A travel tip: When staying in a “capsule hotel,” the Japanese style of budget accommodation that packs guests into tiny, adjoining rooms not much bigger than their bodies, be considerate of your neighbors. Especially if the capsule hotel you’re staying in offers digital automation features—and a hacker is staying in the next room over.
That’s a lesson one pseudonymous security researcher will share in a presentation on his experiences hacking a capsule hotel’s automation systems today at the Black Hat hacker conference in Las Vegas. The hacker, who is French but asked to be called by his handle, Kyasupā, says he found half a dozen hackable vulnerabilities in the internet-of-things systems used in a capsule hotel he stayed at in 2019. They allowed him to hijack the controls for any room at the hotel to mess with its lights, ventilation, and even the beds in each room that convert to a couch, all of which are designed to be managed by networked systems linked to an iPod Touch given to every guest.
When I saw all of these features, I thought it was pretty cool, because it means that if I can hack them, I could potentially control all the hotel bedrooms, which is super fun, Kyasupā wrote to WIRED in a text-message interview ahead of his Black Hat talk. At the end, I found a total of six vulnerabilities, which allowed me to build an exploit to take control of any bedrooms I wanted from my laptop.
Kyasupā demonstrated his hotel-hacking shenanigans in the video below, which shows him using a script on his laptop to turn the lights on and off in a series of three capsule hotel bedrooms. He also converts the bed to a couch and back, and turns a fan in the room on and off. Aside from trying out his hacking techniques in that video—filmed near the end of his stay without the hotel’s permission—he says he went so far as to use his powers to take revenge on another guest in the hotel who had been keeping him up with loud late-night chatter, running a script that turned on the victim’s lights every two hours and repeatedly converted his bed into a couch in the middle of the night. I take my sleep seriously, especially on holidays, writes Kyasupā, who works as a consultant for security firm LEXFO. He woke me up several times; it seems normal if it’s my turn.