Ex-Hacker erklärt, warum Hotels anfällig für Angriffe sind

the Future of HospitalityI understand. So let's say you are a hacker now and you want to hack a hotel. What would be, like, your first step? Like, how would you how would you what is, like, the weakest point? Is it the is it the Wi Fi, or is it something else?

Tal KollenderIt's a combination between the Wi Fi, which, again, is with the right scanner that you can just do whatever or and I would say, like also, you know, like, social engineering. You need to understand what's going on. You need to understand the homes, you know, the the the people that are there. You want time just for fun. You really want to actually know that someone is there or you want to take something. So that's that's pretty much how

the Future of Hospitalityusually, what what you do. So the people are are the weakest link, if I understand correctly. Like, that's basically how you you would target it.

Tal KollenderYeah. We are not robots. You know? Come on. It's like we are still human being. We all have some legs, disadvantages. So I definitely see it as something that that is definitely,

the Future of Hospitalityyeah, the weakest point, the weakest thing. Yes. I get it. And and if if technology if hotels become more tech driven, so they have more technology, more software, working with more vendors, does it make them more like, is it more dangerous for them because they have more, like, entrances for a hacker or does it really matter?

Tal KollenderI mean, you know, your computer can be fully protected. Right? As long as it is not configured properly, you can have the whatever mechanisms on your device. I mean, if they are not configured, then it's a it's a I would say, it's an easy easy hack for for for someone who can, you know, for like, it's a I would call it maybe bread and butter for attackers who get into a device. Oh, yeah. It has maybe an EDR or an antivirus, whatever, and I have some even protection. But the fact is that that they know what's going on. I know how to bypass those those things over and over again. As long as my device is still not configured properly, then it will it will make

the Future of Hospitalityan attacker. I won't say even a window, but it will just open the the the phone door. And what is, like let's say, don't know anything about cybersecurity. What do you mean with misconfiguration? Like, what what does it mean? Like, can you give me an example? Let's say I work at a hotel. I have some stuff. What is the problem?

Tal KollenderSo first, let's say that's how you how your con how your computer is configured in terms of, okay, you got a computer. Let's say that you work at some company. Right? So you have a company's computer, then I mean, sometimes the computer gets kind of hardening, but it's not that hardened. And then it's so easy to bypass some kind of hardening. Oh, there are so many times that we find human errors. You know, human errors are everywhere. Yeah. You just need, you know, pick up a a a place, a point, or or or something on on the on the computer's net, and you will find.

Tal KollenderAnd it's very hard all the time, you know, to chase after your own tail because new operating systems coming up every quarter or every year, and then, oh, wait. But I can't and you still have some old software, and you have some new things that you need to open or new things that you need to close. And it's very, very hard because nothing is being nothing is correlated in a way that you want. So I would say, like, kind of human errors is one of the most popular thing. Default settings. Default settings are again, you get the computer. Usually, the IT will configure what they know that they need to configure. But if you don't know what you what you need to do, then you won't do it. And then you remain you are remain, I would say, like, with different settings and this configuring.

Tal KollenderAnd then, again, there are so many things like unpatchable software or things on your device that's because it's end of life or because there is no patch and it's still vulnerable. So those things usually create a very, very wide space for attackers to definitely to make it make the right move and eventually take take your data or, again, do whatever they want in order to in order to Yeah. To to gain their, yeah, their goal.

the Future of HospitalityI understand. So having that configuration set correctly, that makes really makes a difference.

Tal KollenderYes. I mean, again, yes, you can see all over the place. Misconfigurations is the is the reason why I would say, 80% of all attacks and specifically ransomware attacks happen. So it's a significant thing.

the Future of HospitalityI understand. And if we talk about, let's say, the data that a hacker wants to get, what is, like let's say, are you a hacker and you have a hotel? What is, like, the most sensitive data that you want to get? Of course, what I can think of is, of course, credit card details, etcetera. But is there something else that you would look at as a as a hacker? Like, I think hotels don't really understand they have so much data, but they don't really know what a hacker is looking for. So if they understand that, it's easy for them to to see cybersecurity as a bigger issue than what they think it is.

