Room inspections at Resorts World confuse, annoy DEF CON attendees

https://www.reviewjournal.com/business/tourism/invasion-of-privacy-hotel-room-inspections-confuse-hacker-convention-attendees-3121350/

by jarsin • 2 years ago

322 307 2 years ago

reviewjournal.com

rolph• 2 years ago

why not actually, attend the convention, and learn how to perform security related procedure, rather than alienate the people most apt to help, and educate in the context of computer security.

start with learning what hacking is, and talk about "living off the land" using field expedient improvised tools and materials.

petre• 2 years ago

Sure, educate the mall cops about USB thumb drives.

devwastaken• 2 years ago

The "inspection" was reportedly carried out in a threatening and illegal manner that held attendees against their will and coerced them to give up private belongings.

The DA should prosecute the "security staff" for their illegal acts and make an example out of them. This is not the first time a hotel has done this, and they will continue to act outside the law until those responsible face felonies and prison time.

bigiain2• 2 years ago

The DA should prosecute the "security staff" for their illegal acts

Ha ha. In _Vegas_? Not in this timeline. The DA is _not_ on your side in this fight.

bankcust083856• 2 years ago

That's okay. That's what the Feds are for when there is state-level corruption.

(When Spotting the Fed may actually also be useful.)

philwelch• 2 years ago

https://archive.is/CqCfj

illuminant• 2 years ago

Well I remember the times I went to (single digit) Def Cons. Cement in the toilet, sizable portions of the hotel lost power, haxors taking the event room doors off their hinges, those plotting to exploit the digital signage.

Vegas + hacker cons, everything one might expect.

DaSHacka3• 2 years ago

As a more recent attendee, it's not like that at all anymore. The edgiest you'll get is some graybeard thinking they're "alt" and "punk" while advocating for checking IDs at registration and having quite literally identical political views to Brenda from HR. The attendees have overall been insanely passified, I presume a side-effect of the rapid growth and number of straight-lace SWE guys there because of their employers.

Even this year, you will be trespassed from the con for putting up _googly eyes_ and there are 4-6 different villages dedicates to "break-times" and inclusivity.

Probably for the best, no way a truly "edgy" and zany hacker con would've been able to find venues to host at nowadays anyway.

zer8k• 2 years ago

Probably for the best, no way a truly "edgy" and zany hacker con would've been able to find venues to host at nowadays anyway.

Best for business, perhaps. I stopped going several years ago when the conference got too soft. Yes, the antics were sometimes too much and it's understandable why SOME THINGS would need to be reigned in. For example, concrete in the toilets, flares in the elevators, windows getting broken, ATMs being hacked etc. 100% understandable.

The defcon today is completely sterilized. It's an extension of corporate culture in it's truest sense. There's no interesting things going on anymore. The noted "inclusivity" breakouts and villages are growing, the goons are more serious, the "hackers" are mostly Joe's From Accounting, etc. Part of the allure of old defcon was everyone was just a hacker. It never, ever mattered who you identified as or what you were. Can you hack? Great, you're in. Everyone serious never gave names and cameras were very seriously frowned upon. Oh, how the mighty have fallen.

If I'm being honest it's gone from the high point of my year to something I'm glad is just a memory for me. I went for ~15 years. It's sad to watch it turn into this sterilized "dont offend anyone or anything" after being counter-culture for decades. But, you either die a hero or live long enough to see yourself become the villain. I'm once again glad I didn't spend the money to go.

cqqxo4zV46cp• 2 years ago

Undoubtedly some ‘security’ higher up trying to build their little fiefdom and expand their corporate influence. The absolute hilarity of the mere concept of this does distract me a bit from how invasive it is. Like, what do you think that you’re looking for? What’s cause for suspicion? They’re almost certainly just looking for large quantities of ‘computer stuff’ in a single room. Aside from like, large antennas, I really can’t imagine what correctly ‘looks’ sketchy.

xyzzy123• 2 years ago

What is the problem with having lots of computers in a room anyway?

jen20• 2 years ago

God help them during Re:Invent.

firesteelrain• 2 years ago

The Venetian conference rooms and suites were used to ‘hack’ a satellite last year during Hack a Sat Finals. There were no issues. It is right next to the Caesars Convention Center. I know this is a new venue so maybe they are a little trigger happy

mrandish• 2 years ago

They have to know the glorified mall cops doing such inspections have no ability to differentiate "hacking tools" from typical laptops and thumb drives (because they are the same thing).

So the real goal must simply be intimidation. Of course, given the audience, that tactic is unlikely to have the desired effect.

m463• 2 years ago

The flipper zero is pretty distinctive, but I think the folks who would go to these conferences would leave it at home in a drawer.

shagie2• 2 years ago

Nevada is one where I would avoid having a flipper with me at all.

https://www.toool.us/lockpicking-laws.php

1. Every person who makes or mends or causes to be made or mended, or has in his possession in the day or nighttime, any engine, machine, tool, false key, picklock, bit, nippers or implement adapted, designed or commonly used for the commission of burglary, invasion of the home, larceny or other crime, under circumstances evincing an intent to use or employ, or allow the same to be used or employed in the commission of a crime, or knowing that the same is intended to be so used, shall be guilty of a gross misdemeanor.

Having lock picks in your possession coupled with the circumstances that suggest you intend to use them would be a crime.

It wouldn't be a stretch to find someone with a flipper poking at things could run afoul of this law.

It is in the "a flipper is legal, but be very cautious having it... and if you were some place where you shouldn't be and had a flipper, it could make things worse."

aaron695• 2 years ago

This was first talked about at the 2018 Defcon after the 2017 Las Vegas shooting, it seems exactly the same -

https://www.csoonline.com/article/566069/vegas-hotel-room-ch...

Disney also started a "Room Check" after the shootings - https://touringplans.com/blog/disney-in-a-minute-what-is-a-r...

The sooner we have "The Raven Hotel" the better, but until then I'm not totally sure what you can do? Know it will happen and keep guns and laptops in locked bags when you are not there I guess?

