This week, we welcome you to a London hotel where you could check out its admin credentials for a booking website just by walking past the front desk. Our story comes courtesy of Neycho Tepavicharov, co-founder of Flashcloud, a Delaware-based web hosting company.
He was staying at a hotel in London when he noticed a shocking breach of basic security protocols by management, who were a little too hospitable with their credentials. As he was passing through the lobby, Tepavicharov noticed that the door behind the front desk was open and, inside that back room, there was a whiteboard.
On the whiteboard, written in plain English, were the hotel’s Booking.com administrative username and password. Anyone near the desk could clearly see the login information, and if they didn’t have time to write it down, they could have snapped a picture for later use.
As Tepavicharov explains, there’s plenty of mischief you could perform with these credentials. “With that login, someone could change or cancel reservations, see guests’ names and contact details, or message guests pretending to be the hotel,” he said. “Fake 'please confirm your payment' messages sent from compromised hotel accounts are a well-known scam.”
