3 ms·

These media reports are REALLY misleading, and I would be fuming if I worked at Booking.com at how much damage these media reports have done to the brand. > Th

by lol768 3y ago

These media reports are REALLY misleading, and I would be fuming if I worked at Booking.com at how much damage these media reports have done to the brand. > The company, which is one of the biggest hotel and holiday websites in the world, has not itself been hacked. > > Instead, criminals have tricked their way into the administration portals of individual hotels that use the service. > > This enables them to send messages and fool customers into paying them instead of the hotel. Previous headlines from the BBC have been even worse: - Booking.com users angry at firm's response to hacks - Booking.com hackers increase attacks on customers How is this not libel? Genuinely: What do people here think that are Booking.com supposed to be doing about this? Any sophisticated phishing group aren't going to be making rookie errors like hotlinking images when they set-up a phishing siter impersonating Booking.com. They're already doing DKIM signing, DMARC and SPF. It's unclear to me if the phishing groups are sending emails out directly using the stolen personal details, or using some sort of in-app messaging functionality. If it's the latter I don't think booking.com even supports linking URLs in messages sent out via this mechanism.

daveoc64 3y ago
As others have said, requiring two-factor authentication would go a long way to stopping this. Nothing in the report or what you have quoted is misleading.
- jesseendahl 3y ago
  Most popular forms of two-factor are still phishable. WebAuthn/passkeys are a better solution.
  - daveoc64 3y ago
    It's better than nothing!
- lol768 3y ago
  > Booking.com hackers increase attacks on customers Any reasonable person would read this headline and assume Booking.com's platform had been hacked. > Criminals then send a Google Drive link to the staff saying that it contains an image of the passport. Instead the link downloads malware on to staff computers and automatically searches the hotel computers for Booking.com access. How would 2FA stop this?
- bsdz 3y ago
  Apparently, from a related article, the hotels do have 2FA. https://www.theguardian.com/money/2023/oct/23/bookingcom-customers-targeted-by-scam-confirmation-emails https://www.theguardian.com/money/2023/oct/23/bookingcom-cus...
dragonwriter 3y ago
> Genuinely: What do people here think that are Booking.com supposed to be doing about this? Not having a messaging system that lends authority to messages if they aren't able to secure it (including assuring that partners with access secure their ends) adequately for the appearance of authority that is created.
- lol768 3y ago
  The messaging system is full of disclaimers ("The content of the message from Malmaison was not generated by Booking.com") and, looking at a message I've received, it doesn't even support links. Anyone getting phished would have to manually type in a URL in their address bar if this was the vector used.
  - daveoc64 3y ago
    I don't think the scams use links. They post bank account details for the customer to send a payment to. Manually typing a link may not seem suspicious to many customers anyway. Edit: Looks like the scam may involve credit/debit cards and links. The messages may be sent to customers via email, and the links are clickable that way. Not sure if that's an email client thing or if Booking.com makes them clickable in HTML.
    - lol768 3y ago
      > They post bank account details for the customer to send a payment to. This is even less credible to me than a phishing site set-up to take card details. As soon as you try to make a payment to a scammer's bank account, confirmation of payee will fail because the bank details won't match the hotel's. It should also raise alarm bells because it's a completely out-of-character thing to be asked to do prior to a stay with a hotel.
      - insomniacity 3y ago
        Does Confirmation of Payee even exist outside the UK? Even if it did exist within other countries, I highly doubt there is international integration.
raverbashing 3y ago
> What do people here think that are Booking.com supposed to be doing about this? Not pretending it's not their problem, as a start Because it absolutely is Then, work with hotels so that communications from them are authenticated in some way
I_Am_Nous 3y ago
>After exchanging messages with who she thought was the hotel in Cairo via the Booking.com app, she was sent a payment request. It had in fact come from scammers. "I clicked on it not suspecting it was a scam, given it was in the same ongoing chat in the app," she told the BBC. Are you sure? This makes it sound like whatever account hackers gained control of was able to send messages directly to the app. If they log into a booking.com portal to do that, and booking.com hasn't set up multifactor authentication, they aren't blameless.

by lol768 3y ago

daveoc64 3y ago

As others have said, requiring two-factor authentication would go a long way to stopping this. Nothing in the report or what you have quoted is misleading.

jesseendahl 3y ago
Most popular forms of two-factor are still phishable. WebAuthn/passkeys are a better solution.
- daveoc64 3y ago
  It's better than nothing!
lol768 3y ago
> Booking.com hackers increase attacks on customers Any reasonable person would read this headline and assume Booking.com's platform had been hacked. > Criminals then send a Google Drive link to the staff saying that it contains an image of the passport. Instead the link downloads malware on to staff computers and automatically searches the hotel computers for Booking.com access. How would 2FA stop this?
bsdz 3y ago
Apparently, from a related article, the hotels do have 2FA. https://www.theguardian.com/money/2023/oct/23/bookingcom-customers-targeted-by-scam-confirmation-emails https://www.theguardian.com/money/2023/oct/23/bookingcom-cus...

dragonwriter 3y ago

> Genuinely: What do people here think that are Booking.com supposed to be doing about this? Not having a messaging system that lends authority to messages if they aren't able to secure it (including assuring that partners with access secure their ends) adequately for the appearance of authority that is created.

lol768 3y ago
The messaging system is full of disclaimers ("The content of the message from Malmaison was not generated by Booking.com") and, looking at a message I've received, it doesn't even support links. Anyone getting phished would have to manually type in a URL in their address bar if this was the vector used.
- daveoc64 3y ago
  I don't think the scams use links. They post bank account details for the customer to send a payment to. Manually typing a link may not seem suspicious to many customers anyway. Edit: Looks like the scam may involve credit/debit cards and links. The messages may be sent to customers via email, and the links are clickable that way. Not sure if that's an email client thing or if Booking.com makes them clickable in HTML.
  - lol768 3y ago
    > They post bank account details for the customer to send a payment to. This is even less credible to me than a phishing site set-up to take card details. As soon as you try to make a payment to a scammer's bank account, confirmation of payee will fail because the bank details won't match the hotel's. It should also raise alarm bells because it's a completely out-of-character thing to be asked to do prior to a stay with a hotel.
    - insomniacity 3y ago
      Does Confirmation of Payee even exist outside the UK? Even if it did exist within other countries, I highly doubt there is international integration.

raverbashing 3y ago

> What do people here think that are Booking.com supposed to be doing about this? Not pretending it's not their problem, as a start Because it absolutely is Then, work with hotels so that communications from them are authenticated in some way

I_Am_Nous 3y ago

>After exchanging messages with who she thought was the hotel in Cairo via the Booking.com app, she was sent a payment request. It had in fact come from scammers. "I clicked on it not suspecting it was a scam, given it was in the same ongoing chat in the app," she told the BBC. Are you sure? This makes it sound like whatever account hackers gained control of was able to send messages directly to the app. If they log into a booking.com portal to do that, and booking.com hasn't set up multifactor authentication, they aren't blameless.