You can check out any time you want, and so can card-data stealing criminals. (credit: Novotel Century Hong Kong Hotel)
Hotel chains focus on hospitality, but their security practices have made them entirely too hospitable a target for data theft. Hotels have been brutalized over the past year by a wave of point-of-sale system breaches that have exposed hundreds of thousands of guests’ credit card accounts. And those attacks, as a recent episode described by Panda Security’s Luis Corrons demonstrates, have become increasingly targeted—in some cases using “spear-phishing” e-mails and malware crafted specifically for the target to gain access to hotels’ networks.
In one incident that was uncovered recently, the target “was a small luxury hotel chain,” Corrons told Ars. “We discovered the attack, and it was really customized for the specific hotel. This was 100 percent tailored to the specific target.”
The attackers used a Word document from the hotel itself—one frequently used by the hotel to allow customers to authorize credit card charges in advance of a stay. The document was actually enclosed as part of a self-extracting file, which also installed two other files on the target machine—one of them an installer for backdoor malware named “adobeUpd.dll” to disguise it and the other a Windows .cmd batch script that both opens the Word document and launches the backdoor.