Learn How to Control Every Room at a Luxury Hotel Remotely
summary
Hotel room iPads sit on the guest Wi‑Fi and send unencrypted UDP KNX frames to a KNX/IP gateway; the deployment uses predictable three‑part KNX addresses and sequential IPs so attackers can infer every room mapping. A Python tool plus Wireshark parsing reproduces iPad payloads, builds a per‑device KNX dictionary and sends concurrent frames to control KNX/IP devices — TVs, blinds, music, HVAC — across iPad2 units in 200+ rooms. The exploit works; the vendor disables the service after disclosure.
AI-written summary · about
chapters (28)
- 0:00Introduction
- 0:26Question
- 0:54Who am I
- 1:36What did I do
- 3:03The Hotel
- 3:32The iPad
- 5:06KNX
- 5:50Open Standard
- 6:41No Security
- 7:17IP Address
- 8:37Conclusion
- 8:52Implementing the Protocol
- 10:00The IP Envelope
- 10:14The KNX Address
- 10:58Evaluations
- 11:08One Light Bulb
- 11:33Second Room
- 12:52Collecting Information
- 13:57No iPad
- 14:29How it works
- 15:06How many devices are connected
- 16:10What does it mean
- 16:21Hotel security policies
- 17:18Internet of Things protocols
- 18:07Whats the worst thing that could happen
- 19:22You dont care about this
- 20:10What can happen
- 20:53Security
related talks
46mD1T2 - Pwning KNX & ZigBee Networks
48mMoving from Hacking IoT Gadgets to Breaking into One of Europe's Highest Hotel Suites
26mBMS is destroyed by "smart button"
26mCodema Attack: Controlling Your Smart Home Through Dangling Management Channels
26mHacking buildings: Security flaws in embedded building control systems
52mWi-Fi Hacking for Web Pentesters
45mAirBnBeware: Short Term Rentals Long Term Pwnage
41mPwning Centrally-Controlled Smart Homes