Hacker Newsnew | past | comments | ask | show | jobs | submitlogin
Hackers claim it only took a 10-minute phone call to shut down MGM Resorts (engadget.com)
90 points by jimt1234 on Sept 13, 2023 | hide | past | favorite | 101 comments


They should put the MGM Grand's front desk staff in charge.. Their car park machine ate one of my room keys so I popped to the desk on the way to the pool. As I wasn't carrying ID (just my other room key) they gave me a very thorough interrogation of the exact layout of the room, how much my upgrades cost, and other details before they'd issue a second key.

Then they flat out refused to put parking charges onto my tab without ID. Yet if I had gone back to the room and merely pulled a single drink out of the minibar, I could have run up a $60 charge no problem!


> Yet if I had gone back to the room and merely pulled a single drink out of the minibar, I could have run up a $60 charge no problem!

Is it the kind of minibar connected to the phone line, where every item presses down a dedicated knob thus touching the item releases the signal to the system? The only time I saw something like this was in a hotel in US of A and viciousness of it infuriated me.


I did some research after staying in a Vegas MGM property and the minibars [1] seem to use IR beams to detect if a product has been removed. They also can be hardwired via Ethernet or use wireless protocols like zigbee. It seemed that in my room it was wireless as the thermostat model supported zigbee. I also saw that the fridge could be locked remotely (!) on some models. [1] https://bartech.com/


The last bit makes a lot of sense. Many recovering alcholics request no mini-bar access, and locking it remotely is both easier and more secure than having someone from housekeeping physically go into the room and do.

If virtual it can be automatically as part of the guest check in flow.


On the other hand the sight of alcohol being so close, even if locked, could be unpleasant and very tempting.


It's Vegas. Anyone THAT uncomfortable with alcohol has no business being in town, because it's EVERY where.


Well a lot of people go there on business.


Sure, but anyone SO triggered by a locked fridge is not going to survive a town where some of the restrooms probably have bars in them.


Also useful if it's a room for kids...


> https://bartech.com/

That's a lot of hostile innovation no one needs neither asked for. Almost like the infamous US prison technology.

Turn your cost center into profit center! (by charging your guests $5 for touching a Snickers bar)


I wonder if there's any blog posts about covertly switching around beverages to fool the beams, Mission-Impossible-style.


Just use a straw like the rest of us.


A few years ago I was staying in a hotel where the minibar fridge compressor was making a ton of noise in the middle of the night. I did some "percussive maintenance" to get it to quiet down (I couldn't get to the plug to just unplug it).

On checkout, I had a huge bill for a bunch of things in the minibar. I guess I jostled the items enough that it tripped whatever switches or sensors they used. I complained to the front desk, and luckily they refunded all of it.


Minibars seem to have generally fallen out of favor in the US and been replaced with just in-room refrigerators. It probably partly a function of the hotels I frequent though and, while I travel to Vegas less these days, it's hands-down the worst offender of breathe on the minibar or snack tray and get charged a lot of money.


It's usually done in a much more banal way, just charge you for what they restock.


Not really. Nowadays, Vegas hotel minibars frequently have sensors.[0]

Before sensors, people would grab a $5 can of soda at 2am, drink it, swing by the convenience store in the morning and get a 12-pack for $6, and put a single can back in the minibar. On paper it's a 1:1 swap, so it's not really stealing, but hotels wanted their profits, so they invested in the sensors.

I'm sure other hotels just check what gets restocked and charge you accordingly, but hotels that really want to juice you will get every dollar they can.

[0] https://www.reviewjournal.com/local/local-las-vegas/minibars...


> On paper it's a 1:1 swap, so it's not really stealing, but hotels wanted their profits, so they invested in the sensors.

It's not stealing at all.

I always stuff my own drinks into the minibar fridge between the hotel supplied ones, something like this would really piss me off.


> Yet if I had gone back to the room and merely pulled a single drink out of the minibar, I could have run up a $60 charge no problem!

Please tell me that was a mini bottle of aged whisky and not Diet Coke.


