Hotel Wi-Fi Didn't Get Hacked. The Hotel's Captive Portal DNS Did.

This is good. And by good I mean it is finally a story that puts hospitality networking in front of people who normally never think about it, even if the headline gets the technology wrong.

BleepingComputer reported that Microsoft has attributed a hospitality Wi-Fi campaign it calls CaptiveCrunch to Storm-2945, a sub-cluster of Midnight Blizzard, also known as APT29. Microsoft says the campaign has been active since at least early May, with device-code and OAuth phishing from the same actor going back to February. Two new Windows malware families came out of it, a Go-based remote access tool Microsoft calls CornFlake, and an in-memory PowerShell stealer called ChocoShell that grabs browser cookies, Entra tokens and Wi-Fi credentials.

All of that is real, and all of it matters to your security team. What nobody is saying out loud is that the thing that made this work was a network engineering decision, made years earlier, by somebody buying a gateway appliance on price.

So was this actually a Wi-Fi hack?

Well, they didn't break the Wi-Fi, and it's really sensational to place the word Wi-Fi in the headline when this isn't something that was actually a Wi-Fi hack. This was a captive portal compromise that took place. When people are using Wi-Fi, the first thing that they usually encounter at a hotel is a captive portal, so I can understand why they called it a Wi-Fi hack, but it actually isn't one.

They didn't break the Wi-Fi, and it's really sensational to place the word Wi-Fi in the headline when this isn't something that was actually a Wi-Fi hack.

This was something that was compromised at the captive portal level, and specifically at the DNS level. What happened is this attack group got ahold of either credentials or some type of way to compromise an on-site server or service on an appliance, or they compromised something larger, which is a managed service provider that accesses tens of thousands of these types of on-premise gateway devices. Microsoft said it could not determine the exact initial compromise, but that it saw signs of breaches in shared infrastructure rather than isolated devices, which tracks with everything I know about how these networks are actually run.

Those gateway devices serve not only the captive portal, but they usually serve DHCP and most importantly DNS, and that's really where the crux of this is. The hackers got ahold of the ability to change the DNS parameters on these devices at the locations, either directly or by working through an MSP and affecting a large number of them at once.

What does changing DNS actually let them do?

The compromise was all about DNS more than Wi-Fi. What they were able to do is change where the devices thought Microsoft lived. DNS looks up the address of Microsoft dot com, and in this case they redirected it to their servers in order to obtain the credentials.

They used a name that was very similar. Instead of the real Microsoft login domain, they forged something like m365-live dot com, some weird domain name that seemed legit but wasn't. So when the pop-up page appeared to allow someone to log in, it would look to their servers instead of looking to actual Microsoft servers.

When the guest punched in their login information, the attackers would push that through to Microsoft's servers and then grab a copy of the cookie and the authentication, and store the username and password on the hacker's servers. The user got online seemingly as if nothing had happened, and continued what they were doing. That gave the attackers the ability to harvest those usernames, those passwords, and those cookies.

They even had another way on that pop-up where they could compromise the way that the Entra check-in works, so the text message authentication check-in, because it was fired from the bad actors' services instead of from the actual service it was supposed to go to. There's an acronym called AITM, which is adversary in the middle. Or asshole in the middle. That's a phishing scheme where it rips everything and allows them to keep it.

From there they had options. They could do the device code flow using Entra ID, or on a Windows or Android device they could do the ClickFix fake update button that says, hey, in order to get connected, click here to update your system. A lot of people would click on that. Once that was done, there's a payload that they would inject to that end user, and in that payload they would put a keyboard logger or a screenshot logger or a browser and password logger, and they would install these packages on the users' computers.

So not only did they have the credentials, but now they have everything compromised about what that user is doing and how they're doing it, and that's uploaded out to the bad actor server. It wasn't just about breaking their pop-up and getting Microsoft credentials. It was about the overall scope of being able to completely compromise and install espionage software platforms on the user's computer.

Which config shortcut makes this possible?

There are a couple things that come into play here that make this possible. One is using equipment that's basic off-the-shelf equipment that allows for a compromise like this to take place. If they're using residential gateways and residential routers that have a number of updates required from a security perspective, that's number one. Cheap equipment with poor service is easy to compromise.

The second is if they have equipment that's even some of the best in class equipment, but they don't keep those firmware updates coming, and they don't keep the security settings updated on those devices. That can cause an issue as well. You basically can't just put these devices in and set them and forget them. You have to keep them updated with security patches and with patches for the firmware to make sure that they're safe.

The third is working with an MSP that's a known operator, one who understands what they're doing and how they're doing it, and making sure that MSP is up to speed on their security patches. If they're the ones in charge of managing the security of your network, they need to be able to show how they do that, when they do that, and what that process looks like, so you know that you're safe. The key here to me is making sure that you're using equipment that's built for the hospitality industry, and maintaining those security updates the way that you should in order to keep them working at the top of their game.

There's a segmentation piece too. In some smaller networks, if they're not configured correctly and that traffic isn't segmented properly, then once a user gets online they've got access to things they shouldn't have, like the property management system or the guest management system, with the ability to control things like TVs or different IoT devices around the property. You want to make sure your network security is set so that you're only allowing the guests to go where the guests need to go, and they're staying off of that critical infrastructure at the property. That's what a guest VLAN is for, and it only works if somebody actually verified it.

What do you change on the controller Monday morning?

The first thing I would do is go and look for security patches and security updates. If they haven't updated, they need to absolutely do that immediately. Go in and see what updates are available for their platforms and run those updates.

