Vulnerability patched into Hotel WI-FI Network

Vulnerability has been discovered in hotel Wi-Fi networks, no longer placing customers at risk.The InnGate service range, developed by ANTLabs provides visitor-based Wi-Fi networks to businesses such as hotels as well as for use at conferences. It is a popular method of issuing Wi-Fi in service to hotels and provides businesses the option to bill customers based on temporary web access duration, create prepaid plans and perform check-out procedures.

 Cylance revealed vulnerability within the InnGate product line in a security advisory on Thursday. The vulnerability has been classified as CVE-2015-0932 and it occurred due to incorrect sync configuration in the firmware of certain InnGate HSIA models, which enabled external systems to obtain unrestricted read and write file access. As a result, an unauthorized user could gain full access to hotel Wi-Fi systems.

Cylance security expert Brian Wallace reported:”When an attacker gains full read and write access to a Linux file system, it’s trivial to then turn that into remote code execution. The attacker could upload a backdoored version of nearly any executable on the system and then gain execution control, or simply add an additional user with root level access and a password known to the attacker. Once full file system access is obtained, the endpoint is at the mercy of the attacker.”

 ANTLabs affirmed the existence of the vulnerability in a blogpost. The products affected are mentioned below:

  •    IG 3100 model 3100, model 3101
  •   InnGate 3.00 E-Series, 3.01 E-Series, 3.02 E-Series, 3.10 E-Series
  •    InnGate 3.01 G-Series, 3.10 G-Series

Hotel networks have always been a lucrative source for cyberattackers looking to steal valuable data and afflict victims with malware based on the quick succession of victims connecting to Wi-Fi networks offered at hotels.

 Last year Kaspersky Labs disclosed an advanced persistent threat (APT) campaign that dubbed DarkHotel. The campaign had been designed to trap incautious business travelers in Asia. They used malware skulking on hotel networks to entice them into downloading and installing trapdoors disguised as ‘welcome’ packages. In return, the victim’s PC came down with spyware.

Ehacking Staff
With more than 50 global partners, we are proud to count the world’s leading cybersecurity training provider. EH Academy is the brainchild of Ehacking, which has been involved in the field of training since the past Five years and continues to help in creating professional IT experts.

Most Popular

The Complete OSINT Tutorial to Find Personal Information About Anyone

This article mainly focuses on how to discover a person's digital footprint and gather personal data by using open-source intelligence (OSINT). So, in its...

How to find the password of hacked email addresses using OSINT

Open-source intelligence or OSINT is a potent technique, and it can give a lot of valuable information, if implemented correctly with the right strategy...

How to Identify Company’s Hacked Email Addresses Using Maltego & HaveIbeenPawned

This article is part of the Maltego OSINT tutorial, where you will learn to identify the already hacked account, and it’s password using the...

5 Key Vulnerabilities in Global Payroll

The cyber threat against payroll is growing in sophistication and frequency, according to the latest FBI cybercrime report. Many of these attacks exploit fixable...