Latest / Elon Musk Podcast / Tabiq hotel leaks a million passports

Transcript

Tabiq hotel leaks a million passports · Elon Musk Podcast

• 0:00
  The Tabik Hotel check in system, maintained by a Japan based
• 0:03
  startup called Recrea, left an Amazon cloud storage bucket
• 0:07
  completely open. It exposed over 1,000,000
• 0:11
  customer passports, driver's licenses and facial recognition
• 0:15
  selfies directly to the Internet.
• 0:17
  And it was not a sophisticated breach.
• 0:19
  I mean, no malware, no advanced persistent threat, no zero day
• 0:23
  exploit. They just left it publicly
• 0:25
  accessible without a password. Right, the bucket name was
• 0:28
  simply. Tabik So anyone with a standard
• 0:31
  web browser who guessed or, you know, stumbled upon that word
• 0:34
  could type it in and view the entire database.
• 0:36
  No authentication required at all, you just needed the URL.
• 0:39
  Correct, which forces a very specific question about our own
• 0:43
  habits and the systems we trust. We physically hand over our most
• 0:46
  sensitive identification documents to hotel front desks
• 0:50
  or automated kiosks without a second thought.
• 0:52
  Yeah, we do it all the time. Right.
• 0:54
  But why is the hospitality industry so exceptionally
• 0:56
  vulnerable to losing that data? And why do simple
• 0:59
  misconfigurations like an open bucket continue to happen?
• 1:02
  Well, to get to the bottom of that vulnerability, we have to
• 1:04
  look at the financial reality driving the theft of these
• 1:07
  specific documents. On dark web marketplaces,
• 1:11
  identification documents command incredibly high prices.
• 1:14
  How high are we talking? A registered European Union
• 1:17
  biometric passport sells for around $4500, a Maltese passport
• 1:22
  goes for 3500, AUK passport fetches 2500 and AUS passport is
• 1:28
  priced around 1680 dollars. The price disparity is
• 1:32
  interesting there. An EU passport offers freedom of
• 1:35
  movement across dozens of countries, Which likely inflates
• 1:39
  its value on those secondary markets compared to AUS
• 1:42
  passport. Yeah, it makes sense.
• 1:43
  But what is a malicious actor actually doing with a passport
• 1:46
  scan or a passport number? We generally think of passports
• 1:49
  purely as travel documents. If someone isn't trying to
• 1:52
  physically board an international flight in your
• 1:54
  name, the utility of a digital scan seems kind of limited.
• 1:58
  So passports are foundational documents.
• 2:00
  They act as the root of your verified identity.
• 2:02
  Criminals use them to bypass secondary verifications to
• 2:05
  access your existing financial accounts.
• 2:07
  Like if you get locked out of your bank.
• 2:08
  Exactly. If a bank detects suspicious
• 2:11
  activity, they might ask for a photo ID to verify your
• 2:14
  identity. The criminal can use the scanned
• 2:17
  passport to bypass that check, take over your account, or add
• 2:20
  unauthorized users to it. They also use the data to open
• 2:24
  entirely new fraudulent accounts.
• 2:26
  They apply for healthcare, unemployment and other
• 2:29
  government benefits using your foundational identity.
• 2:32
  So they use the passport to prove they are you to people who
• 2:35
  have never actually met you. Exactly.
• 2:38
  Or they construct A synthetic identity.
• 2:40
  They take the real personal information from your passport,
• 2:43
  your valid document number, your birth date, your exact legal
• 2:47
  name, and they blend it with fabricated data.
• 2:50
  Like a newly generated address or a different phone number.
• 2:52
  Right, they create a completely new ghost pedophile, and because
• 2:56
  the core foundational document is valid, it passes initial
• 3:00
  automated checks allowing this ghost profile to apply for
• 3:03
  credit cards or loans. But modern passports have built
• 3:06
  in biometrics designed to prevent exactly this type of
• 3:09
  fraud. If you look at the cover of AUS
• 3:11
  Passport issued in the last decade, there is a rectangular
• 3:14
  icon with a circle inside it. Yeah, the chip symbol.
• 3:18
  Right. That symbol indicates the
• 3:19
  presence of a biometric chip embedded in the passport cover.
