4 ms·

Seems like a problem booking.com could instantly eliminate by enforcing 2FA for hoteliers.

tmsbrg 3y ago
Not really. In the article it says hackers are getting malware onto the hotel's computers using social engineering. That's really hard to counteract. They could steal cookies, or also just control the existing session using the malware. 2fa won't help if you're already logged in and the hacker hacks your computer.
- mr_mitm 3y ago
  Then why is only booking affected? Surely many of these hotels are also affiliated with hotels.com and similar portals.
  - jacquesm 3y ago
    Every big hospitality broker is under these kinds of attacks. Hotels.com data got exposed en-masse through one of their service providers.
  - smueller1234 3y ago
    Booking is the largest and thus a juicy target for both attackers and articles. Having worked there, I know that competitors had the same problems though.
- commonenemy 3y ago
  you can always do geo and browser signature checks aginst sessions
  - yourusername 3y ago
    If you have malware on the hotel computers presumably you could make the malware make the request. You can't get too aggressive with your geo/browser checks because there are probably a lot of legitimate logins where the owner is doing some work from home or from a different location.
    - commonenemy 3y ago
      I mean if the malware has total control of the computer, there is nothing you can do. But if it’s just stealing cookies, then there’s already a lot of existing technologies to prevent that.
- jacquesm 3y ago
  And 'after hours' if you happen to come by the front desk it isn't all that rare to see the computers up and running but unattended because the desk clerk stepped away for a moment.
deleted 3y ago
[deleted]
kotaKat 3y ago
This begets a new problem. The hotel gets "an" account for Booking. We now need to provide a 2FA credential that essentially needs to be accessed by any hotel front desk/office staff. What methods do we use for "many 2FA, one account"? (And then, how do all those second-factors get secured? Email accounts? Shared phones? Shared token? Shared Authenticator?). It's probably bad enough the password's probably on a post-it under the front desk keyboard, but I don't think the average hotelier is going to be standing up something like Delinea Secret Server. ;)
- dietrichepp 3y ago
  The ideal solution is that each of the front desk / office staff use their work credentials to access booking.com. One customer accounts, many user accounts. Use OIDC so you’re not entering your work password on booking.com. I know it’s not gonna happen industry-wide. But this is how we do things everywhere I’ve worked for the past many years.
- isotopp 3y ago
  "We" don't. "We" need to create individual accounts for each eligible staff member and provide each with a 2FA system, for example a Fido key or a TOTP auth app, or an app that uses push notifications and asks for a "yes".
deleted 3y ago
[deleted]

Not really. In the article it says hackers are getting malware onto the hotel's computers using social engineering. That's really hard to counteract. They could steal cookies, or also just control the existing session using the malware. 2fa won't help if you're already logged in and the hacker hacks your computer.

mr_mitm 3y ago
Then why is only booking affected? Surely many of these hotels are also affiliated with hotels.com and similar portals.
- jacquesm 3y ago
  Every big hospitality broker is under these kinds of attacks. Hotels.com data got exposed en-masse through one of their service providers.
- smueller1234 3y ago
  Booking is the largest and thus a juicy target for both attackers and articles. Having worked there, I know that competitors had the same problems though.
commonenemy 3y ago
you can always do geo and browser signature checks aginst sessions
- yourusername 3y ago
  If you have malware on the hotel computers presumably you could make the malware make the request. You can't get too aggressive with your geo/browser checks because there are probably a lot of legitimate logins where the owner is doing some work from home or from a different location.
  - commonenemy 3y ago
    I mean if the malware has total control of the computer, there is nothing you can do. But if it’s just stealing cookies, then there’s already a lot of existing technologies to prevent that.
jacquesm 3y ago
And 'after hours' if you happen to come by the front desk it isn't all that rare to see the computers up and running but unattended because the desk clerk stepped away for a moment.

deleted 3y ago

[deleted]

kotaKat 3y ago

This begets a new problem. The hotel gets "an" account for Booking. We now need to provide a 2FA credential that essentially needs to be accessed by any hotel front desk/office staff. What methods do we use for "many 2FA, one account"? (And then, how do all those second-factors get secured? Email accounts? Shared phones? Shared token? Shared Authenticator?). It's probably bad enough the password's probably on a post-it under the front desk keyboard, but I don't think the average hotelier is going to be standing up something like Delinea Secret Server. ;)

dietrichepp 3y ago
The ideal solution is that each of the front desk / office staff use their work credentials to access booking.com. One customer accounts, many user accounts. Use OIDC so you’re not entering your work password on booking.com. I know it’s not gonna happen industry-wide. But this is how we do things everywhere I’ve worked for the past many years.
isotopp 3y ago
"We" don't. "We" need to create individual accounts for each eligible staff member and provide each with a 2FA system, for example a Fido key or a TOTP auth app, or an app that uses push notifications and asks for a "yes".

deleted 3y ago

[deleted]