The man-children of HN are the first to cry when big corporations don't protect them, there's some irony this site is crying about it.

gryfft• 2 years ago

Another fine upper management execution of the Politician's Syllogism [1].

  1. https://en.wikipedia.org/wiki/Politician's_syllogism

bankcust083856• 2 years ago

The fallacy employed is even dumber than that: Ban or destroy all nerd magic wands and hacking happening anywhere and everywhere else in the world will stop.

RandomThoughts34• 2 years ago

1. It is not daily room searches. It’s daily room checks by the cleaning crew even when asked to not disturb.

2. The policy is for the cleaning staff to scrupulously applies the usual policy with more attention than usual and reports out of the ordinary things to a support group with IT and security, which seems, well, fine? They are hosting a large group of people specialising in hacking. It is indeed more likely that something fishy with their IT will happen then than at any other point in time.

The whole thing is just pretty much asking staff to be extra vigilant. There are plenty of precedents allowing me to suggest it’s a very reasonable and good idea.

The Twitter thread then quickly goes into crazy conspiratorial territory when they somehow think that the pictures shared imply search and seizure. Hotels never seize things and they don’t rummage through your stuff. The whole thing is about security getting involved proactively if they see things in the open especially if they are plugged where they shouldn’t be.

Still amusing to see people who spent their whole careers arguing about extra invasive provisions to shield against potential sometime fairly remote security risk extremely spooked by room checking - a fairly standard procedure in every hotel.

Edit: Downvoting me to death because you dislike what I say is not going to make it stop being common sense. At least, if you disagree, please have the courage to engage in honest discussion. Also please read the thread, 90% of the reply at the time of my edit are completely pointless because they didn’t bother checking what the hotel is looking for and prefer trying (and predictably failing) to look smug.

mattmaroon4• 2 years ago

If the worry is IT issues, what’s a room check going to do? Are they going to report people for having laptops?

That’s not what these checks are for. These started in response to the mass shooting at Mandalay Bay, and they’re looking for an arsenal.

rob742• 2 years ago

That... makes more sense, actually. But, if they want to prevent something like that from happening again, they have to take a look at every room in every hotel whenever there is an event going on that could be targeted - which, in Las Vegas, I think is pretty much all the time?

rob742• 2 years ago

Well, when guests put the "do not disturb" sign on the door, hotels should respect their wishes, right? If I put that sign on the door and then find out that my room was entered nevertheless, I would also think really hard before booking a room at that hotel (chain) again, not because I had something to hide, but out of principle. Also, what are they hoping to find? An unlocked laptop with some kind of hacking software running? I don't think hackers worth their salt would be so naive (except maybe if they leave the laptop there as a "honeypot")?

RandomThoughts34• 2 years ago

[flagged]

irjustin2• 2 years ago

Hotels don't care about a laptop left around running. My guess property damage or simply disgusting room.

ajsnigrutin• 2 years ago

They are hosting a large group of people specialising in hacking. It is indeed more likely that something fishy with their IT will happen then than at any other point in time.

Yeah, and a daily room check will help with that how exactly? Are they going to take laptops away from guest? Flipper zeros? SDRs?

Faaak• 2 years ago

Sure, I'm certain that the cleaning staff know the difference between an nmap directed at your raspberry pi vs the one targetting the TV vlan of the hotel. smh

giantg25• 2 years ago

"Hotels never seize things and they don’t rummage through your stuff."

This absolutely happens today, although it is rare. Hotels have turned over a client's property from rooms or valet to police without a warrant. Some hotels will actually search your bags if you use their luggage room service. This started happening after the Vegas shooting and seems to be only a Vegas practice (or at least I haven't read articles on it happening elsewhere).

meroes• 2 years ago

Wrong. https://www.secjuice.com/defcon-hotel-security-fiasco/

2018, so as part of the same new security since the mass shooting.

Hotel security are also confiscating attendees lock picks, although we can kind of see why they would do that. The sight of a hacker with lock picks in your five star hotel must scare the bejeesus out of any security guard. But still, lockpicks are part of hacker culture and organizers are trying to get them back for you.
Its not just confiscating items that they can see in rooms, there are reports of hotel security going through attendees personal belongings too, they have very clearly been searching through suitcases, an unnaceptable violation of their guests privacy.

irjustin2• 2 years ago

I wonder what happened in the past to create these policies. Seems like some crazy things.

They outright don't trust this group. Property damage?

yodelshady• 2 years ago

There's always the chance of some idiot who thinks they're going to take down society with nmap and metasploit. The hotel's safe, but I'd be worried about some other legitimate customers getting mixed up in it.

Though I also really don't want to be the one reviewing reports from housekeeping. "Yes, that's a laptop running hacky stuff, because it's a speaker rehearsing slides. Not a visually identical laptop running visually identical tools against slightly different numbers."

prepend• 2 years ago

I think this was in response to the shooting a few years ago where the shooter put his DND on for days and had his guns and ammo out all over the room.

I’ve had “room checks” at many hotels since then and they said it was for security purposes.

michaelt5• 2 years ago

What happened in the past was the 2017 Las Vegas mass shooting [1] - the deadliest mass shooting by a lone gunman in American history. It was conducted by shooting out of a hotel room window. The shooter had 24 guns and over a thousand rounds of ammunition in the hotel room - which went unnoticed partly because the guest put up the 'do not disturb' sign.

The hotel owners have presumably decided that the high-probability-minor-damage risk to their business from a few paranoid types avoiding their hotel is not as great as the very-low-probability-enormous-damage risk from a copycat mass shooting.

And so, ignoring the do-not-disturb sign and snooping on guests' rooms is the norm in Vegas these days.

And if they happen to have a large block booking of particularly privacy-conscious people and so a noticeable fraction of the rooms are declining maid service, I can understand why they'd want to be ready to carry out some supplemental checks.