• 3:23
  That chip holds a cryptographic signature and a digital copy of
• 3:27
  your photograph. Custom systems and airports rely
• 3:30
  on that chip. So if all a criminal has is a
• 3:33
  scanned image of the document from a cloud bucket, they don't
• 3:36
  have the cryptographic chip. How are they bypassing those
• 3:39
  biometric protections? They use a technique called
• 3:42
  morphing. The bad actors take the photo
• 3:45
  from the stolen passport scan and use image editing software
• 3:48
  to seamlessly blend their own face with the victim's face.
• 3:51
  They combine the two faces, yes. They align the eyes, the nose,
• 3:55
  the mouth and create an amalgamation.
• 3:57
  They then put that morphed photo onto a forged physical document.
• 4:02
  Does that actually work on scanners?
• 4:04
  It does. Because the facial features are
• 4:06
  mathematically blended, it can actually fool basic biometric
• 4:10
  optical scanners. The scanner reads the geometry
• 4:13
  of the face, and because the criminal's geometry is partially
• 4:16
  present in the image, it registers as a match.
• 4:18
  It also easily passes a simple visual check from a human guard.
• 4:23
  The criminal uses their real face for the live in person
• 4:26
  check, but the accompanying photo on their forged document
• 4:30
  has been doctored just enough to look like them while still
• 4:33
  retaining enough of the original victims features to match the
• 4:37
  stolen data. Well, that makes the facial
• 4:39
  recognition selfies that were included in the Tabic leak
• 4:42
  exceptionally valuable. I mean, the leak didn't just
• 4:44
  contain the flat scan of the passport, it contained the live
• 4:48
  verification selfie the person took when shooting into the
• 4:50
  hotel. That's right.
• 4:51
  The attackers have the official document and the live
• 4:54
  verification photo right next to it, giving them perfect
• 4:57
  reference material for the morphing process.
• 4:59
  There is an additional threat specific to travellers, too,
• 5:03
  beyond just financial fraud. The Department of Homeland
• 5:05
  Security maintains a public online tool that tracks
• 5:08
  international travel history. Oh right, I've used that.
• 5:11
  It is meant for legitimate travellers to look up their own
• 5:14
  arrival and departure records, but by inputting a full name, a
• 5:18
  birthday and a passport number, which are, you know, all data
• 5:21
  points perfectly packaged together in the Tabak leak,
• 5:25
  anyone can query that database. So they can map a victim's exact
• 5:29
  travel habits. Down to the day.
• 5:31
  Criminals use that travel data to target specific individuals,
• 5:36
  like if they observe through that tool that you are the type
• 5:40
  of person who travels infrequently.
• 5:42
  Say you take one international trip every five years and
• 5:45
  otherwise keep your passport locked in a drawer.
• 5:47
  You become an ideal target. Because you won't notice.
• 5:50
  Exactly. It drastically reduces the
• 5:52
  chances that you will notice the fraud quickly.
• 5:55
  If they steal the identity of someone who travels weekly for
• 5:57
  business, that person will realize their passport has been
• 6:00
  compromised almost immediately. Right the first time they go
• 6:03
  through security. But targeting an infrequent
• 6:05
  traveler gives the criminal months or even years to operate
• 6:09
  under that identity before the victim ever tries to use their
• 6:12
  passport again and discovers the issue.
• 6:14
  Moving from the black market value of the data to exactly
• 6:17
  where it is stored brings us to the central nervous system of a
• 6:21
  modern hotel. The entire operation revolves
• 6:24
  around the property Management system, or PMS. The hub for
• 6:27
  everything. Exactly.
• 6:29
  The PMS is the core hub. It connects the reservation
• 6:32
  system, the point of sale terminals at the hotel, bar and
• 6:35
  restaurant, the guest Wi-Fi networks, and the electronic
• 6:39
  door locks on the rooms. When you hand your passport over
• 6:42
  at the front desk, the scan goes straight into the PMS. You have
• 6:46
  to look at the physical environment of a hotel to
• 6:48
  understand the systemic weakness of that setup.
• 6:51
  The hospitality industry is characterized by high employee
• 6:54
  turnover and a massive web of interconnected third party
• 6:58
  vendors. Very true.