It was ridiculous. So a bottle of water, say, was something like $7 in the mini bar, and then there was a "$50 restocking fee" on top if you took anything out of the minibar in a certain day. Naturally, all minibar use was immediately banned when I discovered this ;-)


Mandalay Bay has a little sign on the minibar indicating that if you even pick something up, you're liable to get charged -- they claim to have weight sensors, presumably so you can't drink a $15 bottle of water, then run down to CVS an hour later and buy a replacement. This might just be bullshitting, but I took great care not to even touch the damn thing... which is exactly what you want on your vacation, a little zone of the room that'll cost you money if you touch it.


They indeed have weight sensors - that’s how the mini fridge detects that something has been taken so it can charge you.

The concept isn’t evil in itself, it’s just that the pricing applied to it is predatory.

The warning is there for your convenience more than anything else and is often out of an abundance of caution. I’ve seen similar ones where you can pick up and put it back within a certain time and not be charged - I’m pretty sure all these machines have a grace period to avoid spurious charges in case it gets bumped/etc, so it is safe to pick up items and put them back within a reasonable timeframe.

In practice feel free to pick up (and even replace items, if it’s literally the same and they won’t be able to tell) and just play dumb and contest the charges at the front desk, they’ll have to waive them if they can’t decisively prove you actually took any items.


Won't be long until manufacturers start making different SKUs for different hotel chains, like they do for price matching retailers


The "reasonable timeframe" listed last time I was in that situation was 6 seconds.


Wonder if the sensors are still able to send data if you pull the fridge's power plug first? eg battery backup or similar


This is strange in that it -feels- illegal. Could you imagine if grocery stores did that? What if you just want to inspect it closer or look the back or something?


How far away from civilization (or the next supermarket) do you need to be for these prices and fees to make any sort of sense, that anyone even remotely thinks about taking a single drink? I've never seen something like that in Europe.


Being a casino, I assume that the targets are people who are either drunk or totally indifferent to prices while they're on vacation or, as is common in Vegas, on an employer-expensed conference junket.

My solution was to go to the convenience store (still located in the casino) which was expensive (a guy in front of me nearly had a meltdown at paying $15 for a can of lager) but at least had no "restocking fees." A Target with more sensible prices is about a 10 minute walk from MGM Grand, however, in case anyone here ever winds up there.


Hotel prices on even basic food/snacks are so high now it's often cheaper, even with a good tip, to just do like a grocery store/pharmacy door dash on your first day there.


One of my coworkers showed me a fun something that was so obvious that it's one of those "now why didn't I think of that" tips on one of our international trips. When arriving at the destination airport, buy a bottle of whatever at the duty free shop. Consume that instead of any minibar items. The cost of one full size bottle will be cheaper than a single minibar charge. I don't know why, but hitting duty free was just in my head as only something to do when returning home. I just chalk it up to OJT!


OJT? Orange juice time?


On the Job Training


Way more practical, but less delicious


Not to mention that you might get scurvy during on the job training (especially if you're a pirate), whereas it would be nigh impossible to do the same during orange juice time.


Sounds like you're buying the wrong bottle at the duty free!


They're not mutually exclusive!


In my experience, the minibar's level of use is proportional to the sobriety of the guests + their understanding of the prices.

So, basically, drunk people and children.


Yeah, the only times I've heard people talk about having to pay for using the minibar it one of two stories, either; 'I was drunk and just wanted something to snack on' or 'I left my kids unattended in the room for a half hour'.


Besides nickel and dimeing you, casinos raise prices in order to make their comps seem more generous. Basically, they want to target problem gamblers and encourage them to get addictions, so they give them gifts in order to keep them in the casino and create a sense of comradery. The most basic comp is alcohol, which is given for free on the floor in order to make gamblers drink. After that, you get free food, which seems more generous than it is because of how expensive Vegas food is. If you're really throwing down money, the casino will give you a free room so you never leave more than necessary. If you're a straight up whale, you'll get a VIP treatment with special rooms, butlers, and transportation. I don't know if comps are a thing in Europe, but the alcohol comps are restricted up here in Canada.


You don't need to be far from civilization. You just need to be drunk and exhausted, which describes a very large fraction of people in Las Vegas hotel rooms.


And the Vegas strip, when it's 110 degrees outside and a 20 minute walk between casinos, is often not the the most convenient place to pop into a convenience store.


I was at the Westin in Las Vegas recently and it just had an empty fridge that I stocked with beer from the nearby liquor store.


Makes me want to stay there


It’s more so “how drunk are your guests.”


