MGM is down, cybersecurity attack ongoing • Hacker News Board

Re: MGM is down, cybersecurity attack ongoing

#41

Post by amenghra » Mon, Sep 11, 2023, 9:58 PM UTC

foota wrote: post #40

napoleongl wrote: post #24

Earlier quoted context omitted.

These days the locks are online so that you can block a lost keycard from the front desk. Previously you had to open the lock with a never keycard than the lost one to make the lost one inoperable. That works kinda fine in a small hotel but not when you 48000 rooms with millionaires in them.

Fwiw you could probably build this in a way that it continues to operate without internet. This creates a new attack vector (disable the internet and you can't revoke access) but that's probably acceptable given the physical attacks possible.

Each key gets a revision number. When the first set of keys are created, they get revision number 0. The lock records a high water mark of the revision numbers it has seen. Only keys matching the water mark get to unlock the door.

When you want to revoke a key, you re-issue a new set with a higher revision number. When the guest checks out, you issue the next revision number to the next guest, effectively disabling the previous set.

You do all this as a fallback when the network fails. This way, you can still disable keys in real-time when people checkout of their room.

Re: MGM is down, cybersecurity attack ongoing

#42

Post by allenrb » Mon, Sep 11, 2023, 10:06 PM UTC

bigbillheck wrote: post #25

If they're going to shut something down, better a casino than anywhere else.

Was just coming here to say it: And nothing of value was lost.

Re: MGM is down, cybersecurity attack ongoing

#43

Post by willcipriano » Mon, Sep 11, 2023, 10:07 PM UTC

alwaysrunning wrote: post #37

lainga wrote: post #14

Earlier quoted context omitted.

How do those hotel door locks work? When I had an apartment with a tap keyfob, it was battery-operated and the fob seemed to be programmed for that specific lock, so I thought they could work offline.

I did a project several years ago for mgm that involved BT, player cards, key systems, wifi, etc and I can confirm they hotel locks are controlled centrally for various reasons.

I would've thought it would get sent messages like:

And it would keep track internally so that if the central system went down it could still function with already issued keys until it is fixed.

Re: MGM is down, cybersecurity attack ongoing

#44

Post by wolverine876 » Mon, Sep 11, 2023, 10:10 PM UTC

lainga wrote: post #14

abathur wrote: post #7

Take w/ requisite salt, but per Daily Mail [1]: > Thousands of guests at MGM Resorts in the Las Vegas strip have been locked out of their hotel rooms after the company was hit with a cyber attack, according to reports. > MGM Resorts International has about 48,000 rooms on The Strip. The company's properties include Mandalay Bay, the Bellagio, Luxor and MGM Grand, among others. > The outage, first detected on Sunday n…

How do those hotel door locks work? When I had an apartment with a tap keyfob, it was battery-operated and the fob seemed to be programmed for that specific lock, so I thought they could work offline.

I was wondering the same. It would be an extreme fire hazard if a power or computer outage made the doors unopenable - especially because a fire could and likely would cause an outage.

Re: MGM is down, cybersecurity attack ongoing

#45

Post by wolverine876 » Mon, Sep 11, 2023, 10:12 PM UTC

mickdarling wrote: post #26

plasticsoprano wrote: post #21

Earlier quoted context omitted.

Casino floor ATMs aren't just ATMs. They are also ticket redemption machines and therefore have to connect to the MGM network to redeem. I'd imagine the whole machine shutdown for security reasons if network connection is lost.

Yes, I think that MGM has actively shut everything down, rather than some massive hack that has effected all these separate systems. Best guess is that with the F1 races coming soon with what is expected to be the largest cashflow through Vegas ever, that MGM Resorts IT found issues in an audit in preparation for that massive event, found anomalies, and pulled the rip cord to shut everything down till they could sort…

> Best guess is that with the F1 races coming soon with what is expected to be the largest cashflow through Vegas ever, that MGM Resorts IT found issues in an audit in preparation for that massive event, found anomalies, and pulled the rip cord to shut everything down till they could sort out what systems were actually hit.

That is quite a guess!

Re: MGM is down, cybersecurity attack ongoing

#46

Post by TylerE » Mon, Sep 11, 2023, 10:14 PM UTC

willcipriano wrote: post #43

alwaysrunning wrote: post #37

Earlier quoted context omitted.

I did a project several years ago for mgm that involved BT, player cards, key systems, wifi, etc and I can confirm they hotel locks are controlled centrally for various reasons.

I would've thought it would get sent messages like: And it would keep track internally so that if the central system went down it could still function with already issued keys until it is fixed.

Such a system seems like it would be incredibly fragile to local attack - and this is one case where you can't just assume "physical access means you've already lost".

Re: MGM is down, cybersecurity attack ongoing

#47

Post by zie » Mon, Sep 11, 2023, 10:14 PM UTC

jjkaczor wrote: post #20

netsharc wrote: post #8

Ocean's 0x11? I wonder if it's just an attack against their email servers or a bigger one, how networked are their operations? If we believe the urban legends about how casinos operate, there's probably interesting conversations a cyber-attacker could find.

Very networked - but their email servers are now likely cloud-based SaaS.

;; ANSWER SECTION: mgmresorts.com. 300 IN MX 10 mgmresorts-com.mail.protection.outlook.com.

Outlook handles their email.

Re: MGM is down, cybersecurity attack ongoing

#48

Post by willcipriano » Mon, Sep 11, 2023, 10:20 PM UTC

TylerE wrote: post #46

willcipriano wrote: post #43

Earlier quoted context omitted.

I would've thought it would get sent messages like: And it would keep track internally so that if the central system went down it could still function with already issued keys until it is fixed.

Such a system seems like it would be incredibly fragile to local attack - and this is one case where you can't just assume "physical access means you've already lost".

> physical access means you've already lost

I agree, thats why I figured if you can get away with fooling around with a lock, some wires and a laptop in the hallway, you can probably pick the backup key more discreetly.

Re: MGM is down, cybersecurity attack ongoing

#49

Post by gymbeaux » Mon, Sep 11, 2023, 10:32 PM UTC

wolverine876 wrote: post #44

lainga wrote: post #14

Earlier quoted context omitted.

How do those hotel door locks work? When I had an apartment with a tap keyfob, it was battery-operated and the fob seemed to be programmed for that specific lock, so I thought they could work offline.

I was wondering the same. It would be an extreme fire hazard if a power or computer outage made the doors unopenable - especially because a fire could and likely would cause an outage.

You can get from your room to the parking lot without a key at the MGM Grand. I’m sure it’s the same for all others per I assume the fire code.

Re: MGM is down, cybersecurity attack ongoing

#50

Post by gymbeaux » Mon, Sep 11, 2023, 10:33 PM UTC

abathur wrote: post #7

Take w/ requisite salt, but per Daily Mail [1]: > Thousands of guests at MGM Resorts in the Las Vegas strip have been locked out of their hotel rooms after the company was hit with a cyber attack, according to reports. > MGM Resorts International has about 48,000 rooms on The Strip. The company's properties include Mandalay Bay, the Bellagio, Luxor and MGM Grand, among others. > The outage, first detected on Sunday n…

Over the years, MGM has bought up hotel-casinos on the Strip, and now they own most of ‘em. If you’re staying on the Strip, odds are it’s an MGM hotel.