• 6:59
  The front desk employee checking you in today might be entirely
• 7:02
  new to the job. They might have minimal security
• 7:04
  training, yet they are interacting with a terminal that
• 7:07
  is networked into millions of sensitive financial and
• 7:10
  biometric records. They are the gatekeepers to the
• 7:12
  PMS. The hotel's network is basically a building with 1000
• 7:16
  doors, and third party vendors are constantly walking in and
• 7:20
  out of them. You have one vendor managing the
• 7:22
  Wi-Fi network, a completely different vendor handling the
• 7:24
  online booking engine, and another vendor supplying the
• 7:27
  software for the electronic door locks.
• 7:29
  And they all need access. Every single one of those
• 7:32
  vendors requires a connection into the PMS to function.
• 7:35
  If any one of those vendors has weak security, the entire hotel
• 7:39
  network is exposed. The integration of smart room
• 7:42
  controls and automated check in kiosks has expanded that attack
• 7:45
  surface even further. A kiosk scanning your face in
• 7:48
  the lobby is just another endpoint talking directly to the
• 7:51
  PMS, right? And Tabik is just one instance
• 7:54
  of a much larger industry problem.
• 7:56
  If you look at the Marriott breach, an unauthorized party
• 8:00
  accessed the Starwood reservation database and
• 8:02
  compromised the information of 500 million guests. 500 million.
• 8:07
  Yes, hackers were inside the system for years before they
• 8:10
  were detected, siphoning off passport numbers, travel details
• 8:13
  and payment cards. Hotel databases have effectively
• 8:16
  become intelligence gold mines. They hold your payment
• 8:19
  information, your movement history, your physical location
• 8:22
  on specific dates, your home address, and your biometric
• 8:26
  data. They hold a more complete
• 8:28
  picture of your life than many government databases.
• 8:31
  The mechanism of the Tabik leak was an unsecured Amazon S3
• 8:35
  bucket. S3 stands for Simple Storage
• 8:38
  Service. It is essentially a digital
• 8:40
  filing cabinet in the cloud where companies store their
• 8:42
  data. But why doesn't security
• 8:44
  software immediately flag and lock down a public bucket
• 8:47
  containing passports? If a hotel or a tech startup is
• 8:51
  utilizing a cloud environment, they usually have some form of
• 8:54
  cloud native application protection platform monitoring
• 8:56
  it. I would think so.
• 8:57
  A bucket sitting completely open to the Internet, filled with
• 9:00
  files named like passport scans, should trigger every alarm in
• 9:03
  the security system. Well, it does trigger alarms,
• 9:05
  but that creates A phenomenon known as alert fatigue.
• 9:08
  Recent testing in simulated production environments showed
• 9:11
  that default security rules for S3 buckets generate a false
• 9:15
  positive rate of over 80%. An 80% failure rate on the
• 9:19
  alerts. Yes, an analyst receives an
• 9:22
  alert about a potentially open bucket.
• 9:24
  They have to stop what they're doing and investigate.
• 9:27
  They spend up to 10 minutes triaging that single alert.
• 9:32
  Because of the false positive rate, a vast portion of their
• 9:35
  time is wasted investigating completely benign
• 9:38
  configurations. Why is the false positive rate
• 9:40
  so high though? Because cloud environments are
• 9:43
  incredibly complex, a bucket might trigger an alert because
• 9:47
  it's access control list looks overly permissive at a surface
• 9:50
  level. But there might be a
• 9:51
  compensating control in place, like an IP block list applied at
• 9:55
  the network level, that restricts access only to
• 9:58
  employees within the corporate office.
• 10:00
  OK, I see. The security software sees the
• 10:02
  permissive access list and flags it, but it doesn't recognize the
• 10:05
  IP block list that actually keeps the data secure.
• 10:08
  It sees the open door, but it completely misses the 20 foot
• 10:11
  concrete wall surrounding the building.
• 10:13
  Exactly. The analysts are buried under so
• 10:16
  much noise from false positives that they become desensitized.
• 10:19
  When you are clicking Ignore on hundreds of meaningless alerts
• 10:22
  every single day, you inevitably miss the genuine exposures like
• 10:25
  the Tabic bucket. That makes sense.
• 10:27
  The solution currently being implemented in the industry
• 10:30
  relies on writing custom context aware detection rules.
