ACA: Help Yourself Hotels

[samh004]

Seen on ACA tonight, an undercover investigation on 3 hotels in Brisbane (Novotel, Sebel Suites and Holiday Inn), where the producer of the segment asked for a spare room key card and only had to provide a surname to get it.

They also walked into a room being cleaned, asked if they could stay until the cleaners were finished and weren't asked to prove it was their room.

Highlighted quite a few security issues.

Anyone else see it? Has me a little worried for my upcoming stay in Sydney!

 

[BlueAU]

Interesting Story.

I have asked for a room key before as I did lose it in Melb, they just asked surname and room number and gave me a new one as well..... :shock: Never thought of it until now Sam!

 

[harvyk]

It's a well known security loophole... Look like your meant to be there and you'll rarely be challanged. (Sometimes called the orange safety vest loophole, when was the last time you questioned a workman wearing an orange safety vest on what they where doing, and if they where authorised to be there).

It's how the chaser managed to get away with so many stunts so easily...

 

[Flashback]

Otherwise known as social engineering ...

 

[odysseus]

It was a bit iffy to me though.

If someone had a targeted objective of getting into someone's room who they already knew, it may be possible. But it's unlikely they would just get into a random room so readily.

In all the cases shown, the producer already knew the required details if being asked, so there was no problem. But where the front desk asked the surname, how would the average burglar know what to answer? And then if you didn't know your surname when prompted that would get security on to you straightaway.

Then there's stiil the matter of getting through the lift, and up to the room. Even assuming random shadowing to get through security, and being lucky enought to find a room with housekeeping, for all you know that room is unoccupied which housekeeping will then alert security about why you want to hang around in an unoccupied room. Or it may not have anything of interest. And it's a one trick effort as housekeeping will then recognise you if you were to try to do the same in another room.

There's a lot of other things to it, but I don't see it as showing any big security issue. All hotels recommend you use safety deposit for valuables and you shouldn't expect rooms to be bank vault like security and indefensible. Equally though, it's not as though someone can come off the street and just rifle through every room looking for valuables either (which was the likely impression given by that bastion of investigative journalism).

 

[Dave Noble]

Some hotels are better for security than others

For some I have stayed in can pretty much just ask for a replacement key and anyone could get one

Finding out the surname of someone checking in is pretty trivial thing to do

Some hotels are good for security ; some I have stay in ( such as IC Dallas ) will always ask for ID from the person asking for a replacement key ( not just name ) ; I recently stayed at the IC Singapore ; one day came back from teaching and they were servicing my room so I walked straight in ; the person servicing came and asked me for the key and then went and verified that the key was that for the room

These are pretty decent in security , but there are a lot of hotels that are lacking

Having watched the item it does show to me a lack of security procedures

Dave

 

[drewbles]

MGM Grand in Vegas is good. I left my room key in my room the other day, went to reception and they required photo ID for replacement key. I'm not sure what they'd do if you don't have a wallet with ID, I'm guessing they'd escort you up to the room for you to get your ID (as has happened at previous hotels I've stayed at).

Most are pretty good though. I still make sure I lock up my valuables in the in-room safe where possible, and take whatever valuables I can with me.

 

[Mal]

Can't remember which hotel it was (but it was within the last 12 months - I obviously have both a poor memory, and also have been to too many hotels), I left my key in the room and requested a new one... was asked for ID.

This sort of issue has been ongoing for a long time, and really isn't nothing new. It's quite easy to do - assuming you look the part, and know the required details.

Note that usually the production of a replacement key invalidates the old key - so your room key won't work.

Then of course you really shouldn't have valuables left around a hotel room (and a laptop charger is obviously valuable :evil: ), and also use the key chain or inside door lock when you are in your room.

So really, someone accessing your room shouldn't be able to do too much (except plant some bugs, or hidden cameras or steal a laptop charger :evil: or take a few clothes or something that they could quite easily do by getting access other ways to the room - like corrupting staff)

 

[harvyk]

Otherwise known as social engineering ...

Yeap, and sadly just about anyone is susceptible to a well thought out and well executed social engineering attack, especially if they are targeted specifically.

It would be easy to find out someone's name and room number. Listen in to conversations is one method. That said, they would

A. Need to be targeting you

and

B. Know that hotel staff isn't going to recognise you or the person trying to gain access.

The other problem is that if you were going to try this trick you'd need to cover your face from security camera's. Unfortunately if you rocked up to the front desk with a balaclava on - which would be a sure fire way of no security seeing your face, chances are they are not going to just give you a room key.

 

[samh004]

Then there's stiil the matter of getting through the lift, and up to the room. Even assuming random shadowing to get through security, and being lucky enought to find a room with housekeeping, for all you know that room is unoccupied which housekeeping will then alert security about why you want to hang around in an unoccupied room. Or it may not have anything of interest. And it's a one trick effort as housekeeping will then recognise you if you were to try to do the same in another room.