[1] https://en.wikipedia.org/wiki/2017_Las_Vegas_shooting

intunderflow3• 2 years ago

If this is true then why does the hotels list of what to search for include USB drives, breadboards and wifi routers, not guns?

tempfile• 2 years ago

Perhaps DEFCON should be hosted in a safer country :^)

dtech• 2 years ago

I fail to see how this is relevant for DEFCON specifically. If this was a general policy sure.

giantg25• 2 years ago

I aee a lot of disagreement here. It's not that it's specific to DEFCON of "hacking equiptment". It's that the prior attack has given hotels the will and potential legal cover to do room checks/searches. They can now apply this to anything, such as "hacking" equiptment, guns, hotplates, etc. There are even examples of hotels handing over property from rooms or valets to law enforcement without a warrant.

gaws• 2 years ago

I wonder what happened in the past to create these policies. Seems like some crazy things.

Caesar's Palace and the MGM got hacked.

486sx333• 2 years ago

jedberg5• 2 years ago

I posted it above, but it's a combination of the festival shooting and DefCon attendees hacking the maid tracking system to make it look like their rooms were cleaned/inspected when they were not.

https://news.ycombinator.com/item?id=41229322

Metacelsus• 2 years ago

Wasn't this a thing last year too?

johncessna• 2 years ago

It's been an issue in the past, and the articles mention it.

saagarjha• 2 years ago

Yes, they've been doing it for a while.

spacecadet2• 2 years ago

I stayed at a hotel directly behind the convention center, no room searches...

intunderflow3• 2 years ago

Per the image in the linked post daily room searches are mandatory for people staying on property who booked as part of the DEFCON room block

CuriousCosmic• 2 years ago

Your room was certainly searched (effectively required in all the big strip hotels after the 2017 shooting) but those searches are mostly housekeeping crew phoning in anything particularly "problematic looking" during regular cleaning and a separate set of dedicated staff doing random walk-ins every day or other day (generally without touching anything) where they step in look around for 30 seconds and go to the next room. It's designed to be exactly the thing you never notice while you are there unless you don't leave your room.

spacecadet2• 2 years ago

Interesting! Except I put a game camera in my room facing the door. I couldn't even get fresh towels without calling 4 times. Maybe I was just lucky.

intunderflow3• 2 years ago

More images are included by the same poster at this URL, disclosing what the hotel considers hacking tools: https://x.com/d0rkph0enix/status/1822879409126162779

Seems like whoever drafted this policy has no idea what they're talking about given USB drives and empty breadboards are on here

cyberge99• 2 years ago

I blame Hollywood, not the hotel staff. They can’t be expected to know what each and every stray circuitboard is/does. Not all circuitboards are bombs, but almost all modern bombs have circuit boards.

Hizonner• 2 years ago

Anybody who gets their worldview from the movies deserves a big, hearty chunk of any resulting blame.

ImPostingOnHN• 2 years ago

All bombs contain matter, yet "matter" managed to escape the list. Perhaps there is a flaw in this logic?

CyberDildonics• 2 years ago

Where are all the "modern bombs" you're talking about?

aeonik• 2 years ago

I think most bombs are hand grenades or similar, and don't have circuitry as far as I know. Just mechanicals and chemistry.

dang• 2 years ago

(This comment was originally posted to another thread, but we merged it hither)

DEFCON attendees having mandatory daily room searches by conference block hotels - https://news.ycombinator.com/item?id=41222930

bankcust083856• 2 years ago

I guess they're trained that electrical engineers are the same as pedophiles.

denysvitali2• 2 years ago

Since when is a soldering iron a hacking tool? When I saw that picture on the internet I legitimately thought it was a joke (similar to those magazines telling the parents to look out for "hacking software")

lithos• 2 years ago

Having "unusual" technical skills.

You need to remember that America is stupid enough that working on calculus problems on a plane, is enough to delay the plane and get searched because the person next to you thinks you're a terrorist: https://www.washingtonpost.com/news/rampage/wp/2016/05/07/iv...

nabla9• 2 years ago

DEFCON conference attendees have a history of hacking hotel room keys, property management systems, filling pools with bubbles and doing all kind of mostly harmless but annoying shenanigans in hotels they reside during the conference. The conferences have changed a lot but something always happens.

The right policy would be to always respect customer privacy and if they can't be trusted to behave, refuse them.

alwa2• 2 years ago

In this case, then, you feel that the right policy would be to deny them accommodation outright rather than accommodating them on the condition that you’ll glance in the room once a day?

multimoon• 2 years ago

I’m not sure what the hotel is hoping to gain here, and the argument in this thread is very weird.

The argument for this in the comments below seems to be justifying this saying that the hotel is doing safety checks because of a prior mass shooting, which was unrelated to DEFCON, or that they’re looking for “suspicious networking equipment” which none of the staff is trained on how to go find let alone even identify.

Moral implication of do not disturb aside, this seems very poorly executed and meaningless. If the management of the hotel for some reason is paranoid and doesn’t like these guests, then don’t accept their business.

JohnMakin• 2 years ago

The argument is this has been going on for a long time and isn't anything new or surprising. It's even happened at past events and has always been known to the organizers as commonplace. It isn't justifying the behavior, but attempting to put it into context.

alwa2• 2 years ago

I noticed that a hotel I stayed at reworded their door signs to say “cleaning not required,” which seemed to me a sensible way to reframe expectations.

Legal obligations aside, how would a provider of public accommodation figure out who to refuse the business to? Do they size up guests at checkin to see if they look hacker-ish?

Is that more fair than a bumbling effort at deterrence by advertising your existing security policy, of casting eyes in every room every day—a policy you apply uniformly to every member of the public who wants to rent a room?

yencabulator• 2 years ago

My understanding from some other conversation was that these rooms were sold as a discounted block to the conference; they knew it was going to be defcon people.

kelnos14• 2 years ago

If they don't want to be an attractive lodging option for DEFCON attendees, maybe they shouldn't reserve a discounted block of rooms for DEFCON attendees.

devinegan11• 2 years ago

Vegas local here, after Oct 2017 no Vegas hotel room on the strip is going 24 hours without hotel staff seeing the inside of a room - every hotel has this policy. I don’t know why people expect privacy in Vegas, there are more cameras and technology watching you here than anywhere else in the US.

unsupp0rted3• 2 years ago

I don’t know why people expect privacy in Vegas

I expect privacy in any home where I live, whether it's for a decade or for a day.

