Cybersecurity Researchers Warn of DNS Poisoning Campaign Targeting Hospitality Sector
In a rising threat, cybersecurity analysts at ReliaQuest have uncovered a widespread DNS poisoning campaign targeting hotels, conference venues, and the broader hospitality sector. This malicious campaign focuses on credential harvesting attacks aimed at stealing corporate login details from unsuspecting visitors. This alarming trend, identified by ReliaQuest, underscores the vulnerabilities present in public Wi-Fi networks frequently utilized by corporate employees.
The campaign has been noted to affect various public-facing routers used for Wi-Fi provisioning at locations such as hotels and conference centers worldwide, with instances reported in multiple U.S. cities, India, and Saudi Arabia. Such attacks exploit the inherent vulnerabilities of routers within high-traffic public venues, raising significant concerns among cybersecurity professionals and corporate travelers alike.
ReliaQuest’s analysis, detailed in a blog post dated July 23, highlights several tactics employed by attackers to gain initial access to these devices. This includes exploiting exposed management interfaces, such as SSH, SNMP, and web administration consoles. Additionally, attackers are leveraging weak or reused admin login credentials to infiltrate the targeted devices. The researchers noted that once the attackers gain access, they modify the configurations of the compromised routers to implement DNS poisoning techniques. This nefarious tactic redirects legitimate web traffic through infrastructure controlled by the attackers, allowing them to intercept sensitive data.
One of the most concerning aspects of this attack vector is that it allows for user compromise without any direct interaction from the attacker. Victims may continue using their devices without any suspicion, remaining blissfully unaware that their online activity is being monitored. As a result, attackers can collect usernames, passwords, and other sensitive information seamlessly. The passive nature of the attack makes it particularly difficult for victims to detect or prevent data theft.
Focus on Corporate Business Travelers
The consequences of such attacks are particularly dire for corporate business travelers who frequently rely on public Wi-Fi networks in hotels and conference venues. By targeting these specific locations, attackers can harvest a wide range of credentials that may lead to unauthorized access to sensitive corporate information, creating potential vulnerabilities for organizations. The relevance of this threat is magnified by ReliaQuest’s assertion that the compromised devices primarily serve hotels and other entities operating captive Wi-Fi services.
Moreover, the researchers pointed out that any operator of a captive portal network—such as airports, co-working spaces, universities, healthcare facilities, and event venues—faces similar risks. The structural weaknesses identified in these networks create fertile ground for cybercriminals, adding urgency to the need for comprehensive cybersecurity strategies.
The ongoing nature of the DNS poisoning campaign bears similarities to previous operations linked to APT28, commonly referred to as Fancy Bear or Forest Blizzard, a notorious cyber espionage group associated with the Russian military intelligence agency (GRU). Such associations highlight the sophisticated and potentially state-sponsored nature of these attacks.
Recommendations to Mitigate Risks
In light of the threat posed by the ongoing DNS poisoning campaign, ReliaQuest has published a series of preventative measures designed to protect corporate networks. Their recommendations focus on eliminating vulnerabilities and detecting credential-harvesting activities should they occur:
-
Enforcing VPN Usage: Organizations are encouraged to mandate the use of an always-on VPN with a full-tunnel configuration. This will ensure that all corporate devices route DNS requests through trusted corporate resolvers, minimizing exposure to compromised networks.
-
Auditing Proxy Logs: Regular audits of proxy authentication logs for suspicious authentications from unknown hosts can help organizations identify potentially malicious activity and respond swiftly.
-
Disabling Unnecessary Protocols: Where not strictly required, organizations should disable web proxy auto-discovery (WPAD) to reduce potential attack vectors.
-
User Education: Employees must be trained to validate URLs and the security certificates of any website requesting credentials, particularly when connected to public Wi-Fi networks.
- Device Authentication Policies: Organizations using Microsoft Entra ID should consider configuring Conditional Access policies to block device-code flows, further enhancing security measures against unauthorized access attempts.
As cyber threats continue to evolve, particularly in public venues frequented by corporate personnel, these preventative measures are critical. Organizations must remain vigilant, proactively securing their networks and educating employees to safeguard sensitive information against emerging threats. The findings from ReliaQuest serve as a stark reminder that in an interconnected world, cybersecurity must always be at the forefront of organizational priorities.