Tal KollenderSometimes they can decide that they want to to take the entire website down. Sometimes they would like to decide that they want to to pull the the maybe the okay. Maybe let me take it one step back. An attacker can can attack because of personal reasons, because of someone failing, or because he has a kind of an agenda to to do something. Okay? If it is a personal reason, usually, credit cards, usually, you know, like, making sure that you get into the website and make sure that the hotel is fully occupied all the time, and then they won't be no one will be able to because, oh, they did something to you. Right? And you find, you know, to pay that. Exactly.

Tal KollenderAnd this will be something, you know, personal. Someone if someone paid me to do something, then probably they have the agenda. For example, the hotel or the entire hospitality or the network, whatever they did, something to the specific I I don't know, like, the people who paid, then they have other things, and they are going. And and, again, they think about, you know, the the the entire the goal, and then they calculate the steps until they will get this until they will get the goal. Usually, it's more planned. Usually, it will take more time. And and if it is something that you want to do for the entire, I would say, vertical of hospitality, then you have an agenda. Oh, okay. I mean, now I have hospitality because, for example take just an example.

Tal KollenderAnd take hospitality. Okay? They are pretty much it it it is a competition. Now I will not be surprised if some of the hacks went from Airbnb to hospitality and vice versa. Okay? Because it's all about if you think about it, it was also the the antiviruses companies that they came Yeah. You know, in the past. They came and they want to to sell, you know, their products. And then people were like, who what is it? Who is it? And then they were the they were the ones that created

the Future of HospitalityThe virus.

Tal KollenderThe viruses from the beginning. So I won't say it's like the chicken and the egg. No. But it's like if someone and and and another thing would be, okay. Let's met the entire vendors who work with those fatalities. Let and and this is why you say every single time, Zero day in Microsoft, zero day in Palo Alto, zero day in phone. Yeah. It doesn't really matter. You see every single time because at the end of the day, people find those zero days again in different different ways. But one of the ways is that, okay. Let's see who do they work with, and then let's let's let's go to the vendor itself, and let's find some weaknesses so we can gain our access in

the Future of Hospitalityin a faster way. Yes. So if you have access to the vendor, then you have access to, like, a lot of hotels. So that's like the jackpot. I understand. And from what I hear, a lot of hotelier is, like, investing in cybersecurity. They feel like sometimes it's not really they want to calculate return on investment, and they feel like it's difficult, but because they didn't they didn't have been hacked yet. So they think, like, why should I invest, like, in cybersecurity? It's like, you know, if it happens to me, then what I've seen a few times, hotelier is that got hacked. They were, like, fully cybersecurity mindset, and everything should be fixed. But until it it doesn't happen, they're like, nah. It won't happen to me. I'm like a small hotel. I'm just, I don't know, forced out in in Amsterdam.

the Future of HospitalityWhy should hackers target me? They have, like, the Hilton in New York. Why should they target me? So how would you, like, give them advice that even even the small ones, even the big ones, even the, I don't know, not yet ready for cybersecurity, should be prepared for something that can happen to them. What is your advice to to c level

Tal KollenderOTAs? Well, I would say that for the for the SMB hotels, I would say use some kind of FSSP provider that will provide the entire the entire umbrella of the entire umbrella of the security. That is that is one thing. And the other thing would be that if you are a network, you know, I don't like, you know, etcetera. What I would recommend is that, please, use use those security tools. One of the thing that we added in was that we added a way that everything that you remediate with our system, you see the return on investment. You see how much time and money you save, which is very cool because you see that, oh, that is nice. Now I can say, like, I I finally get my return on investment because the the the the amount of this.

Tal KollenderAlso, if I click and they say five minutes, two minutes, ten minutes, etcetera, then you see how easy it is to convert between those. So, yeah, that's why I'm I'm super happy that we added it. And, again, we added it thanks to our customers. Our customers requested, okay. Show me show me the value. Show me actually,

the Future of Hospitalityshow me how I see the value in money, and and that's what happened. Yeah. That's what that's what everybody wants. There's all your money in money regards to cybersecurity, but that that's a challenge for a lot of companies. Right? Showing that. Correct. Okay. Cool. And and in regards to the future of cybersecurity, let's say artificial intelligence, do you think that it will make let's talk first about the negative side. Do you think it will make it easier for hackers to to hack hotels, artificial intelligence? And if so, can you give some examples?

