Should we have Hotel Security Concerns?

Question

Key employee will be out of office performing highly confidential
negoiations and we have security concerns. His hotel has a landline
with free local calls and high speed wireless internet.

Regarding the phone, how safe is it to make calls thru hotel phone?
How can someone intercept,switchboard? Have a cell phone but number
and carrier is known. With this info we are told that eavesdropping
can occur with equipment located within 100 feet of phone. Could we
change the number to block this or would carrier be enough to capture
conversations? Suggestions?

High speed wireless-We have Ghostsurf to use an encrypted proxy but we
do not know exactly how this works. If someone is watching from the
hotels node could they capture data? Or will the wireless aspect be
the biggest security hole. Suggestions? Use landline phone and go
back to 56k speed?

Thanks for the help!

Answer 1

???? Are you worried about the US government?
otherwise it is pretty safe!

Answer 2

Generally it's quite safe to make calls through the hotel phone systems. Most modern systems are automatic PBX systems; the hotel staff do not have access to monitor calls in progress but a technician with admin access to the PBX could listen in, as could anyone in the phone room where the room lines are punched down on the patch panels. You have the law on your side on this, though, as intercepting phone calls without a warrant is highly illegal. BUT, do keep in mind that phone calls may traverse any of a number of media between the hotel and the office, especially if they're long distance. Although most run through fiber optic lines these days, there are still many old microwave links in existance that can theoretically be intercepted.

Cell phones are generally secure. But beware, some CDMA/TDMA phones have analog capability and if the phone is paired with an analog tower the signal CAN be intercepted easily. It's illegal, but virtually undetectable. GSM and iDen phones use digital signalling that is very secure. If your phones use a SIM card they're secure enough for all but the most sensitive national security issues.

The wireless internet is a security hole wide enough to fly a squadron of B-52s through -- with a mile between the wingtips. Anything that goes out on the wireless that isn't encrypted end-to-end can be sniffed from anywhere within the hotel and probably out into the parking lot. I'd strongly recommend a VPN connection back to your office.

If you have a tier-1 firewall at your office (Cisco, Checkpoint, etc.) then this is pretty easy for your IT staff to implement. If you're relying on a SOHO firewall (Linksys, etc.) now is the time to upgrade to a Cisco PIX or similar that supports VPNs. With a VPN connection, an interloper will get uncrackable gibberish.

If your employee will only need e-mail acces and if you have a secure web server to provide remote e-mail access then you won't need to worry about the wireless as the sessions will be encrypted end-to-end. If you're not sure about this, then assume that you don't have this type of system and go with the VPN.

I haven't worked with GhostSurf and therefore can't comment on it. In general most of those products do a decent job of protecting web surfing but don't encrypt e-mail sessions at all. Their real value lies in that they hide your true IP address and identity from the sites that you visit. That's probably not sufficient for what you are asking.

Answer 3

As long as you have to use a service provider for your service, you are at risk of being monitor and eardrops on.

The most secure is to have your own frequency and transmitting with your own SW and encryption. That is not as easy for general public to spy on but yet, if there is a will, there is a way.

Another way is to send password protected/encrypted documents. That will be more safer but still it is still hackerable.

Overall, your privacy and your security of your information is upon the credability and the integrity of the places where you stay. But that does not means there won't be some crazy IT people trying to get information out of you anyhow.

Answer 4

Encrypted email is probably the most secure form of communication. For the information to be intercepted they need to both capture the packets and break the encryption.