When the door closes, it's "my personal space" for the duration I paid for.

Of course, now Vegas begs to differ.

jhbadger• 2 years ago

Then you must not rent your home. I've lived in rented apartments my entire adult life and while not daily inspections, everywhere I've lived the management has mandatory inspections every few months to check on fire alarms and other maintenance issues as well as making sure residents aren't violating policy by having more than two pets, trashing the apartment, allowing roaches and other pests to fester, etc. It can be annoying, but if I don't own it, it's not really "my" home.

devinegan11• 2 years ago

I feel I have privacy in my home here in the Las Vegas suburbs. Surveillance stops at the strip for the most part. But the strip is not “home” for anyone I know and I would never call a hotel * stay at anywhere home. Strangers have access to your room at all times, that is why they provide safes.

akira25014• 2 years ago

The obvious question is "would these inspections have stopped Route 91?" I strongly suspect that would have had NO impact. The guest was known to them, was a high roller, known to get comps, and used the service elevator over several days to load the room with weapons hidden in cases. All for the purpose of attacking a large outdoor festival next to the hotel.

The other obvious question is, did the people who "cyberattack" them do so from _inside_ their own hotel? Is there some reason to think simple visual room inspections are going to help prevent their networks from being attacked?

None of these are logical responses to the stated problems. They're just ways to reduce privacy with a very thin corporate liability excuse tacked onto the end of it. I don't trust that they can people safe, and I don't trust their motivations in deploying these "techniques."

I'd rather sleep in the tunnels with the homeless at this point.

jarsin2• 2 years ago

I agree with you that it probably would not have stopped it, but Steve Wynn at the time was convinced his staff would have discovered him.

He claims they implemented policies in 2015 to enter and inspect all rooms after more than 12 hours of DnD. In other interviews he admits they "profile" everyone that enters their hotel.

https://nypost.com/2017/10/08/vegas-shooting-wouldnt-have-ha...

gosub1002• 2 years ago

of course they wouldn't have, but if they don't change their policies at all, they have 2 new problems: some patrons will perceive your property as not taking security seriously if other hotels have "beefed up security" while yours doesn't. Secondly, if there were another shooting, even if it wasn't nearly as big as the Route 91 massacre, in court they could point to your lack of doing anything whatsoever "in the face of the nations worst shooting".

devinegan11• 2 years ago

“ Authorities have said he brought 23 weapons in 10 suitcases into the room and set up cameras inside and out to watch for police closing in on him.”

If they are looking through everyone’s rooms I would hope they find this now as he took days to get all of the guns and ammo up to his suite. I am not law enforcement and can’t say for sure though. The US has done a lot worse in the name of terrorism (I believe this was a terrorist act).

smsm424• 2 years ago

Likely, if there were another terrorist (which is not very likely, they usually don't repeat the same thing over and over) the housekeeping would report something weird, and then somebody would file it somewhere, and would sit on it for hours if not days, and then when the shit hits the fan, everybody would trade the blame and claim it wasn't their job to do something about it. I mean, the US Secret Service works this way, do you expect hotel security to be better?

mattmaroon4• 2 years ago

This policy by itself: perhaps not. He did skip a room cleaning one day before the shooting, but he quite probably could have worked around one if he knew it was coming as a matter of policy. It is, however, just one of many changes made, all of which in concert (no pun intended) would make something like that at least significantly harder to do.

For instance, he had bell desk bring 22 large suitcases to his room over a few days. That's a huge red flag that would not go unnoticed now (and there's likely some procedure about logging/reporting since then). Prior to that event, nobody logged or even paid attention to such things. When you work with whales in Vegas, you just get used to eccentric rich people being eccentric rich people. Now you're at least aware of threats from people posing as them.

thih9• 2 years ago

Are other hotels near popular places in the US following the same procedure? Or is Vegas at higher risk?

gs174• 2 years ago

It supposedly is a policy for major chains. Hilton in DC did it to me and claimed the whole chain does it.

eltoxo• 2 years ago

I had never in my life heard of this before now and I am no stranger to hotels.

I would go straight to the front desk, demand my money back for that day and then never stay with hotel again along with making sure the corporate office got a nice email about their bullshit policy.

Maybe over priced Vegas hotels can do this but any hotel I have ever stayed at needs to make the customer happy because the competition is so fierce. Most hotels will go out of their way to make sure you are happy. Not randomly inspect your room like you are a child.

lotsofpulp4• 2 years ago

Most hotels should be doing it every 2 or 3 days at the latest. Maybe every 7 days if it is a hotel catering to long term guests.

Any longer than 7 days for inspecting and cleaning every room is asking for pest infestations, or worse.

As a hotel customer, I would not want to stay in one that does not a policy of frequent room inspections.

wkat42425• 2 years ago

I don’t know why people expect privacy in Vegas, there are more cameras and technology watching you here than anywhere else in the US.

Yeah I can't imagine ever willingly going there (eg unless my work forces me to). It's a very curious choice for a community with so many privacy activists. The shooting excuse for the inspections is stupid. Anyone could walk in and set up in 10 minutes.

heyitsstanley• 2 years ago

"the shooting excuse" implies that the hotels have some ulterior motive for wanting to enter rooms at least once per 24 hours?

what motive would they have that is so important that they insist on spending money on low skill headcount to enter thousands of rooms per day?

honestly i'm struggling to sort out what scheme they're running that makes this headcount investment worthwhile.

anon373839• 2 years ago

This comes as news to me! I’ve stayed in Vegas numerous times since then, and I almost always decline housekeeping. I’ve never had anyone come into the room (to my knowledge, anyway). I wonder how selectively this is enforced.

gs174• 2 years ago

Were you there 24/7? In DC they barged in (well, knocked and then went away when I answered before they could get in) around 4 PM.

anal_reactor2• 2 years ago

It is absolutely astonishing to me that Americans call their country "the land of freedom" while at the same time their society keeps on producing more and more bizarre ways to control the citizens, paralleled only by communist regimes. Usually when I try pointing this out they act confused and explain to me that I'm misunderstanding their idea of freedom. "You know what, no adult can be trusted to be left alone in their own room for 24 hours, the official policy is to make regular inspections" turns into "the hotel has freedom to check on their guests, if you don't like it you're free to go to a different hotel (closest one is 10h drive away)"

devinegan11• 2 years ago

Check into a hotel room in Idaho and this won't happen. Check in to one of the hotels in the city who makes its money on tourism where the worst shooting in the US occurred and here we are. We are talking about 5 Miles of Las Vegas Blvd.

graemep3• 2 years ago

Some pretty bizzare things happen at UK airport security.