• 10:34
  How do context aware rules differ from the default rules?
• 10:39
  They consolidate multiple alerts into a single high fidelity
• 10:43
  signal instead of just flagging a bucket.
• 10:45
  Because one specific setting looks public, the system checks
• 10:48
  multiple conditions simultaneously before generating
• 10:51
  an alert. Like checking the wall in the
• 10:52
  door. Right.
• 10:54
  It checks for public access lists, it confirms the lack of
• 10:56
  any network restrictive conditions like the IP block
• 10:59
  list, and it scans the actual contents of the bucket for the
• 11:02
  presence of sensitive data tags. By tying all those specific
• 11:06
  conditions together, the system only alerts the analysts when
• 11:09
  all signs point to a true exposure.
• 11:11
  That seems a lot more efficient. In testing, this approach
• 11:14
  dropped the false positive rate to 0 and the triage time for an
• 11:17
  analyst was cut to under a minute.
• 11:20
  But there is still the human element to consider.
• 11:22
  Security software can only do so much if the people configuring
• 11:26
  the cloud storage rely entirely on default settings and actively
• 11:30
  ignore the overwhelming noise generated by their own defense
• 11:32
  systems. Very true.
• 11:34
  If a security team is receiving 1000 alerts a day and 800 of
• 11:38
  them are false, they eventually stop looking at the dashboard
• 11:41
  altogether. The software can be fixed, but
• 11:44
  the organizational culture prioritizing speed over security
• 11:48
  is harder to patch. And the infrastructure holding
• 11:51
  all of this up is constantly decaying.
• 11:53
  It requires continuous attention just to maintain the baseline of
• 11:57
  security. Yeah, a fourth Linux kernel flaw
• 11:59
  was discovered recently that allows for stolen SSH host keys.
• 12:04
  SSH keys are the cryptographic master keys that administrators
• 12:07
  use to securely log into remote servers.
• 12:10
  Without those keys you can't access the back end systems.
• 12:12
  Right, they're the keys to the Kingdom.
• 12:14
  If a flaw allows an attacker to steal them, they gain full
• 12:17
  administrative control over the server.
• 12:19
  The servers running the massive cloud databases we are talking
• 12:22
  about are largely built on operating systems like Linux.
• 12:25
  They require constant patching and maintenance to fix flaws
• 12:28
  like the one affecting the SSH keys.
• 12:30
  There is a sharp contrast between how much attention goes
• 12:33
  to consumer facing technology rebrands like Microsoft deciding
• 12:38
  to rebrand Xbox to an all caps XPOX, while the hidden
• 12:42
  foundational infrastructure holding our sensitive data rots
• 12:45
  from the inside out. It really does.
• 12:48
  The stakes of that infrastructure failing are
• 12:50
  incredibly high because it processes the information
• 12:53
  driving our entire society. To illustrate the gravity of the
• 12:57
  data flowing through these digital platforms, we should
• 12:59
  look at several socio political events currently circulating
• 13:02
  online. And we need to explicitly state
• 13:05
  to the listener right now, we are impartially reporting the
• 13:08
  following topics strictly to convey the ideas circulating in
• 13:11
  the source material. We are absolutely not taking any
• 13:14
  sides or endorsing any viewpoints here.
• 13:16
  Right, we are just looking at the tech housing them.
• 13:19
  The political or legal merits are not the focus.
• 13:21
  We are impartially reporting these events to convey what is
• 13:24
  circulating without taking sides or endorsing the viewpoints.
• 13:28
  So here are the events currently circulating on the platforms
• 13:31
  hosted on this infrastructure. A leaked Pentagon report
• 13:34
  regarding civilian harm mitigation measures.
• 13:36
  A lawsuit filed by a Georgia town over an ICE immigration
• 13:40
  detention center. The Supreme Court rejecting a
• 13:43
  bid to restore a Virginia congressional map.
• 13:46
  A Colorado governor commuting the sentence of Kina Peters and
• 13:49
  a Kansas State court blocking a gender affirming Caribbean.
• 13:53
  And again stating for clarity, we are impartially reporting
• 13:57
  those topics strictly to convey the ideas in the source material
• 14:00
  without taking any sides or endorsing any viewpoints.
