Hello world, booking.com is a website where you can book hotels, flights, flights and
hotels and so on, it’s one of the most popular sites on the interwebs for booking trips.
However some interesting new revelations and more importantly allegations have been made
public in a new book titled “The Machine, under the spell of booking.com”.
The book details how in 2016 an employee of the website stumbled across an unauthorised
intrusion, an unknown individual had gained access to the booking system through a poorly
secured server. “The breach involved names of Booking customers and their travel plans.”
- which at first might sound like an odd target, why would anyone care about the holiday plans
of random people. Well, intelligence services have a vibrant history of targeting travel
companies, but more on why in a bit. The data breach was internally named the “PIN-leak”
due to reservation pins also being stolen by the intruders.
After 2 whole months of analysis, which included hiring private investigators and even the
help of the dutch intelligence service, the “AIVD” - because the website is based
in the Netherlands - a peculiar discovery was made. The hack was attributed to an individual
who’s only being identified as “Andrew”, it was determined that this “Andrew” is
an American who worked for a company which carries out operations on behalf of US intelligence
services - which intelligence service, well you’re going to have to guess, there’s
18 or so of them. This is all we know about “Andrew”. However, I can’t help but
feel like something isn’t right about all of this, for “Andrew’s” true identity
to be exposed he must have been a pretty awful spy. Or maybe not a spy at all, I’ve seen
criticism levied that the vagueness of the claims and the fact that absolutely no evidence
has been provided points to the possibility that this story is being pumped up by the
Authors to get publicity for their new book, to be honest it’s a fair criticism. Books
don’t typically make much money and you’ve got 3 Authors here splitting the cash, and
as I understand it the book isn’t wholly about the hack, but rather about the rise
of booking.com as a company and all the drama associated with that. But then again intelligence
agencies do love hacking travel companies… we’ll get to why momentarily.
But one of the other areas of controversy surrounding all of this is that booking.com
made the decision to keep the intrusion a secret, not even informing their customers
that by the way, your holiday plans are probably in the hands of the NSA or something like
that. However, given this took place before GDPR was even a thing the laws surrounding
disclosure were a little more murky. “Under privacy laws applicable at the time, a company
was required to notify affected persons of data theft when the breach in question „would
likely have adverse effects on the private lives of individuals.” Now obviously this
is a very debatable standard and open to interpretation - though I don’t know about you but potentially
becoming the target of a US intelligence spying operation sounds like it falls under this
category, but what would I know...
However the question of why even hack a travel company remains. Travel companies hold information
on who will be where and when, if their databases can be successfully hacked you can potentially
catch targets outside of their natural habitat, bug their rooms, follow them around, etcetera.
These could be people on terrorist watch lists, foreign officials, diplomats or even influential
businesspeople. In fact in 2013 documents leaked by Edward Snowden revealed a top secret
operation helmed by UK spying agency GCHQ which focused on monitoring the hotel bookings
of foreign officials all over the world. The operation was titled “royal concierge”,
and leaked powerpoint slides show it even had a logo, a little penguin wearing a crown,
cape and holding a sceptre. How cool is that?
Anyway, only a couple of powerpoint slides were leaked by Snowden, so the technical details
of exactly how this operation worked aren’t public. However we do know that GCQH had some
kind of system in place to monitor reservations made using email addresses that ended in .gov
- an extension typically used by diplomats. From partially redacted logs you can see hotels
in Zurich, Singapore, Hong Kong and even the UAE were targeted. The aim here, to gather
information for what’s described in the document as “human intelligence and close
access technical operations”, in other words, operatives on the ground could bug and surveil
targets. In response to the leaks, GCHQ said that it "neither confirms nor denies the allegation."
Leave a comment below, do you think the booking.com hack went down as the whistleblowers claim?
Or does this whole story just sound like some kind of a marketing ploy for their new book?
I’m a little torn, it’s very believable US intelligence had a hand in this, but the
lack of any evidence or specificity doesn’t help the story.
Big thankyou to roboform for sponsoring this video. I personally use and recommend their
password manager, and it’s currently 50% off for this month only. Roboform keeps your
passwords encrypted until you need them and notifies you if any of your passwords have
been included in a data breach helping you stay secure. Roboform is one of the og-est
password managers, they’ve been around since the 90’s.
Use the link in the description to grab an annual subscription for just $12, and there’s
a 30 day refund policy if you aren’t happy with roboform for any reason.
If you enjoy this kind of video make sure to help me out by fondling the like button
for the youtube AI as well as turning on those sub notifications.
If you want to see what goes on behind the scenes make sure to follow me on the instagrams,
I’m @jhonti I will of course link it in the description.
And if you’re looking for something to watch next go check out my previous video on how
banking malware is using ancient encryption to fool antivirus scanners.
As always sources will be linked in the video description, stay tuned for more hacking videos,
and have a good one.