Our government is currently trying to use the recent riots as an excuse for even more surveillance and censorship.

The arguments include "the rioters used social media". That is one reason its going to be easy to catch them. They themselves were posting photos and videos - self-surveillance.

aeternum• 2 years ago

You sure you're allowed to post this? You better double-check with your department of censorship.

Remember that you're also free to open a hotel that doesn't have this policy and there's plenty of cheap land to be had very near Vegas. If you're right that this is something people want then it should be quite successful, maybe it can host the next DefCon. That's the American way to solve the problem.

Additional regulation generally yields less overall freedom.

mlyle3• 2 years ago

https://x.com/d0rkph0enix/status/1822814018643374260

The protocol for non-DefCon rooms:

* Housekeeping services the room.

* If housekeeping was unable to service the room, security will come take a look.

The protocol for DefCon rooms:

* Security comes and takes a look no matter what, and is, from reports, particularly invasive. E.g. asked to look for USB sticks as evidence of "hacking tools": https://x.com/d0rkph0enix/status/1822879409126162779

mikerg87• 2 years ago

So does this mean that housekeeping is conducting covert surveillance? Searching my personal effects? To whom do they report their findings ?

ryandrake2• 2 years ago

For those who don't want to follow a X link: Soldering irons, breadboards, USB sticks, and WiFi access points are called out as "hacking tools." What clowns!

leptons2• 2 years ago

The third protocol:

* Housekeeping is optional, and not preferred. Housekeeping never shows up. * Security is never seen once on any floor above the ground level.

This has been my experience in Las Vegas in 5 different hotel rooms in the same hotel this year. These were 3 to 4 day stays. If the stay is longer than that then maybe a visit from security is more likely, but I didn't see them at all in the afternoons, evenings, mornings, any time. There was a security guard at the elevators on 1 day out of all the days I stayed.

The "protocol" probably depends on the hotel, where it's located, the events going on around Las Vegas at the time, and probably what the budget for security is.

The reports of mandatory security coming from "locals" and others in the comments here seem pretty wild to me, and far outside of what I've experienced in Las Vegas in the last year.

mindslight2• 2 years ago

I don’t know why people expect privacy in Vegas

Because it's part of the United States, where personal freedoms are supposedly respected. Reading so many comments describing daily room searches at hotels as just the new normal state of affairs makes me sick. I hadn't been aware that the terrorizing mass media had ruined hotels even harder than they ruined air travel.

devinegan11• 2 years ago

The Las Vegas Strip and its hotel casinos are famously one of the most surveillance-heavy areas in the world due to the casinos ostensibly looking for casino cheaters but it goes way beyond that now in the name of "safety"

NoImmatureAdHom• 2 years ago

Yeah...this is nauseating.

singleshot_• 2 years ago

I'm fascinated by the juxtaposition of the idea that "what happens in Vegas stays in Vegas" and the assumption that your bedroom should be searched every 24 hours because of a policy.

kelnos14• 2 years ago

I don’t know why people expect privacy in Vegas

I expect privacy in any hotel room, regardless of where I am. Certainly not the same level of privacy I'd expect in my own home, whether purchased or rented. But daily security checks? No way, that's unreasonable. If I've put up the "do not disturb" sign, I expect no one to enter my room, at all, except in an emergency, or in a non-emergency where I'm present and have agreed to let someone in. That seems to me... entirely normal and reasonable to expect.

there are more cameras and technology watching you here than anywhere else in the US

What does that have to do with it? Just because casinos want to watch what's going on to prevent cheating (or just too-good play), that doesn't mean the hotel-room privacy situation should go to shit.

My last few trips to Vegas I stayed in Airbnbs; I guess I will continue doing that for the foreseeable future when I visit.

quantified• 2 years ago

Being aboveboard about the evil maid... this can be a new pwning vector for the conference.

bigiain2• 2 years ago

I wonder how many attendees social engineered their way into other people's rooms pretending to be room inspection goons?

(I wonder if the NSA collected a bunch of zero days by copying every usb drive their undercover operatives found in rooms while "employed" as hotel security?)

smegger0012• 2 years ago

wonder how many devices they lost to devices like usbkill trying to copy other peoples random usb drives at defcon

jedberg5• 2 years ago

Since the festival shooting Vegas hotels have a policy of entering every room every 24 hours. If you skip housekeeping, they get suspicious and then they send security to check on you.

Some clever hackers figured out how to use the phone system to make them think housekeeping had been there[0], so now they do inspections when BlackHat/DefCon is in town because they don't trust their own tracking systems.

[0] One of the hotels had housekeeping dial *5 on the room phone when they entered the room to clean, and then *5 again when they left. So some hackers would put out their "do not clean" sign and then just dial *5 twice 10 minutes apart so no one would get suspicious.

Shank3• 2 years ago

I think your post contradicts itself. It sounds like they "do inspections" every day of the year.

Since the festival shooting Vegas hotels have a policy of entering every room every 24 hours
so now they do inspections when BlackHat/DefCon is in town because they don't trust their own tracking systems

What's the difference between these two statements? It sounds to me like the only point is that they have a manual ledger to track inspections, which is probably for the best, given that any would-be domestic terrorist would surely know how to use Google and find this information too.

pathartl• 2 years ago

I think they mean that cleaning services will passively do inspections, but past cons have marked their rooms as being already cleaned in their system. They do manual inspections during Defcon because they can't rely that cleaning services have gotten to their room.

krisoft4• 2 years ago

What's the difference between these two statements?

