The Japanese hotel chain HIS Group admitted that its in-room robots were vulnerable and could allow hackersto remotely view video footage from the devices.
The personnel at the Henn na Hotel managed by the Japanese hotel chain HIS Group is composed of robots that provide hospitality services to the guests.
The HIS Group hotel chain has 10 locations in Japan that used robots instead of human personnel to provide some services.
The robots use facial recognition to perform check-in operations before access to their rooms and assist them during their stay at the hotel. Now the HIS Group admitted that the in-room robots were vulnerable to hack and could allow remote attackers to view video footage from the devices.
On October 12, 2019, the researcher Lance R. Vick (@lrvick) revealed that he reported a zero-day flaw in the robots to the company in July, but he was ignored by the HIS Group.
It has been a week, so I am dropping an 0day.The bed facing Tapia robot deployed at the famous Robot Hotels in Japan can be converted to offer anyone remote camera/mic access to all future guests.Unsigned code via NFC behind the head.Vendor had 90 days. They didn’t care. pic.twitter.com/m2z6yLbrzq— Lance R. Vick (@lrvick) October 12, 2019The expert discovered an “unsigned code” that could allow an attacker to access video footage via the streaming app of their choice by tapping an NFC tag to the back of robot’s head.
1. Tap an NFC tag to the back of the head with any url which breaks out of the “jail”2. go to settings, allow untrusted apps3. Use browser to install streaming audio/video app of choice4. set to autorun.5. Reboot6. Watch stream remote whenever you wantIt is that easy.— Lance R. Vick (@lrvick) October 13, 2019The expert explicitly mentions Tapia robots used in a specific hotel, it is not clear if other locations use different models of robots.
“The operator of the robot-staffed Henn na Hotel chain announced last week that a modification has been made to prevent exploits by guests, reports TV Asahi (Oct. 18).” reported the Tokyo Reporter.
“On October 16, travel firm H.I.S. Hotel Group acknowledged that it had been possible for persons to gain unauthorized access to its 100 Tapia robots at Henn na Hotel Maihama Tokyo Bay, located near Tokyo Disney Resort.“
The HIS Group apologized for any uneasiness caused.
This was not the first time that the Tapia robots used by the hotel chain made the headlines. On July 6, the company was informed by a guest about a security flaw affecting this model of robots.
According to TV Asahi, the manufacturer of the Tapia robots was informed of the issue, but it determined that “the risk of unauthorized access was low,”
window._mNHandle = window._mNHandle || {};
window._mNHandle.queue = window._mNHandle.queue || [];
medianet_versionId = “3121199”;
try {
window._mNHandle.queue.push(function () {
window._mNDetails.loadTag(“762221962”, “300×250”, “762221962”);
});
}
catch (error) {}
Pierluigi Paganini
(SecurityAffairs – Tapia Robots, zero-day)
The post Robots at HIS Group are vulnerable to hack appeared first on Security Affairs.