I know that it will take the network down for a little bit of time when it patches, but it's essential to make sure these operations are done. If they need to schedule a maintenance window to do that, they need to schedule it as soon as possible. Enable automatic updates on these devices to make sure they're keeping current, or contact their managed service provider, let them know that they're concerned about this, and have them do an audit of the network to make sure all of the security patches are up to date across all of their equipment.

Where does the 'use a VPN' advice fail?

The problem with this is that it happens even before that. As soon as you sit down at a hotel in your room, you open up your laptop, and in order to get on the Wi-Fi, this is the pop-up that takes place. That pop-up happens, people go through the login process to get onto the Wi-Fi, and once they're onboard and they're set, then they fire up their VPN. You can't get on the Wi-Fi without going through that authentication process, so unfortunately this happens before a VPN is even established.

One of the keys here is to make sure that whatever properties you're staying at are reputable properties, though in this case a lot of those may have been compromised as well. So you just have to use the best, most common sense when connecting to these networks. When that pop-up page hits, if something looks different or feels different, then you have to be aware that you might be under attack. Microsoft's own guidance lines up with that, treat hotel and conference Wi-Fi as untrusted, don't take updates offered through a captive portal, and never register for guest Wi-Fi with corporate credentials.

It's never a bad idea to carry your own hotspot in that case, or use your phone as a hotspot if you're concerned about the security of the network. Make sure you have some way that you can attach through your phone if you have any questions about it.

How does Passpoint make this attack impossible?

From a hotel property owner's perspective, one of the ways they can alleviate this is by not having that captive portal at all. One way to not have that captive portal is to enable Passpoint on their networks.

If they enable Passpoint and they use a service like SignalRoam, or they're part of the OpenRoaming initiative, those devices will immediately connect with secure credentials to the Wi-Fi network, and that negates the ability for a pop-up to even occur, because that connectivity component is already removed. This is a great use case for implementing a Passpoint network in a hospitality environment, because this type of attack doesn't affect a Passpoint network. You'll never see that pop-up, because the Passpoint credentials are what get you on that network and allow you to connect seamlessly and securely without giving an attacker the ability to interrupt that traffic flow.

This is a great opportunity for hotel operators to look at Passpoint, because Passpoint allows you to connect seamlessly and securely without giving something like this the opportunity to exist. The pop-up is simply unneeded on a Passpoint network.

Why is cheap gateway hardware a security decision?

A lot of operators, smaller operators and even some of the larger ones, like to really cut costs when it comes to devices, and they think it's simply a matter of cutting cost on a network gateway or on some piece of network equipment. Then there's an assumption that they all work the way they're supposed to, when in fact they don't.

What you're finding is that when people cut costs on technology, especially in an environment like this where it's a security appliance, that's the wrong place to cut costs. It's really concerning that someone would cut costs there, because there are a lot of low cost vendors out there that manufacture equipment that can do the majority of the work. But they don't have the software patch cadence, they don't have the firmware patch cadence, they don't keep up with all the CVEs that are out there, and they don't support things like Passpoint. It becomes an issue when you try to implement new technology, or save yourself from a hack, and your software or firmware doesn't support it.

Couple that with what's going on with the FCC's router ban. If you look at things manufactured outside of the United States, specifically for our US partners, now you have lists of routers and devices that may not be on that list, and that you might not be able to even apply firmware or software updates to. If you have a property that purchased these pieces of equipment and they haven't gotten that FCC approval yet, you're going to have a lot of gear out there that you can't patch the firmware and the software for. When something like this takes place, you're really left with no options other than to completely replace it.

So make sure you do your due diligence when you're purchasing equipment for your properties, and you understand where they're manufactured, what the politics of that look like, and how that's going to affect your firmware moving forward. Because it can leave you in a position that opens you up to bad actors.

When making a purchasing decision about something as important as a security appliance, you have to understand not just what's available in the market and that the price point might be attractive, but that its ability to support future firmware and software updates might not only be affected by the manufacturer, it might be affected by the politics involved in where that piece of equipment was manufactured.

Do this

• Run a network security audit this week, and confirm every gateway, controller and access point is on current firmware with the most recent security patches applied.
• Schedule the maintenance window now if patching drops the guest network, and enable automatic updates on the devices that support it.
• Call your managed service provider and demand an ad hoc audit, plus documentation of how and when they patch, because they are the shared infrastructure in this story.
• Verify that guest traffic is actually segmented away from the property management system, the guest management system, and the IoT gear running TVs and door locks.
• Start evaluating Passpoint providers so you can onboard guests with secure credentials and retire the captive portal pop-up entirely.
• Audit where your security appliances were manufactured and whether you will still be able to patch them a year from now under current FCC rules.

Q&A

Was the Wi-Fi encryption broken in this campaign? No. The attackers manipulated DNS and HTTP traffic on networks served by captive portal equipment. The radio side of the network was never the target.

Will a corporate VPN protect my travelers? Not at the moment that matters. You cannot get on the Wi-Fi without going through that captive portal authentication process, and the attack happens before the VPN is ever established.

Does Passpoint really eliminate this? This type of attack doesn't affect a Passpoint network, because there is no pop-up to hijack. The credentials on the device connect it securely and seamlessly, so that interception point stops existing.

Our gateway is old but it works. Is that fine? Only if the vendor is still shipping firmware and tracking CVEs. Set-and-forget is exactly the posture that made hundreds of properties reachable through one compromise.

Want this kind of thing weekly, in audio? That's the show.