London hotel put admin login for booking website on whiteboard behind the front desk
This week, we welcome you to a London hotel where you could check out its admin credentials for a booking website just by walking past the front desk.
Key points
- On the whiteboard, written in plain English, were the hotel’s Booking.com administrative username and password.
- He was staying at a hotel in London when he noticed a shocking breach of basic security protocols by management, who were a little too hospitable with their credentials.
- Anyone near the desk could clearly see the login information, and if they didn’t have time to write it down, they could have snapped a picture for later use.
As he was passing through the lobby, Tepavicharov noticed that the door behind the front desk was open and, inside that back room, there was a whiteboard.
It was just the easiest way for the whole team to share one login.” After Tepavicharov talked to the manager, not only did the hotel change its ways, but it also moved its website to his hosting service, Flashcloud.
Additional details
- “With that login, someone could change or cancel reservations, see guests’ names and contact details, or message guests pretending to be the hotel,” he said.
- “Fake 'please confirm your payment' messages sent from compromised hotel accounts are a well-known scam.” An attacker could potentially exploit that access to disrupt hotel operations or target guests with convincing scams.
- Tepavicharov decided to play the role of good samaritan and warn the hotel’s manager that the business was endangering itself by showing everyone its password.
- Give each staff member their own login, turn on two-factor authentication, and keep passwords in a password manager, not on the wall.” ®.
- Most important: give each user dedicated credentials with their own separate login, and use multi-factor authentication.
How this summary was made: extractive summary — built from the sources' own reporting. It is drawn only from the reporting of the sources listed below — read the originals for full detail. How we summarize →
Advertisement
Every article behind this summary — 1 article from 1 outlet
Get stories like this in your inbox.
Subscribe — it's freeOne free email at 6am — your topics, deduplicated, five minutes. No account, no paywall.