Probably closer to the former, but I wouldn't expect GOOD booze. I've seen minis of Cuervo for $15 in a minibar.


    Yet if I had gone back to the room and merely pulled a single drink out of the minibar, I could have run up a $60 charge no problem!
Right, but pulling a drink out of the minibar requires a room key which, in turn you couldn't get without ID.

So both cases depend on ID.


Ah, but they did. They gave me that second key without ID, just with interrogation. That same interrogation was not suitable for a $35 parking charge, however.


I suspect there's an aspect of precedent/case law here. Minibar charges hold up in court differently than parking (service) charges, perhaps?


That’s odd. Can’t say I’ve ever been in a high end hotel that would not accept room number and last name as sufficient for any charge


The MGM Grand is massive, over 5000 rooms. It's about a 1/4 mile from self park to the front desk. Nobody "pops" anywhere in that building.

Also, who drives without ID?


Who said they were driving?


They were interacting with the car park machine.


The comment never says they interacted with it, only that the machine ate it. They could be a passenger, we don’t have enough information.


As I mentioned, there are numerous parts of the story that don't add up. The MGM Grand, as I stated, has over 5000 rooms, a random front desk agent would not be able to verify identity by describing the layout of one specific room (nor would that be compliant with security procedures).

The car park machine, "popped to the desk," driving or wandering Las Vegas without ID, the identity procedure... I'm comfortable with my assessment that there is something not entirely correct with the story. You are welcome to disagree.


I'm not sure why you're so suspicious of my banal vacation story. Here is the dull chain of events:

* We return late to the MGM self park one night. I was told I could "use my key" to get in/out. Stupidly I put my key into the credit card slot (rather than scan the barcode, as you're meant to) and it eats it.

* We return to the hotel room using my wife's key because we're tired.

* The next morning we decide to use the Grand's pool. I leave everything except the remaining room key and my phone in the safe because we're going to the pool and I would not leave anything poolside that I couldn't tolerate being stolen.

* On making it to the lobby, my wife decides she wants Starbucks. I decide to spend my time attempting to get my key replaced. I therefore turn up to the desk with my remaining room key, my phone, but no driver's license or passport. In Europe this would literally be zero problem, hence my attempt.

* I was able to use a combination of answering numerous questions about my room, my identity, and how much I'd spent on the room to convince them to give me a second key.

* I later returned to the desk with my ID to add parking to my folio.


How is identity verified in Europe? Every hotel I've checked into there wanted a passport.


As others have suggested, it varies, but in my experience, knowing my full name, room number, possessing a key and knowing how I paid for the room has always been enough. Last four digits of the card used for the room tend to seal the deal in every case, but were not acceptable for MGM (despite me having that very card on my Apple Watch).

In the UK, at least, it's unusual to show a driver's license for anything (except buying alcohol if you look young) because many drivers don't carry them, whereas in the US I had to show it every time I even checked into a hotel and even occasionally when buying things with a credit card.


Everything in your first paragraph usually flies at a typical suburban Courtyard Marriott in the USA. However your story took place at a 5000-room megaresort in Las Vegas, where security has to be much more serious. Most visitors appreciate that.


In Europe? Don't you mean "in that specific hotel, on that specific day, with that specific employee"? Do you really think everyone follows the rules to the letter when they're making front desk wages? That job is 100% replaceable.

Sometimes workers get tired of dealing with persistent people who absolutely insist that they are correct (which in this case they were), and realize that they don't get paid analyst wages, they get paid front desk wages, and they say "Okay, this looks right to me. Here you go."


> In Europe? Don't you mean "in that specific hotel, on that specific day, with that specific employee"?

No I don't mean all of that. He wrote "In Europe this would literally be zero problem, hence my attempt." I'm curious, if you can get a hotel room key in Europe without ID, how does that work? Does the phone work as proof?


Apologies, I misunderstood your question. I interpreted your question as a dismissive general response, but it appears that it was a legitimate question about a specific thing.


It's all good. I opened up a can of worms at the start by expressing doubt, it was all kind of a joke but as we all know, text on a screen lacks expression.


They do yes, some bastards even want to hold on to it which is illegal in all of Europe.


