August 8, 2024

The Hostile Hotel

The Hostile Hotel

Actually, it's good that hotels announced room searches

Some hotels in Vegas have alerted their guests there will be daily room searches to look for anything with too many hacker vibes. While this is naturally upsetting to many people, it is actually a good thing. The announcement makes it explicitly clear that hotel rooms are not a safe and secure environment to leave your belongings.

Hotel room shenanigans have always been a feature of the Vegas conference season. For too long the vast majority of attendees have been oblivious to this issue, treating their hotel room like a room at home. By making it explicitly clear that rooms are not secure and will be searched, the hotel has done a great service to the community.

I was at BlackHat in 2013. I locked my travel laptop in the hotel room safe. Like a normal person, I took measures to detect tampering with my electronics such as before and after photos.

Before:

After:

As you can see, some sort of localised seismic event caused the contents to move around. My travel router shifted 5cm to the left (about three and a half aspirins), my other travel router went backwards a couple centimetres (approximately one fiftieth as tall as Danny DeVito), and my Movies USB spun around 60 degrees and moved roughly 1cm (8 grains of sand) to the left.

Fortunately this seismic incident was entirely restricted to the inside of my safe and no one was injured.

A friend of mine told me about an incident where he returned from the Briefings early. When he opened the door to his room there were two men in suits standing there. They said something to the effect of "Good afternoon, sir. Everything seems to be in order," and walked out before he could process what had happened.

Here are some steps you can take to help detect if someone has been going through your stuff. These are just some basic tricks which might catch amateurs.

1. Take before and after photos

2. Scatter coins, etc. over objects to create a random pattern (making any changes more obvious in the before/after photos)

3. Place cups around your stuff to block off access. Use the compass in your phone to align the handle to a specific direction. Check that it still points that way when you return.

These are free, easy, and. don’t look suspicious. They might even provide some amusement if you detect anything.

My point is not that your equipment will be tampered with or your data stolen if you leave items unattended in your hotel room. Rather, that it is safer to operate with the knowledge that your room will be visited by many strangers, some of them actively searching for "hacker stuff." Keep that in mind when you head out.

The key takeaway is to think of a hotel room as sort of like email in that it feels private, but it isn't. Don't leave anything in your hotel room that you wouldn't leave with the security services.