One describes the policy. Which is what they want to achieve. They want to achieve that a hotel employee checks on every room every 24 hour.

The other describes that they don't trust their usual implementation during BlackHat/DefCon.

which is probably for the best, given that any would-be domestic terrorist would surely know how to use Google and find this information too.

The whole thing provides probabilistic protection anyway. (Also known as a security theatre, if you want to be uncharitable.) A determined attacker will appear as a model hotel guest up until the point they want to attack. Then they wait until housekeeping is done with their room and move their weapons in the room only after. Hotels are full of people moving luggage around at all hours so this won't be suspicious to anyone.

The policy will probably catch some would be attackers (the dumb ones). It will also probably uncover a lot more drug overdoses/suicides/murders/sudden heart attack victims, several days earlier than they would be uncovered otherwise.

I bet that for every Stephen Paddock found there is at least a hundred "oops this room has a dead person in it for some reason".

mlyle3• 2 years ago

https://x.com/d0rkph0enix/status/1822814018643374260

The protocol for non-DefCon rooms:

* Housekeeping services the room.

* If housekeeping was unable to service the room, security will come take a look.

The protocol for DefCon rooms:

* Security comes and takes a look no matter what, and is, from reports, particularly invasive.

FickleRaptor5• 2 years ago

This is has nothing to do with the behavior in question.

jedberg5• 2 years ago

Sure it does. The reason they do security sweeps is because they don't trust the attendees. Normally they mostly leave it up to the housekeepers. They only do sweeps when big conferences with known "tech nerds" are in town.

wannacboatmovie2• 2 years ago

Holy shit, there are hotels that still do housekeeping every day post COVID? Please name names, I want to stay there! Even better if there are ones that still do real room service where someone wheels a cart into your room, not leaving a bag at the foot of your door.

Last time I traveled the concierge looked at me as if I was some horrible person because I requested daily housekeeping, not this "on demand" nonsense which has sadly become pervasive.

canada_dry• 2 years ago

still do housekeeping every day

They don't change sheets or towels ("for the environment")... just inspect the room, then leave.

AndyMcConachie• 2 years ago

I travel 6-7 times a year and I think every hotel I stay at does daily housekeeping service. Only in the USA have I encountered them not doing it.

msadirna• 2 years ago

I have never seen a hotel which wouldn't do housekeeping every day.

Haven't been to the US though...where is the connection to COVID?

noddingham• 2 years ago

That's simply not true. I've stayed at PH, TI, and the Venetian over the last 3 years for conferences and personal travel, I pass on housekeeping the whole week, and there have been no security checks like you describe.

beacon294• 2 years ago

I also stayed at Planet Hollywood with no housekeeping, although I wasn't around during the day to determine if there was an inspection.

jedberg5• 2 years ago

How would you know, unless you were in the room the whole time?

sschueller• 2 years ago

So you used the same towels an entire week? How did you not run out of TP and soap?

I don't understand why you would not want them to clean your room as it's included in the price.

Yeul• 2 years ago

I'm white, blue eyed and speak without an accent but I do have friends of shall we say Mediterranean complexion who have run into problems with hotel security.

It's all in the small print too which nobody reads (these hotels have legal advisors).

lasereyes136• 2 years ago

They had that rule, every 24-hour room checks, for a few years after the Mandalay Bay mass shooting in 2017. Since Covid they removed that rule and don't do the room checks every 24 hours, unless, I guess, they really want to do it.

Room service counted as a room check so security only did it if you refused room service.

Shank3• 2 years ago

Why does DEF CON have to happen in Vegas? I can understand staying after Caesars Palace abruptly terminated their contract, but in future years, is there any real glue that keeps people there? I mean supposedly this is one of the most paranoid groups of people congregating in one place. Wanting hotel room privacy should be something that should be factored into the venue-search in-general, right?

Are there any huge advantages to staying in Vegas? Why not another city, perhaps with negotiated privacy for rooms at choice hotels?

zebomon• 2 years ago

Las Vegas has a uniquely scalable infrastructure for conventions. Lodging, restaurants, meeting spaces, entertainment.

0cf8612b2e1e• 2 years ago

Surely DEFCON has more limited attendance than any number more mainstream conferences.

Search results are saying that defcon sees some 30k people. The 2023 Chicago Auto Show had 300k. Major city with all the amenities.

https://www.chicagoautoshow.com/the-2023-chicago-auto-show-c...

HWR_14• 2 years ago

There are other US cities that can support a convention DefCon's size.

Historically, Vegas had a cost advantage. I don't know if that's still the case.

kelnos14• 2 years ago

I agree that it's probably the best situated for that, but most conferences don't need the best.

Let's look at San Francisco. A city that is not as well-suited for conventions as Las Vegas. Dreamforce (Salesforce's annual conference) draws 40,000 people. DEFCON drew 30,000 this year. DEFCON could easily be held in SF. I'm not suggesting they'd want to or should move to SF, but it would be... fine.

As someone who (very) occasionally goes to conferences, Vegas is fun! I get that. I enjoy Vegas, at least for a few days before I get sick of it. There are good restaurants and shows, and virtually no puritanical laws around alcohol consumption like you find in nearly all other places in the US. It's a 24/7 city, the only one in the US. I see the appeal. (And also get why many people dislike it, largely for the same reasons many people like it.)

But c'mon, there are plenty of other US cities that have the infrastructure to support a conference like DEFCON. Conference organizers pick Vegas because they like it, not because other cities can't support them.

njbooher• 2 years ago

BSides, BlackHat, and DEFCON happen yearly on the same week in August in Las Vegas, and many people attend more than one.

I would be happy if the location or date of all 3 changed. The peak temperature outside was around 110° all week this year.

FickleRaptor5• 2 years ago

The surface of the sun was booked.

Also, it’s always been in Vegas, so there’s inertia, and part of the draw is the attendance synergy with the rest of the hacker summer camp events like black hat, bsides, and others. There’s no good reason to change, and a lot of good reasons to stay.

monocasa• 2 years ago

Because August was historically Vegas's off-season, being a bajillion and a half degrees outside, and they could get a good deal on conference space.

jtriangle• 2 years ago

Vegas is a fantastic bang/buck proposition if you can stay away from gambling. It isn't that vegas has the absolute best of everything, it's that the average in vegas bests everyone else's mid-high end options.