I don’t know about this particular story. But I have personally been escorted to my room and asked to describe, in-detail, what objects are in the room when they open the door. I have no idea what they plan to do if it isn’t what I say it is, but that method I’ve experienced. I’ve also explained to the front desk and they ask a cleaning person to do a check based on what I say.

Nothing about this sounds too far fetched to me, based on my experiences at other hotels/resorts. Maybe this only happens to you if you have a sketchy appearance or due to other biases; if you are clean cut and of a non-prejudiced race, maybe you won’t run into this crap.


"escorted to my room" is entirely different than the story described here. And "other hotels/resorts" don't have over 5000 rooms and thousands of additional visitors to the casino, clubs, shows, restaurants, who are not hotel guests.

> maybe you won’t run into this crap

What "crap"? He didn't have ID. The employees should simply hand out keys on the honor system?


I also mentioned how in some cases I described it to the front desk and they had cleaning services check. A 5000 room hotel is no different than a 500 room hotel except for scale. You still have to do the same stuff, just more often. Having more rooms doesn’t make things go away…

What crap? Being treated with suspicion just for the way you look. “Have ID, don’t care, maybe it’s fake”. :sigh:


Fake ID? Did you read the story? He did not have ID with him when he requested a replacement room key.


He probably had ID in his room (or, if in America one can check in without an ID, he could have a credit card with his name), and the staff should have verified it instead of giving a key to a random stranger.


Hacker: "Ugh, I just lost my laptop. Can you reset my password?"

Helpdesk: "Sure!"

Hacker: "Thanks! What mail server should I use again? And what's the VPN IP? I need to RDP to fix some kind of outage."

Helpdesk: "[redacted]"

Hacker: "Thanks so much! Have a nice day!"


I remember reading one of the earlier editions of "Art of Deception" which has lots of these types of examples. Like simply calling up the local county clerk to figure out when the police officer is on vacation for your traffic ticket, then getting a continuance for that day. The police officer doesn't show up, and you get off the hook.

So many good stories. RIP.


When I worked for the government, my coworkers and I half joked that if you dressed nicely, wore a lanyard, and carried around a clipboard and a stopwatch, you could probably get into a lot of facilities you didn’t have access to.

None of us were brave enough to try it.


I used to work for a company that supported a lot of exhibitors at trade shows and conferences and things.

In theory, basically all of these required an exhibitor pass to get in to. Sometimes I’d have one, sometimes it would be with someone already at the show who I was supposed to call to come out and let me in, etc.

I used to make a game out of getting in without using or having a pass.

One of the easiest strategies was just to have a slightly large or unwieldy looking box and find a well enough travelled side door. In the context of a trade show or something, somebody hauling stuff in through a side door was 100% expected. Nobody would blink an eye at holding the door for you. Often there’d be a security person inside but if you just walked confidently and like you knew where you were going they wouldn’t chase you down just to ask you to put down all your stuff and dig your pass out.

Same strategy has worked to drive right past vehicle barriers. They’ll tell you can’t drive in there. Tell them you’re there for <namedsponsor> and you’re not carrying all these boxes in the back seat from a mile away. Quick radio call and “drive slow through the crowd please, be really careful”. Wasn’t even there to deliver anything, that area just has shit all for parking.

After showing up in a group of ten people carrying <namedsponsor> swag and gear, wearing <namedsponsor> clothing, in a <namedsponsor> wrapped vehicle and having every staff member have to present a pass and submit to a glance through of everything they were bringing in… one of my main contacts was always shocked every time I’d do this.

Make way more money now doing way more interesting work, but that role definitely had some fun parts.


I used to break into music festivals as a kid.

The best time was just as camera phones were being adopted. I had a paying friend already on site, and got him to send me a picture of the wristband. Sky blue, yellow toggle.

I head to a haberdashers, grab some ribbon and a few appropriately sized beads and laugh my way in through the front gate.

No way that'd work these days, but my favourite hack to date.

Good times.


Have you caught these couple of Max Fosh videos?

I Broke Into The International Security Convention https://www.youtube.com/watch?v=qM3imMiERdU

I Broke Into The U.S. Security Convention https://www.youtube.com/watch?v=NmgLwxK8TvA


Sounds so fun. It would probably be a pay cut for me as well at this point, but it's still kind of my dream job.


Oh, I have some coworkers that are often tasked on going into places they shouldn't be and seeing if anybody complains.

