The guests who pay the most for a room also hand the hotel network its most valuable traffic, and attackers have been studying that arithmetic for over a decade.
Why Attackers Book the Same Suites You Do
In November 2014, Kaspersky Lab published research on a group it named DarkHotel. Its operators had spent years inside the guest networks of luxury hotels in Asia, waiting for specific people to check in. The trigger was the login page. A guest typed a surname and room number, the network answered with a fake update for a familiar program, and the laptop installed it without complaint. The people on the receiving end were senior executives in manufacturing, pharmaceuticals, defense and investment.
Nobody picked those properties at random.
Three years later the method surfaced in Europe. In August 2017, FireEye attributed a campaign against hotels in at least seven European countries and one in the Middle East to APT28, a unit of Russian military intelligence. The group used EternalBlue, the exploit leaked from the NSA that spring, to spread through hotel systems, then harvested login credentials from guests who connected. High-end hospitality concentrates exactly the profile these groups want.
The Lobby Network, the Room Network, and the One Nobody Secures
Most upscale properties outsource guest internet to a specialist vendor, and the access model barely changes from one brand to the next. A captive portal asks for a last name and a room number, two details printed on luggage tags and repeated aloud at reception. Behind that page, many hotels place every guest on one shared segment. Client isolation, the setting that stops one device from seeing another, is a configuration choice that plenty of installations skip.
A phone joins the lobby network before a laptop leaves its sleeve, often silently, because it remembers the network name from a previous stay. Gizmodo’s travel ranking is built on that premise: its shortlist of the VPNs that hold up best for travelers was measured on two current handsets rather than a desk-bound laptop, a closer match to how the tool actually gets used on the road. The NSA’s July 2021 guidance on wireless devices in public settings reaches the same conclusion from the other side: it treats hotel Wi-Fi as public, full stop, and recommends routing traffic through a virtual private network.
A password on the network is not the reassurance it appears to be, either. In 2017, Mathy Vanhoef at KU Leuven disclosed KRACK, a set of flaws in the WPA2 standard itself that let an attacker within radio range decrypt traffic on supposedly protected networks. Patches followed, unevenly. And nothing prevents someone in the bar from broadcasting an access point called “Guest_WiFi_Premium” and waiting.
What an Encrypted Tunnel Changes at Check-In
Replay the DarkHotel scenario with a tunnel running. The hotel network now sees one encrypted stream heading to a single server. It cannot read the pages being requested, and it cannot slip a fake update into the response, because it never touches the content. That is the entire value proposition, and it is considerable.
It is also narrower than the marketing suggests. A travel VPN does nothing for the reservation database in the back office. Marriott disclosed in November 2018 that the Starwood reservation system had been compromised since 2014, a breach eventually counted at around 383 million guest records, including 5.25 million unencrypted passport numbers. The UK Information Commissioner’s Office fined the group £18.4 million in October 2020. No app on a guest’s phone would have changed a line of that.
Closer to the room, the limits are practical. A tunnel will not stop a guest from approving a malicious download. On a shared segment, a device can remain visible to its neighbors unless the app blocks local network access, an option most apps include and few users switch on.
Business travelers carry a second exposure that leisure guests rarely consider. Many corporate laptops already run an employer’s VPN, and IT departments often assume that covers the trip. It covers the laptop. The personal phone holding the same email account, the airline app and the banking login connects to the hotel network on its own terms, outside any corporate policy. For an executive traveling with a spouse, a family tablet and a smartwatch, the employer’s tunnel protects one device in five.
The “premium” internet tier sold at many resorts deserves a word here. It buys bandwidth. Nothing in it changes who else is on the network.
Habits for the Phone That Opens Your Door
The routines that matter are dull, which is why they get skipped. Turn off auto-join for hotel networks and delete them at checkout, so the phone does not reconnect to a lookalike name at the next property. Set the VPN to connect automatically on untrusted networks and enable its kill switch, which cuts traffic the moment the tunnel drops. Treat any update prompt that appears on a captive portal as hostile, every time.
For banking, or anything involving a passport scan, the phone’s own mobile hotspot beats the hotel network outright. And the in-room smart TV that invites guests to cast their streaming accounts keeps those sessions logged in long after the car to the airport has left. Sign out before checkout. The same applies to the hotel business center, whose shared desktop keeps browser sessions and downloaded boarding passes for whoever sits down next.
The larger shift is already happening at the front desk. Digital keys, app-based check-in and loyalty wallets mean the phone now carries the room key alongside passport details and payment cards. A 2019 analysis by Zimperium found that every iOS travel app it examined failed its security grade, along with 29 of the 30 Android apps. For years the network was the weak link between a guest and the hotel. Increasingly, it is the hotel’s own app.
Which makes the lobby Wi-Fi the first stranger a very valuable device meets, and rarely the last.
