Unlike the inner network of companies, hotels have no way to make a credible assessment of the fine size of each access device and rely on certification systems and cyber security strategies to mitigate risk. This article summarizes the main strike vectors facing the WiFi certification system in the hotel from the point of view of safety risk identification, as well as physical protection features.
Risk of security gaps in the certification system itself
The authentication system is a target of attack as an intermediate between the host and the network. Commonly used attacks against the certification system include violent deciphering of the code by way of an enumerate attack (e.g. high frequency requests for SMS interfaces, six-digit identification codes); direct bypassing the authentication logic using SQL injection or other Web holes; and CPRF attacks on Portal pages to allow certified users to perform malicious operations without knowledge.
Protection features include: frequency limits for the authentication code interface (e.g., up to three SMS requests per minute for the same IP) and triggering an IP ban on abnormally high-frequency requests; a certification system that uses parameter queries to eliminate SQL injections; all interfaces involving session operations must be verified by CPRF Token; and the Portal page should make mandatory use of HTTPS to prevent middlemen from attacking seized authentication documents.
ARP cheating and middleman assault
In the public WiFi environment, ARP Spoofing is a common middleman attack. The attackers can intercept an unencrypted network traffic from other occupants, even with malicious content, by sending false ARP responses to send equipment that other devices in the network would have sent to the assailants.
Protection features: Activate dynamic ARP detection on access layer switches (DAI, Dynamic ARP Induction) and allow only legitimate ARP response clearance in conjunction with DHCP Snooping functions; enable use of wireless access layers"Client quarantine"Function to prevent direct communication between the occupants ' equipment under the same WiFi network and, even if the attackers have access to WiFi, they cannot directly attack other occupants ' equipment.
Fish fishing WiFi hotspot fake
The attackers can set up malicious hot spots inside hotels with the same name (or similar) as the hotel WiFi, induce occupants to connect to networks controlled by the aggressor, and forge a certificate page to obtain information about their cell phone numbers, passwords, etc. Such attacks are difficult to identify for tenants, because forged authentication pages may be almost identical to the real ones.
Protection features: At the technical level, it is possible to monitor by Widward Intrusion Detection System (WIDS) whether there are illegal hot spots in the perimeter disguised as a hotel WiFi and alert them immediately upon detection; at the management level, hotels should inform residents of the characteristics of their certified pages (e.g. official domain names), including manual checks and forward alerts; and at the certification page, which uses HTTPS and displays valid SSL certificates, allowing occupants to re-enter personal information when they see the browser security identifier.
Authentication bypasses the bug.
Some certification systems have a gap in authentication, and the attackers can obtain access to the network without completing the certification. Common bypasses include: modifying the mainframe MAC address to disguise it as an authenticated device (MAC cloning); using Portal's log-over defect to directly access the addresses on the white list and then transmitting any data through DNS tunnels; and hijacking another person's certified conversation by attacking the session management mechanism of the certification system.
Protection features: The authentication system should bind the MAC address to the authenticated user and periodically check whether the same MAC is switched between different certified users (alternate alarm); monitor traffic of DNS queries to identify DNS tunnel characteristics; and manage sessions using random Token instead of purely MAC addresses to prevent meeting hijacking.
DDoS attack threat to the availability of certification services
The certification system Portal is a public network-oriented HTTP service that can theoretically be the target of DDoS attacks. A large number of forged authentication requests may result in overloading of the authentication server and failing to respond to regular occupants’ requests for accreditation, affecting access by all.
Protection features: request speed limits for deployment of base to pre-certification servers; automatic blocking of abnormal high frequency requests from a single IP; certification server not exposed on the public web, only allowed hotel local network to initiate authentication requests; real-time monitoring of performance indicators of certified servers and prompt warning when unusual loads are detected.
Residential data protection and risk of disclosure
The certification system contains personal data on the number of a guest’s cell phone, authentication time, equipment information, etc. These data are themselves safety risk points.
Protection features: the authentication database should not be deployed on a server to the public network; sensitive fields such as stored cell numbers should be de-esensitized (e.g. only four places are stored, full numbers are used for validation but are not permanently stored); strict rights control and logbook records of access to databases should be performed; data security assessments should be conducted regularly and high risk configurations should be modified in a timely manner.
The security protection of the WiFi certification system is a continuous process, not an end to one-time deployment. Threat environments are changing, system loopholes are being detected and only continued security controls and regular security assessments ensure that the certification system does not become a weakness in the overall hotel security system.