As a security consultant who travels up to 40 weeks a year, T. Robert Wyatt has spent his share of nights in Hilton hotels. In recent years, he has noticed problems with Hilton that extend far beyond unclean rooms or clogged shower drains.
According to a lengthy recent blog post, Wyatt says that he has found a series of significant security problems on various Hilton websites. The problems may expose regular Hilton guests to the risks of data breaches and identity theft, similar to those that hit LinkedIn, LastFM, Sony and other prominent companies over the last year.
http://liarcatchers.com/identity_theft_investigation.html
Wyatt also alleges that the company knows about the security problems, but has repeatedly ignored warnings about them.
“Despite my best efforts Hilton has declined to take any action and has continued for several years to knowingly expose their customers’ information,” Wyatt writes in his post.
If true, the security lapses could pose a serious risk to the identities of people who stay at Hilton hotels and use the company’s website, says Ondrej Krehel, information security officer at Identity Theft 911, Credit.com’s sister company.
“It still needs to be verified,” Krehel says. “But if this is accurate, I would consider this to be pretty serious.”
The heart of the problem, says Wyatt, is that when guests sign into Hilton’s HHonors loyalty program on the company’s homepage, their usernames and passwords are sent without encryption. This is contrary to the site’s assurance to guests that “Your login is always executed through a secure connection.”
If true, this lax security exposes Hilton guests to numerous threats, Wyatt says. Since many Web users still reuse passwords across multiple sites, hackers could use data gathered from Hilton’s website to break into accounts across the web.
“Generally consumers have one password for everything,” Krehel says. “So if you can get the password, you can sign into that person’s email or financial accounts.”
Hackers could book rooms in the name of their identity theft victims, Wyatt says. They could also use guests’ registration information to know when victims will not be at home, possibly making it easier to rob them, Wyatt says. Or the hackers could use the data to snoop guests’ online activity when logged into a Hilton hotel’s Wi-Fi network.
“Having provided all sorts of motive for hackers,” Wyatt writes, “Hilton kindly provides the means as well.”
[Related Article: What @NeedaDebitCard Says About Our Credit Knowledge]
Wyatt found additional problems with Hilton’s “Double Miles” promotion, which he says stored users’ login information either with simple encryption or no encryption at all. It was exactly this kind of vulnerability, Krehel says, that hackers exploited to steal millions of user logins from Sony, LinkedIn, eHarmony and LastFM. We reported on these breaches here.
“All [these sites] either stored passwords in the clear or with reversible encryption, all were breached and all of these breaches exposed the passwords,” Wyatt writes.
For regular Hilton guests, Wyatt gives advice for how you can log into the website without possibly exposing yourself to hackers. Don’t log into the Hilton HHonors program from the company’s homepage. Rather, enter a fake user ID and password, and hit Enter, Wyatt says. That will give you an error page and a form to re-type your login. This form is sent via SSL, which means the data is encrypted.
After that, Wyatt urges Hilton guests to do a little advocacy on their own.
“Then call their customer service and complain that they have been knowingly exposing your login credentials and personal information for years and demand that they fix it,” he says.
Calls to Hilton and Wyatt were not immediately returned.