Tal KollenderHow? Yeah. Come on. Every good every new technology, it creates good stuff and bad stuff. Right? I mean, the good stuff of AI, everyone I mean, people know already. Okay? Why? It will help you live faster. It will help you, know, like, a ride, not only faster, but better. You will definitely have a better, you know, like, way of like, kind of you get your you get your own profession, you know, like Assistant. From from the chat, but it's not only that, even LLM, etcetera. But those things, eventually, with the AI, once it will be more progress, don't get don't get me wrong, it will be able to to code for you. It will be able to create many, many things. But don't forget that the AI, you have also the deep fake. You have also the way that you can you know, it will give you information that even if you looked for in the in the Internet for years, you or for months, you can get it in in in seconds. Exactly. That's the good thing about AI. They will tell you every single thing that you want to know that will help you move to the next step. At some point, maybe you would say, okay. I pause there because, oops, I see some issues, problems. But then, okay, you will use other techniques, but you will get such a long way with the AI, and then you will need to use maybe a little bit of to do the rest, I mean, yourself.

the Future of HospitalityYeah. So AI can really help you do those to take those first steps in a very easy way, like the way I'm thinking. I'm not a hacker, but I'm kind of a creative guy. Like, you can basically do social engineering at scale because it can easier personalize stuff because you can just throw in data and then personalize with AI. You can do voice cloning, like you said. It's also easy with AI to do and and social engineer somebody. And, of course, deepfake is a little bit more advanced, but I think that that also can be done on scale at scale. And and, yeah, hotels are very vulnerable for for that for those kind of attacks. And they are also naive.

Tal KollenderI mean, like, it's very, very hard. I would say it's very, very easy to manipulate, you know, some people that, oh, again, back to the weakest link. Okay? Exactly.

the Future of HospitalityYes. Yeah. The people in hospitality and hotels, especially because they need to be so service related mindset. They have to always be nice. And if you call the reception, for example, they're always open to help. They're like, suspicious. Is this somebody that wants to hack or they're not like the gatekeepers like we call it in other companies? Here, they are so open and, yeah, that makes it easier. Right? I agree. Okay then. In general, what do you what do you see as the future of cybersecurity? How do you see, like, what will happen in the coming coming years?

Tal KollenderCybersecurity is the end to stay. You can add an AI. You can add an LLM. You can add an ML. You can add whatever you want. Cybersecurity is here to stay. Everything becomes digital. I mean right? I mean, it's not we are we are moving away from we are moving away from papers and Yeah. And other things. Some of us, well, I I do still I still I still have my own papers to write some notes to take some notes. But at the end of the day, your data is in the cloud more than on your computer. Laptops are probably here to stay until you will have something that could pop up, you know, something. But, again, probably like a super duper phone.

Tal KollenderAnd and and yeah. So yeah. I mean, always always always there will be cybersecurity solutions. There will be something that's again, at the end of the day, when I say misconfiguration, it's like to say, you know, some misconfiguration exists everywhere. Right? We have the solution for the device misconfiguration. The device can be anywhere as well. It can be in the cloud. It can be I mean, like, my my laptop. It can be a PC. It can be whatever it is. It can be a network device. It can be an OT. Misconfiguration can be can be cloud misconfiguration. Okay? We are doing devices. Cloud misconfiguration, like, we have many.

Tal KollenderWe have data misconfiguration. Again, there are so many ways Yeah. To misconfiguration and manipulate. And and and but, again, the smart thing is to close it, not only to show what is wrong because today, there are too many solutions and less people that will fix it. So you have too many people that will that will sorry. You have too many solutions Yeah. That will show you what is wrong and many people to do it. That's why in Gitpol, we took it to the next level with proactive remediation and without any business impact. So that's the power of GitPol. Maybe in the future, AI will be able to do it. But for now For now. We try. AI is not even.