A hospitality company was rolling out an in-room tablet that let guests control temperature, curtains, entertainment, room service and their bill. It asked ioSENTRIX to test the system the way a guest with bad intentions would, with no inside information.
Testing started with nothing but a guest’s tablet, no source code or system details, and worked outwards: first the room system, then other rooms, then the network behind them.
Testing covered a vulnerability assessment of the room system, exploitation of what we found, network segmentation testing and a remediation plan that kept every guest feature working.
One guest tablet reached other rooms, room service and the network behind them.
Weak password policies allowed simple, predictable passwords on the room automation system. From one in-room tablet, our testers could change temperature, curtains and TVs in other guests’ rooms and place room-service orders that were not their own.
Business impact. Guests in any room could be disturbed or billed for orders they never made.
The room automation network was not separated enough from the hotel’s management networks. From the guest side, a path existed onto the network that hosts the billing system.
Business impact. A guest-facing device could become a way into financial and operational systems.
We found that a guest could control devices in other rooms, place orders that were not theirs, and move from the room system towards the network that runs billing. The client remediated the findings, and ioSENTRIX retested the fixes.
20+ findings in total, including 3 Critical and 4 High.
| Area | Before the test | After remediation |
|---|---|---|
| Room-to-room control | Predictable passwords let one guest tablet control other rooms’ temperature, curtains and TVs | Stronger password policies and security configuration on the room system |
| Room service | Orders could be placed for rooms that were not the guest’s own | Remediated with the room system fixes |
| Network separation | A path ran from the room network towards billing | Room automation network segmented from the hotel’s management networks |
✓ Verification: Critical and High fixed by the client; retested by ioSENTRIX.
One room’s tablet could reach every other room, and the network behind them.
One tablet with predictable passwords reached other rooms. Unique credentials and per-room authorisation keep guests in their own room.
The room network had a route towards billing. Guest systems need their own segment, with no path to finance.
A black-box test shows what someone staying one night can reach, before a real guest finds out.
Details in this case study are anonymised and generalised. Methods that could harm other products are withheld.
A hospitality company was rolling out an in-room tablet that let guests control temperature, curtains, entertainment, room service and their bill. It asked ioSENTRIX to test the system the way a guest with bad intentions would, with no inside information.
A guest could control other rooms. Guests in any room could be disturbed or billed for orders they never made.
20+ findings in total, including 3 Critical and 4 High.
Critical and High fixed by the client; retested by ioSENTRIX.
IoT and embedded device penetration testing, delivered by the ioSENTRIX IoT and network testers.
OWASP IoT Top 10 (2018), I1: Weak, Guessable, or Hardcoded Passwords. These are cited as alignment guidance, not a compliance claim.
