Hacker News Reader

Comment by djrogers | Hacker News Reader

In a large hotel/resort, there are literally hundreds of people with access to your hotel room at any given time. There's a reason hotel room doors have deadbolts and chains in addition to the keycard - they've never been considered 'secure'...

View on HN

Physical access dynamics area always interesting. I used to visit data centers with high security to work on some equipment. I almost always had more access to more areas than the local employees. I had the magic hand that could open all doors. Many server guys couldn't physically access the data center floor, but I could, and I didn't even work for the company.

The only guys who had more access than I did.... their $15 an hour security guys and ... the janitors. Every room had a garbage can somewhere, someone had to get it... funny how that works.

:-)

In the early 00's we were looking for data centers to host our infrastructure and I remember a couple of the tours we took. On all the tours we saw the man-traps and the fancy hand scanning bio-metric locks as they touted how seriously they took the security of our servers...

...but as we were touring one of the facilities, a large back door was wide open to the outside directly into the main server room. As far as we could see it was unattended. To be fair, I'm sure there was someone around... somewhere... and that the door couldn't have been left open like that for long (forget about access controls, environmental controls were compromised by that one, too!)

At another facility during that same RFP, the sales guy was trying to get us into a room and the fancy hand scanner wasn't accepting his hand for entry. So in a fit of frustration he just opened the door... it actually wasn't locked at all.

Ah... good times...

In college I worked as a janitor and I had access to every room in the building, including the off-limits President's room. It's no wonder that in TV and movies the good guys always infiltrate by dressing up as janitors.

I was the IT guy at a government intelligence agency in Canada as an intern one summer. I had access to darned near the entire building. I had secret level clearance, but I could get into rooms that required top secret.

And I was allowed to wear jeans to work because IT guys need to get down on the floor frequently!

What's the chance they've hired you only because they were also reading all of your communications?

If they were reading all of my communications, they probably wouldn't have hired me.

At one company I worked at we had to take our garbage cans outside the room if we wanted them emptied because the janitor did not have access to our office.

That seems like a better thought out policy.

until you work in a unionized shop that is over-serious about it. i made the mistake of moving the trashcan outside the door, and then had to sit through a union lecture about doing someone else's job. didn't work for that company any longer than it took to find a new job

I was on a flight recently (I think on United), and noticed that the trash can in one of the washrooms was full and, judging by the paper towels around, had been full for some time.

I told one of the attendants when I went to get a snack. She told me they couldn't empty the trash can. I didn't push, but it seemed strange that they were willing to leave a full trash can in one of a very limited number of washrooms on a full plane.

That's how it worked at my last position. Some of these basic issues are not that difficult to address, it's just that most companies don't care enough to bother with it.

ha, this reminds me of once I left my badge at home and snuck into my office from the mailroom entrance instead of the actual front-door entrance with badge scanners and security guards.

> The only guys who had more access than I did.... their $15 an hour security guys and ... the janitors.

The invisible work force!

It's the same story when people get high quality locks for their house. If a thief wants to get in, they'll just break the window.

I've also seen it before with high grade padlocks on a chain link fence, often with razor wire on top. Bolt cutters may not be able to cut the lock, but they could cut the chain link like butter.

Security is only as strong as its weakest link. This is why social engineering has always been such an effective method of hacking.

I think the better reasoning behind using high-end locks in your home is that you have a much better chance of knowing your house has been broken in to.

With standard locks, a thief can quickly and easily gain access without the homeowner knowing.

(I agree with the gist of your post though.)

> With standard locks, a thief can quickly and easily gain access without the homeowner knowing.

Too true. Especially cheap ones with tumblers only on one side. In [more than] one of my old apartments I remember having to sit at the mailbox picking the lock so I could open it and replace it because the previous tenants left with all of the mail keys.

It was funny to have people walk in and just say hello as if nothing was happening. "It could have been your mailbox. I just entered mine with my girlfriends bobby pin while you were standing there. Somehow yours is never vulnerable." Of course I wouldn't say that— but oh that I would... ;P

> just say hello as if nothing was happening

I think the psychology here is that if you behave as if what you're doing is ok and not suspicious, most people will accept that. Same thing for instance when I've gone and picked up my wife's locked bike at her job and put in the car. Most people assume that if I'm doing it publicly, I'm not doing anything shady.

When I did IT stuff as a student job, at one point I needed to pull a computer in for repair and it had been quite securely tied to the desk it was on- I needed a pair of bolt cutters to remove the cable. Of course nobody in the computer lab said anything as I walked in, pair of bolt cutters over one shoulder, and walked out, carrying bolt cutters and iMac.

One of my student jobs involved the 12am-4am shift in the library's 24-hour computer lab (essentially, be a theft deterrent and babysit the printers).

Part of my training involved being told to call a central number to confirm if someone tries to take a computer without any official email being sent to us ahead of time. The year before, someone walked in, placed out of order signs on a whole row of Mac Pros, and carted out 10-15 top end Mac Pro towers without anyone saying anything.

... It took over a month before someone who knew better happened to walk through and noticed the missing Macs.

Also turns out there were no security cameras either, as the University library and IT department had a years-long fight over which department needed to foot the bill for cameras on that floor (after the theft, they quietly split the cost and put cameras in immediately).

I fully believe it.

You’ll probably appreciate this then:

https://youtu.be/8d-bM-Whsmk

And the deadbolts don't work that great, either:

https://twitter.com/sehnaoui/status/978339459208007686?lang=...

Small aside, but that door isn't deadbolted. This shimming vulnerability has always been there for any non-deadbolt style latch.

Keycard manipulation was used in the assassination of Mahmoud Al-Mabhouh.. for anyone doesn't remember that crazy story.

https://en.wikipedia.org/wiki/Assassination_of_Mahmoud_Al-Ma...

Deadbolts and chains don't help if you're not in the room, since you can't lock those on the way out. I suppose this is why many rooms have safes as well, although I'm sure those are riddled with security defects too, like everything else.

Usually as easy as trying the default master password

https://gizmodo.com/5837561/can-000000-secretly-open-your-ho...

https://www.independent.co.uk/travel/news-and-advice/hotel-r...

I'm sure there's a way for the hotel management to just open those regardless of your passcode.

Many of them don’t have a back or the back slides out the only thing you need is to unscrew a few screws often wood screws since hotels love screwing them to a shelf in the closet.

Master passkeys also work on most safes.

It is also ridiculously easy to get a new keycard for a hotel room from the front desk. They don't even check ID most of the time.

"I left my key in my room as well as my wallet, so I don't have ID" is so effective when they do ask for it. Social Engineering has always been an effective method for getting around security.

And hotel guests complain about hotels taking copies of their photo ID at check in to avoid the above scenario.

Reply on news.ycombinator.com