AirBnBeware: Short Term Rentals Long Term Pwnage

on YouTube ↗45m

" summary

Airbnb-scale short-term rentals create a real attack surface: an estimated 2 million vulnerable networks worldwide where physical access lets an attacker escalate risks rapidly. Demos show common consumer routers compromised in minutes — owning routers in five minutes — and tools like router-pass-view extract plaintext admin and ISP credentials from router backups. Attacks include changing DNS/WPAD to force captive portals, persistent remote admin, DMZ placement, proxy injection and firmware backdoors; simple mitigations are hardcoded DNS, disable auto-proxy, and VPN or mobile hotspot.

AI-written summary · about

" chapters (12)

1. 0:00AirBnBeware: short-term rentals, long-term pwnage
2. 1:20Jeremy Galloway
3. 5:42Brave New World The Sharing Economy
4. 13:51Scale of Trust
5. 14:52Countermeasures
6. 23:42If a bored teenager can hack your network, you're in trouble
7. 29:21Owning DNS: Attacks
8. 32:40Attacker types
9. 33:19Semi-targeted attacks
10. 34:35How you secure your DNS
11. 34:53Mitigations for renters (technical)
12. 39:38Mitigations for owners

" related talks

• 40mAll Your LAN are Belong to Us. Managing the Real Threats to Remote Workers.Wicus Ross, Charl van der Walt · RSAC 2021
• 13mThe dark side of IoTVince Steckler · Collision 2017
• 41mModding Security & PrivacyBarry Galster · GOTO Chicago 2016
• 48mAssume Compromise: Think Like a Hacker to Build ResiliencePaul Dant · RSA Conference 2023
• 30mOne Million ASUS Routers Under Control: Exploiting ASUS DDNS to MITM Admin CredentialsMasaki Kubo, Yoshiki Mori, Kanta Okugawa · Black Hat Europe 2023
• 27mWIFI-Important Remote Attack Surface: Threat is ExpandingYe Zhang, Haikuo Xie, Ying Wan · Black Hat Asia 2020
• 42mCloudy With a Chance of Exploits: Compromising Critical Infrastructure Through IIoT Cloud SolutionsRoni Gavrilov · Black Hat Asia 2023
• 59mThe Internet of Pwned ThingsTroy Hunt · NDC London 2020