At least over the population we test, your chances of getting in jail are big enough that you shouldn't try it. But you certainly can collect anecdotal evidence that it works.


Or a ladder. Nobody stops a pair of people dressed like laborers carrying a ladder.


A few years back a town lost several miles of copper cable installed under main street. A work truck pulled up in the middle of the street, coned off the area, opened a lid, hooked up a spooler and started yanking.

They spooled up a truckload of copper, gathered their cones, and drove off. They were seen by hundreds of witnesses in the middle of the day, but nobody suspected anything.


Or just a high-vis vest, a hardhat, and a toolbox or belt.


Security minded types might still stop you, especially since these are the kind of well-known scenarios that might get used in security training.

You want invisible? Be female, 40+, short but otherwise average build, any skin colour but white, black hair, generic cleaning staff outfit, and one of those carts with mops and buckets. Now you're invisible (racist, classist, and misogynistic biases exist, might as well use them).

(As a 2m tall person I can't blend in anywhere.)


Or just be very pregnant while carrying boxes, anybody will open the door for you. Pro-tip: prothesis pregnant belly full of tools.


I don't think it's racist, classist, or misogynistic to make an observation. You yourself made this observation, and I didn't detect the slightest hint of racism or misogyny from your report even though it described a very specific marginalized group. On the contrary, to your point, the reason they are "invisible" is because we are used to seeing exactly what you describe.


If you smoke a few Marlboros in a cleaning staff outfit, get some Walmart shoes, get a $30 phone, and get a mop and bucket, I feel like it might work pretty well.


When I sold my Flipper Zero recently, the buyer showed up wearing business casual, with a button-down shirt tastefully embroidered with the name of a company involved in commercial real estate.

I didn't ask whether they actually worked for that company, or the outfit was part of their pen-testing toolkit.


This is pretty common, even was a reddit sub dedicated to it. /rActLikeYouBelong

Its amazing where you can get with some "proper dress" and confidence. Lots of cases of using a hivis vest and lanyard to get into free concerts, gaining rooftop access, etc.


There’s a line in the 90s movie the Paper where Michael Keaton’s character says, “A clipboard and a confident wave will get you into any building.”

I have to admit that I actually used that on occasion.

9/11 changed that fact.


9/11 might have changed it in some places but not most.



When I worked in film production we would also joke that "you could stop a parade with a walkie-talkie". In other words just holding the walkie and telling people what to do was very effective even when you had no real authority.


Posing as an IT person is the best way. I remember when NationsBank bought Bank of America (yes, it wasn't a merger) a friend bet another friend that he could get BofA root access.

He called the branch manager saying he was from NationsBank IT and was going to do a pre-merger inspection. He showed up, asked for the root passwords of the boxes in the branch, logged in, left a MOTD message, then left.

Needless to say they beefed up the training on that once the merger closed.


Humans are always the biggest weakness in any system. I completely believe this, and it's a major reason why I don't keep my linkedin or other social profiles current.


If MGM refuses to pay up then it must have confidence that they have sufficient backups and can get everything up and running again.

I had (still have) serious doubts that they have the expertise and discipline (as well as all the vendor systems it relies on) but I will have to give them credit if true and they can get back to 100% without paying a ransom.

At the same time, the source of this article may be completely fabricating all his/her claims, there's obviously no confirmation of any of it at this point.


The hackers may regret it when Vinny and Tony pay them a visit.


Vinny and Tony were the hackers.


Wouldn't real hackers post evidence and not just claims?


If I had made some significant negative impact on a company's operations such that my antics made national news, I would likely choose to avoid providing evidence of my actions.


Really looking forward to hearing a thirty second clip from this call in a 2028 episode of Darknet Diaries.

“THESE are true stories from the dark side of the internet… I’m Jachary Sider.”


I love seeing your spelling of his name! It took me years to realize that his first name is Jack, not Jackery. It’s Jack Rhysider.


> Customer anecdotes report issues making reservations, using ATM machines, playing certain games and mobile key entry into hotel rooms, but Engadget has not independently confirmed these reports.

Will be very curious to see what systems were affected


Quite a few systems were likely pulled offline as a preventive measure, though it may be indistinguishable to a customer from a "hack"


These responses may have been a goal of the attack.





Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: