Hacker News Reader

Comment by andrewstuart | Hacker News Reader

Is unplugging the power of the router in an AirBNB a good basic security step?

Presumably some cameras depend on flash storage rather than Internet connection but many cameras do use Internet connection to function?

View on HN

I just cut the power to the house when I arrive.

"Today engineers will succeed in restoring water and power to your area, leaving you with hours of hard sledgehammer work to get it back the way you like it." --The Onion

I burn it down and camp on the ashes.

Nuke it from orbit. It’s the only way to be sure.

I've seen other commenters mentioning that they now consider at least scanning the network to be a mandatory step in their check-in process. Personally I try to avoid connecting my devices to others' WiFi on principal - especially if they're... less than tech savvy.

The most powerful advice in the linked post seems to be infrared scanning for heat. Presuming most cameras generate some sort of heat this would be a good way to locate them.

Microphones can be hidden completely out of sight. A long enough lens barrel can put the heat generating electronics far enough from any visible surfaces that the heat signature may become unnoticeable. Also the heat camera is the most expensive method.

Assuming you don't accept bad certs, don't ssh if there's an issue with the host key, don't use http, relent and other plaintext protocols, why?

Right gue CAs and a lack of cert pinning?

And how would a rogue CA cert get into your cert store?

The only issue with random access points when using properly secured connections is the metadata leak - DNS queries, etc. They will now whom you are connecting to, basically. That's it.

Exactly. And even that, you could use a VPN. In fact anything an airbnb host can do, your ISP at home can do it to, and is far more likely to be doing analytics on it, or be subpoenaed for it. So if it is a concern, you're probably already using a VPN.

Because there are dozens of processes in the background doing that for me.

This is the correct answer. You'd be surprised how many programs rely on the remote server redirecting them to a secure server.

Most major banks in Sweden had http landing pages and did not use HSTS last time I checked (in 2017).

How do you know you're not unplugging a decoy router, with the secure surveillance router concealed somewhere you wouldn't think to look?

This seems highly unlikely, but like all security, this is just one layer of defense.

It could be very inconvenient to unplug the router. The real issue is what level of threat you hope to counter. An unexpected extra clock or an extra coffee machine in the room, as mentioned in the article, would not represent a very high-level surveillance tactic. I mean, to try something as blatant as that would be very unimaginative, or at best, evidence of working with very limited options. Is there really a two-bit Airbnb surveillance problem?

I doubt that a sleazy airbnb host would be sophisticated enough to place a decoy router, and if they were, there's probably nothing I could do to stop them.

My threat model would be the host trying to blackmail me and/or get their kicks from watching me.

A corporate or national actor isn't part of this model, because: - I'm a low-priority target - Prevent highly sophisticated attacks borders on impossible/maddening - The likelihood of the creep is probably 10,000x more

I'm not sure unplugging the router would help, but I probably wouldn't find it very inconvenient either (depending on location).

Overall it's probably worth a quick try to locate and unplug it - if you can't find it, hedge your bets and try some other opsec techniques. Just my own approach.

I keep a small (and cheap) separate router for my IoT devices. If I wanted to spy on someone, I'd definitely use one of those, with a USB powerbank acting as a UPS.

Check your smartphone while you unplug the router (or you block 99% of its signal by 1) wrapping it in aluminum foil or 2) taping a metal box or mylar sheet over it).

If one of the wifi presences discovered by your phone disappears thereafter, then the router you blocked was live and very unlikely to be a decoy. (I can't believe most casual spies would install a live decoy router in the room.)

Since all of the spy devices in the room almost certainly operate via that wifi router, disabling or blocking it is probably the most effective single act you can do to disable all of the room's surveillance devices.

I assume that the decoy router is the active router. So you'll know you've turned it off by e.g. the absence of the Netflix service you were planning to enjoy while staying in the AirBnB apartment.

How do you know that one of the remaining WiFi networks that you can detect (after unplugging the visible one) isn't providing connectivity for surveillance devices? I can't think of any easy way to do this. There could be a surveillance server+router in a crawl space or an attic, but you have to find it.

Better to treat whatever you say and do in the AirBnB apartment as compromised, if you are inclined to worry about this.

I'm not actually that curious to hear what 'compromised' implies in the typical AirBnB surveillance scenario. Is it just the possibility of creepy observation, or identity theft, blackmail, worse?

It's easy to come up with potential horror stories. The higher the stakes, the more incentive for the surveillance to be undetectable (where detectability would impair the attack).

Reply on news.ycombinator.com