Also understand that, the conference, no matter which conference mind, is half the draw, the other half is being in vegas itself. Move it elsewhere and it'll be much, much smaller for that reason alone.

wkat42425• 2 years ago

With all the lines at def con, is it really a bad thing to be smaller?

strictnein• 2 years ago

They've stated the reason: Vegas is the only true 24/7 city in the US.

Arainach• 2 years ago

You can get more things at more hours in NYC than Vegas.

Animats• 2 years ago

The gun crowd gets upset about this, too.[1]

[1] https://www.firearmsnews.com/editorial/2nd-amendment-nightma...

gorbachev• 2 years ago

Since these are apparently being done while people are out of their rooms, according to the article, what do they expect to find? Surely everyone planning on doing something malicious would leave their tools behind...

Also why aren't they targeting laptops? That's probably the #1 "hacking tool" in anyone's arsenal.

But, hey, I bet this looks great on a Powerpoint presentation to the board of directors.

michaelt5• 2 years ago

what do they expect to find?

Hopefully nothing!

But there was a 2017 mass shooting so they're looking out for travellers carrying fourteen AR-15 rifles, 1600 rounds of ammunition and 50 pounds of explosives.

IDK what the mentions of "hacking tools" are. But if I was running a hotel and I was hosting defcon, I'd give all staff refresher training on "don't plug in that USB stick you found dropped in the parking lot" and suchlike.

j-bos• 2 years ago

Weird how their was no clear motive for the shooter, has that changed?

151553• 2 years ago

AR-15 rifles, 1600 rounds of ammunition and 50 pounds of explosives.

All of which can be fit into a handful of suitcases that staff are not opening to inspect. 1600 rounds of ammunition is not very much.

bankcust083856• 2 years ago

The cargo culting demonization of arbitrary components, devices, and supplies by people who believe hacking is unlimitedly-powerful magic is laughable.

dreamcompiler• 2 years ago

Laptops will be next. And they will want to check the OS:

Linux=Evil Hacker.

Windows=Harmless Muggle.

Hope nobody tells them about WSL...

486sx333• 2 years ago

I think Mac OS is far more powerful than wsl …

FickleRaptor5• 2 years ago

I was walking through resortsworld when a security guard started walking next to us. After about 50 feet, he demanded our ID, informed us we were on private property, and threatened to have us arrested for trespassing, all in the same sentence. The issue was that my colleague was one of the amateur radio VE for the ham radio village and happened to have his handheld with him. The guard was aggressive, entitled, and arrogant.

Yesterday, I poked another friend to see where they were at the conference. They were not at the conference. They were stuck at resorts world three hours after the conference had started. Their conference badges had been confiscated by security. The security team had tried to force them to throw them in the garbage, and for a while it appeared that security had thrown them away after they had confiscated them. It’s literally just a fancy gameboy!

This isn’t a safety issue, it’s deliberate, malicious abuse by a vendor who knowingly sold a discounted room block to defcon conference attendees and then, through persistent and abusive behavior, tried to force those customers to leave once they checked in. The issue was mentioned early in closing ceremonies as something that will be addressed with the vendor once all conference attendees have been checked out of the hotels. This wasn’t random room check for caches of weapons. It was not a safety search. It was luggage contents searches for the lulz, seemingly intended as harassment. Either they didn’t want us there in the first place, or they wanted the revenue for the rooms forfeited. This was not behavior in good faith and the specific acts that I witnessed personally and others whom I trust communicated to me that they had experienced directly, could only be intended as harassment or profoundly extreme incompetence.

For 20 years, I’ve stayed almost exclusively at Hilton properties when I travel, with the exception of Vegas for HSC. I’m almost certain to switch to another company after this, unless they issue a really, really, excellent apology.

Quit your BS excuses about how this was a legitimate safety issue. This was almost entirely limited to one hotel. Somehow another 10+ major hotels, including Caesars who non-renewed the conference contract, managed to not do any of this.

Edited for spleling.

BonoboIO• 2 years ago

Unbelievable what the hotel is doing here, why would anyone stay there next time or in a hotel that is part of their company.

synack• 2 years ago

They won’t change their behavior unless it affects the bottom line. Time to lobby your corp travel departments to blacklist Hilton properties.

kmeisthax• 2 years ago

My understanding was that every hotel chain brand was basically a franchising operation. You'd probably want to look up the property owner and whoever was operating that specific hotel. They might own hotels of other brands which you'd want to boycott as well.

mapmeld2• 2 years ago

From other reports, it sounds like hotel security was trained about hackers carrying the Flipper Zero. Maybe they thought the badges were something like that?

bugtodiffer2• 2 years ago

If the Flipper is what you worry about at DEF CON, you really did not understand it.

Log_out_• 2 years ago

Annoying a bunch of black hats, there have to be easier ways to go out of buisness.

cameronsr• 2 years ago

For instances where security gets that egregious, you may want to consider not just complaining to the hotel. Especially where people have an incident well documented, it may be worth filing a complaint with the state licensing agency. In Nevada, private security personnel and agencies fall under jurisdiction of the Nevada Private Investigator's Licensing Board (PILB). As a heads up, their website is a bit of a kludge to navigate through.

davidmurphy• 2 years ago

Time to email exec team

https://www.elliott.org/company-contacts/hilton/

josephg• 2 years ago

Their conference badges had been confiscated by security. The security team had tried to force them to throw them in the garbage, and for a while it appeared that security had thrown them away after they had confiscated them.

I'd consider calling the police in a situation like this. "Officer, these men stole my conference pass, which I paid ($$) for, and they won't give it back."

cfcf14• 2 years ago

Police in large American cities are not likely to be of much assistance in this situation. Assuming they attend at all, I would expect them to not understand the nature of the issue and probably proceed to make it much worse.

01HNNWZ0MV43FF• 2 years ago

Then the cops will take some of your stuff, too

mdhb• 2 years ago

The irony here is that they have undoubtedly undermined their overall security posture in a meaningful way here.

