware-of-this-booking-com... [2] https://perception-point.io/blog/booking-com-customers-hit-by-phishing-campaign-delivered-via-compromised-hotels-accounts/ https://perception-point.io/blog/booking-com-customers-hit-b...

spike021 3y ago
I got one like the second link you posted a few months ago. Had a trip booked to Japan, multiple hotels reserved with booking and Agoda. At some point I received one of those messages, which arrived directly through Booking's system. As mentioned in the article it's not even though SMS -- technically it did come to my email but just as an email copy of the message from their system. The oddest thing was that a couple days later I got a follow-up message with a profile icon matching the hotel, but a message written as if from a customer, and they said something about trying the spam link, putting their CC info in, and nothing happening. I wasn't sure if that was the scammer trying to impersonate a customer or if somehow another customer was attached to my message thread. If the latter, I'd surmise that Booking's message underlying system is email and somehow when the scam was sent out, it was done with cc or bcc to a set of customers rather than only me. If the former, it doesn't really make sense to act like it didn't work otherwise the targeted customer is less likely to try it. So odd.
dakial1 3y ago
Well if it is through Booking.com message system it’s their problem not yours. The card would promptly get you a chargeback if they charged you

MichaelPayne 3y ago

[flagged]