Connect with us

The Online Technology

Airbnb Superhost’s creepy spycam sniffed out by sleuthing infosec pro – Naked Security

Security Watch

Airbnb Superhost’s creepy spycam sniffed out by sleuthing infosec pro – Naked Security


An Airbnb Superhost in China who got Supercreepy with a hidden camera tucked inside a router got Superimprisoned for 20 days after a guest pulled out Superinfosec savvy and spotted the weirdly wired device.

The South China Morning Post reports that the guest, known by her online alias of Yunfei, told Beijing Youth Daily that she works in information security and, like so many righteously paranoid technophiles who stay in hotels and Airbnb listings, went about her typical routine of looking for spying apparatus when she checked in to the rental in Eastern China last week.

In Airbnb land, a Superhost is an exemplar of all that is righteous and noble in short-term hosting: we (I am one!) don’t cancel guest reservations and leave them stuck on the tarmac without a place to rest their weary bones, we answer questions quickly so as not to leave them confounded, and we get ratings that average 4.8 stars or above. In return for what one would hope is also moral rectitude and an utter lack of filming guests while they do what humans do behind closed doors, our listings get a boost in search results, and we get sweet benefits like travel credits or professional photography.

This peeping Tom of a so-called Superhost that got busted ain’t that. This host installed multiple motion detectors – one at the apartment’s entrance, and two in the two bedrooms. Weird, given that his listing, in Qingdao in Shandong province, wasn’t exactly a showcase for smart-home technology, Yunfei said:

[The motion sensor monitors were] … odd, since the flat had not been renovated for smart-home automation.

Given that she works in internet and information security, she said she’s in the habit of always checking her hotel rooms. First, she turned the sensors to face the wall and covered them with stickers. Next, she checked the smoke detectors and the TV, into which tiny spy cameras are often tucked. She also cut the power to the TV.

Then, she had a look at that router, which faced a bed. Yunfei said she noticed a light that didn’t look right, and she suspected it might be a hidden webcam.

I checked it carefully and found the line arrangement was different from the usual ones.

Sure enough, the router looked different from a photo of the product. When she took it apart, she found a digital memory card inside.

Upon finding the memory card, Yunfei immediately called the police. They came and grabbed the equipment. She had booked the place for three nights, at a cost of 1,700 yuan (USD $250), but she left and didn’t return. She hadn’t met her host, communicating solely online with him about check-in and a Wi-Fi password.

Real Life. Real News. Real Voices

Help us tell more of the stories that matter

Become a founding member

A spokesman for Airbnb told Beijing Youth Daily that they sincerely apologized to the woman, refunded her money, and yanked the host’s listing. Police later confirmed that they had arrested the host and given him a 20-day jail term.

Nothing like an infosec bod to ruin your fun filmy fantasy

So many hotel rooms and Airbnb flats, so many creeps with webcams hidden in light sockets and coat hooks and who knows where else, so much fun when somebody with an Nmap network scanner checks in!

That’s what happened in Ireland, where New Zealand infosec consultant Andrew Barker checked in to an Airbnb with his family. Barker, who routinely runs scans of networks when they check into lodgings and sign on to the Wi-Fi networks, hit the jackpot when he found a camera camouflaged to look like a smoke alarm.

His wife, Nealie Barker, wrote up their experiences in a Facebook post last month. She said at the time that it took 33 days and 10 more unsuspecting guests staying in the property (she knows because at least some of those guests contacted her) before Airbnb told her that it had removed the listing and the host.