Imagine singling out a group of people who previously had no ill will towards you for targeted harassment and that this exact same group of people also had the capability to fuck with you in unpredictable ways without getting caught.

This is literally the most fundamental 101 intel / LEO thinking of: means, motive and opportunity.

If I were them I’d be doing my best to make up for this starting with some serious apologies and firing whoever came up with this idiotic idea.

jcrawfordor• 2 years ago

Room inspections are nothing new in Las Vegas, being the norm at many on-strip properties since 2017. In that way, the article perhaps misses the point.

What was new this year were many reports of aggressive, confrontational behavior by security at Resorts World specifically. In particular, there are quite a few stories of Resorts World security staff actively escalating confrontations and of calling over armed colleagues over resistance as minor as asking to see ID. This kind of thing is extremely worrying from a licensed security force with armed members, and suggests a serious defect in the training and security leadership at Resorts World. The problem was not room checks per se, it was the incompetence the people doing the checks repeatedly demonstrated.

I think the press may have been reticent to level accusations at specific resort operators, but I hope journalists will put some pressure on Resorts World. Do they normally mount this type of response to high-risk events? Who planned their handling of DEFCON? Are their security staff trained in deescalation? What is their policy on when and how trespass threats should be issued?

The overall feeling was that the Resorts World security department was exceptionally unprofessional and, through their confrontational behavior, made this into far more of a scandal than it should ever have been. Caesars security, by contrast, is downright militarized, but seems to have been far better trained and more graceful in their handling of similar situations.

atlgator• 2 years ago

This sounds common for Vegas conventions. The same thing happens every year at Venetian/Palazzo during AWS:Reinvent. They come by 2-3 times during the week.

The excuse I got is that they are trying to prevent another Las Vegas shooter situation.

Ylpertnodi2• 2 years ago

Ahhhh....2nd and 4th amendments. As an EU people, I get it now...freedom. I guess I've been watching too many 1st Amendment auditors.

dghlsakjg• 2 years ago

The constitution doesn't apply to things that happen between private individuals. I don't have to allow guns in my hotel, hate speech in my newspaper, or have a warrant to search people as a condition of being on my property.

The solution, as always, is to vote with your wallet.

Havoc• 2 years ago

wtf are they hoping to achieve with inspections for thumb drives?

Find one with a convenient label on it that says Evil Plan?

seaourfreed• 2 years ago

Fight back: 1) Get video of everything 2) Try to get video of their in room search 3) Get names of the security people and upper management 4) Share facts on line 5) The find the legal entity's ownership. Find out who. Publish 6) Put videos online 7) Warn all hotels and conference companies of this vendor. 8) Look for intel links. It may cost them far more in security and lost of future revenue for any revenue they gain this week. This is likely not done for more revenue. Look for other reasons it is being done 9) Publish all. Have fun with it.

486sx333• 2 years ago

Probably the most fun is almost all on strip hotels have access to lots of Ethernet cables in your room… maybe the VoIP phone, maybe an access panel in the closet. Maybe nothing in my network for windows users but you can start digging into vlan’s pretty quick

glitchc• 2 years ago

Sounds DefCon has become an unpleasant conference to go to. Other conferences don't merit such scrutiny.

knallfrosch• 2 years ago

They could just meet elsewhere, in a different city. It's not that hard to book a hotel with a speaker podium.

Then again, you won't be able to gamble and get prostitutes elsewhere as easily..

kopirgan• 2 years ago

Remember this cartoon of some bloke standing at airport arrival hall with a placard "Mr.. bin Laden". That was before he was found.

He says seems as good idea as any.

Guess this too.

hartator• 2 years ago

Is DEF CON still requiring IDs to attend?

nickdurfe• 2 years ago

Defcon has never required IDs to attend. They were requiring negative Covid tests in 2021, but that is no longer required.

DaSHacka3• 2 years ago

Not true; DEF CON 29 required a valid COVID vaccine card with at least two vaccines listed, paired with an ID (most of us used our passports) to be given a little silver wristband before you got your badge.

and that year, the goons were searching for attendees without the silver wristband more closely than even attendees without a badge, they weren't joking around.

canjobear• 2 years ago

I don’t know much about Def Con but the drama coming out of this conference is really entertaining.

cbanek• 2 years ago

Here I remember my first DEFCON (6) at the Plaza Hotel. Someone literally started a road flare on some higher floor, then sent the flare down to the casino level in the elevator, filling the floor with smoke.

I feel like the attendees these days are much less dangerous, but these searches seem ridiculous and over the top compared to any past year I can remember.

bankcust083856• 2 years ago

DEF CON should just permanently move to somewhere awesome like Santa Fe NM or San Marcos TX.

bankcust083856• 2 years ago

Errata: Thinking on it, I vote against San Marcos TX because the city police department is unprofessional.

xg152• 2 years ago

Easy fix: Just co-schedule the hacker convention with a furry con, then the hotel staff will think twice before barging into rooms unannounced...

jack_riminton2• 2 years ago

I think the venn diagram of attendees is already overlapping quite a bit, that could be both good and bad

xg152• 2 years ago

Yeah, I figure 1/3 of the attendees would book both cons anyway.

jack_riminton2• 2 years ago

Is the hotel/franchise aiming to become a target of hackers? because that's the right way to go about it

Brett_Riverboat• 2 years ago

I was just here a few weeks ago for the pure storage conference and never saw a single security guard (unless they were plain clothes maybe?). The majority of the building was near empty on the convention floor besides the pure storage conference. My experience was very different and its weird for me to think only a few weeks apart they went from practically no security to police state tactics.

midnitewarrior• 2 years ago

So, they launch a mass Evil Maid attack against DEF CON convention attendees?

vonunov• 2 years ago

Lol, that statement from Resorts World reeks of ChatGPT. They don't even know why they're doing what they're doing. I'm not sure if they even know what they're trying to do.

Someone in management is trying to look like they're getting shit done.

Room inspections at Resorts World confuse, annoy DEF CON attendees

Related Stories