• 14:03
  Just looking at the data. The connection here is that
• 14:05
  whether a platform is hosting a hotel guests passport scan,
• 14:09
  internal military reports on mitigation measures, or highly
• 14:12
  charged legal and political rulings, they are all relying on
• 14:15
  the exact same vulnerable cloud infrastructure and operating
• 14:18
  system. If the underlying Linux kernel
• 14:21
  has a flaw allowing SSH keys to be stolen, the specific nature
• 14:25
  of the data on the server doesn't matter.
• 14:27
  The entire system is compromised.
• 14:29
  The military data is just as exposed as the passport selfie.
• 14:32
  So what happens to the companies that fail to secure this
• 14:35
  infrastructure? The General Data Protection
• 14:38
  Regulation, or GDPR, provides the regulatory hammer in Europe.
• 14:42
  Under GDPR, fines can reach 20 million, or 4% of a firm's
• 14:46
  global annual revenue, depending on which number is higher.
• 14:49
  We have seen some astronomical penalties levied under this
• 14:51
  regulation since it went into effect.
• 14:53
  The heaviest penalties are almost entirely against the
• 14:55
  major tech companies. Meadow was fined 1.2 billion for
• 14:59
  transferring European Union users data to the United States
• 15:02
  without proper privacy protections in place.
• 15:04
  Billion with AB? Yep.
• 15:06
  Amazon faced a 746,000,000 fine for failing to acquire proper
• 15:11
  user consent for their targeted advertising systems.
• 15:14
  TikTok received a 345,000,000 penalty regarding children's
• 15:18
  privacy, specifically for setting child profiles to public
• 15:21
  by default and failing to adequately secure their family
• 15:24
  pairing features. And WhatsApp faced a 225 million
• 15:28
  fine for failing to provide a lawful basis for processing user
• 15:32
  data and not being transparent enough about how that data was
• 15:35
  shared with other Meta companies.
• 15:36
  The hospitality companies are definitely not immune to this
• 15:39
  level of enforcement either. Marriott was hit with a 20.45
• 15:43
  million fine following the start Farwood breach we discussed
• 15:45
  earlier. British Airways faced a 22.4
• 15:48
  million penalty after hackers compromised their systems and
• 15:52
  directed users to a fake website, harvesting the payment
• 15:55
  data and personal information of over 400,000 customers.
• 15:59
  The law applies to everyone processing data, regardless of
• 16:03
  their size or sector. The enforcement actions actually
• 16:05
  detail how even very small entities are penalized for non
• 16:09
  compliance. It is not just the multi billion
• 16:12
  dollar tech giants. Like who?
• 16:14
  A kebab shop in Austria received a 1500 fine because they had an
• 16:18
  insufficient legal basis for their data processing.
• 16:21
  A primary school received A6000 wellard penalty for uploading a
• 16:25
  video of children to YouTube without acquiring the necessary
• 16:28
  parental consent. But you have to question the
• 16:30
  actual efficacy of these fines against massive corporations.
• 16:33
  I mean, does a 20 million fine actually change the behavior of
• 16:36
  a multinational hotel chain? That's the real question.
• 16:39
  When a corporation brings in 10s of billions of dollars in
• 16:42
  revenue every single year, a €20 million fine simply becomes a
• 16:47
  line item in their annual budget.
• 16:49
  It becomes the standard cost of doing business in the digital
• 16:51
  age, rather than a severe deterrent that forces a total
• 16:56
  ground up overhaul of their security practices.
• 16:59
  That shifts the burden of defense entirely.
• 17:01
  If the regulatory fines aren't enough to force perfect
• 17:04
  security, we have to look at what can actually be done
• 17:07
  internally by these companies to stop the bleeding on the
• 17:11
  corporate side, security guidelines recommend
• 17:13
  implementing a zero trust architecture, strict network
• 17:16
  segmentation, and data tokenization within the property
• 17:19
  management systems. Network segmentation is crucial.
• 17:22
  Think of segmentation like a submarine.
• 17:24
  OK, if one compartment of a submarine is breached and starts
• 17:27
  taking on water, you seal the bulkheads.
• 17:30
  You lock that compartment down to the water can't spread and
• 17:32
  the whole ship doesn't sink. That makes sense.