They covered getting up the lift in the segment. Granted, they admitted she was staying there, though I assume she tried to keep a low profile at least so no one would recognise her when the time came? Anyway, in 2 of the hotels she got in the lift and another guest or a helpful member of staff pushed the button for her in the lift (they made that point clear... for fingerprints?) and in the third hotel they were asked to show their room key.

The other problem is that if you were going to try this trick you'd need to cover your face from security camera's. Unfortunately if you rocked up to the front desk with a balaclava on - which would be a sure fire way of no security seeing your face, chances are they are not going to just give you a room key.[/FONT]

So what you're saying is, it might work at a ski resort

 

[Flashback]

They covered getting up the lift in the segment. Granted, they admitted she was staying there, though I assume she tried to keep a low profile at least so no one would recognise her when the time came? Anyway, in 2 of the hotels she got in the lift and another guest or a helpful member of staff pushed the button for her in the lift (they made that point clear... for fingerprints?) and in the third hotel they were asked to show their room key.



So what you're saying is, it might work at a ski resort

Note fingerprints are very unlikely to be lifted from this. When my house was broken into, items such as door handles etc. were discounted straight away because of the high volume of prints that would be on them.

 

[samh004]

Note fingerprints are very unlikely to be lifted from this. When my house was broken into, items such as door handles etc. were discounted straight away because of the high volume of prints that would be on them.

Good point. I just wondered what was so significant about someone else pushing the button for them.

 

[Flashback]

Good point. I just wondered what was so significant about someone else pushing the button for them.

Sensationalist journalism

 

[serfty]

Good point. I just wondered what was so significant about someone else pushing the button for them.

You don't have a key - but the other guest / staff does.

Many hotels require you to insert your key for validation before being able to select a floor.

So in this case "pushing the button for them" means much more than that.

 

[harvyk]

Good point. I just wondered what was so significant about someone else pushing the button for them.

In a lift which requires keys to move, oftan they only need to have one key inserted into the lift before buttons are pressed. By asking someone else to press the button, chances are they would just use their room key without thinking...

 

[Dave Noble]

By asking someone else to press the button, chances are they would just use their room key without thinking...

Not me; I always tell people ( unless I know who they are ) that they need to use their own card and won't do it for them

Some hotels are v good and the key only works for the floor staying on and public floors which reduces the risk

One other way of bypassing can be to go to any floor and then take the staircase; often the staircase is a security hole

Dave

 

[dajop]

At the end of the day there are millions of ways of being scammed/ cheated/ robbed etc.

Don't know if anyone's seen a show called the Real Hustle (BBC), but saw on it cable the other night as I was flicking channels. Two guys turned up at hotel too early to check in, so stored their luggage at the hotel through the concierge. One being a very large suitcase with a third person packed in the suitcase .... so when the luggage was placed into secure storage, you can guess what happened whilst the others distracted the concierge. THen it was oh silly me we've turned up at the wrong hotel, so need our bags back..... Apparently this scam is also being done on buses in Scandanavia with luggage in the passenger compartment of the bus.

Sure these things can happen, but how often do they happen and how can we protect against it? Leaving valuables unprotected in hotel room, is akin to putting valuables in your checked luggage. You might get away with it but you may not.

 

[dajop]

Some hotels are v good and the key only works for the floor staying on and public floors which reduces the risk

Best example of this was a hotel (can't remember where), where you just put your card over a sensor (like on the more advanced metros such as LON, HKG, SIN etc) and it automatically registered your floor and on came the light for that floor. No need to press any buttons at all. Quite impressive.

 

[odysseus]

They covered getting up the lift in the segment. Granted, they admitted she was staying there, though I assume she tried to keep a low profile at least so no one would recognise her when the time came? Anyway, in 2 of the hotels she got in the lift and another guest or a helpful member of staff pushed the button for her in the lift (they made that point clear... for fingerprints?) and in the third hotel they were asked to show their room key.

Right, but again that's not reliable for just a random passer by which was the implication. As said before, if someone's being targeted, then they could put the effort into making it work. But for a random situation, there may not be anyone around the lift at the same time (and loitering is not a good look to stay undetected), or the person already in there may not help out (being a woman may have helped in this case, as my experience is it's very rare for someone to offer to press a floor button). Or you may even be in a hotel where lift access is floor restricted; there would have to be a lot of coincidences for a random passerby to be successful.

 

[markis10]

Timely article given Mals missing laptop charger, may be over the top journalism but the key to your hotel is not all that is seems, I have had someone try to enter my room late at night after being checked in, to my room! Every since I use the chain, and anything valuable goes into the safe or with me when I leave.