• 17:35
  Right now, many hotels are operating like a giant hollow
• 17:38
  cruise ship. Once a hacker gets inside the
• 17:40
  system, maybe by compromising a weak password on a vendor's
• 17:44
  Wi-Fi portal, they can walk right through the entire network
• 17:47
  and access the reservation database.
• 17:50
  There are no bulkheads. Network segmentation forces
• 17:53
  strict boundaries between systems.
• 17:55
  Tokenization is another really effective tool.
• 17:57
  It involves taking a guest's credit card number or their
• 18:00
  passport number and replacing it with a randomly generated token.
• 18:04
  How does that work in practice? Think about handing your coat to
• 18:08
  a coat check. You give them your actual coat,
• 18:10
  which has real value. They give you back a small paper
• 18:13
  ticket with a number on it. That ticket is useless to anyone
• 18:16
  else, right? If a thief robs the coat check
• 18:18
  attendant and steals all the tickets, they don't have the
• 18:20
  coats. In a property management system,
• 18:23
  the passport number is the coat, the token is the paper ticket.
• 18:27
  So the hotel's local database only stores the tickets.
• 18:30
  Yes, the actual coats, the passports and credit card
• 18:33
  numbers are stored in a fortified, entirely separate
• 18:37
  external vault. So when hackers breach the PMS
• 18:40
  and access the local database, they don't get the actual credit
• 18:43
  card or passport, they only steal those randomized tokens.
• 18:47
  They walk away with millions of useless paper tickets.
• 18:50
  Exactly. But when a company fails to
• 18:52
  implement those measures and the data is left sitting in an open
• 18:55
  S3 bucket, individual action becomes the only defense left.
• 18:59
  If your passport or identity is caught in a leak like Tabik, the
• 19:03
  immediate action is placing a credit freeze or a fraud alert
• 19:06
  with the four major credit bureaus.
• 19:09
  Experian, TransUnion, Equifax and IT of us.
• 19:12
  Right. A fraud alert tells businesses
• 19:14
  they must contact you and verify your identity before granting
• 19:17
  new credit in your name. A credit freeze locks the file
• 19:20
  entirely, requiring you to provide a specific pen ion to
• 19:24
  unfreeze it before any new credit can be opened.
• 19:27
  A lot of people know about those 4 bureaus, but there's a lesser
• 19:30
  known step that is just as crucial.
• 19:32
  What's that? You need to request a security
• 19:33
  freeze with the National Consumer Telecom and Utilities
• 19:36
  Exchange, or NCTUE. Oh, for utility.
• 19:39
  Yeah, criminals don't just open credit cards with stolen
• 19:41
  passports. Identity thieves will open cell
• 19:44
  phone contracts or utility accounts in your name, run up
• 19:46
  the bills and abandoned them. That can ruin your credit just
• 19:50
  as quickly as a fraudulent loan. Wow.
• 19:52
  Yeah, the NCTUE freeze stops them from doing that by locking
• 19:56
  your utility and telecom credit file.
• 19:58
  You also need to opt out of pre screened credit card offers.
• 20:01
  Because they can steal the mail. Exactly.
• 20:03
  Criminals can intercept those physical offers in your mail and
• 20:06
  use the stolen data to activate them.
• 20:08
  And of course enable 2 factor authentication on all of your
• 20:11
  sensitive accounts. So a stolen password alone isn't
• 20:14
  enough to compromise you? The physical documents you slide
• 20:17
  across a hotel desk instantly become digital assets stored in
• 20:21
  a highly vulnerable, globally connected cloud ecosystem.
• 20:25
  It is entirely up to you to utilize credit freezes and
• 20:28
  authentication tools to protect yourself when those systems
• 20:31
  inevitably fail. If a completely unsecured,
• 20:34
  unpassworded bucket simply named Tabik can sit undetected on the
• 20:38
  Internet holding a million passports, how many identically
• 20:42
  configured cloud buckets are sitting out there right now just
• 20:45
  waiting for someone to type in the right URL?
• 20:47
  If you're not subscribed yet, take a second and hit follow on
• 20:50
  whatever app you're using. It helps us keep making this.
• 20:52
  We appreciate you being here. Also, check out our YouTube
• 20:54
  channel for more business and tech updates.
• 20:56
  There's a link in the description.