Hilton Honors Website Security - Accounts hacked Oct 2014
Oct 2, 14, 10:39 am
#32
Join Date: Dec 2002
Location: SMF
Programs: AA EXP 4MM
Posts: 800
Account temporarily closed by HHonors
My Hilton HHonors account was also hacked on 9/29/14, and over 200,000 points were used for a merchandise purchase. I contacted guest services and the points were quickly returned to my account. Unfortunately, they also said that the account information should stay the same, because that would help the fraud protection department track down the culprit. Against my own best judgement, I agreed. Two days later, another 230,000 points are missing from my account. Guess it's time to spend another hour on the phone with guest services!
Reading the last few posts it is clear that major HHonors account hacking is in progress.
Oct 2, 14, 11:29 am
#33
Join Date: Nov 2006
Location: Norway, Maine
Programs: United Silver and HH Diamond
Posts: 1,426
Why all the hate for the simple 4-digit pin? It's so much easier to remember one number for everything (including my ATM card) then all of these passwords that require lower case letters, capital letters, numbers, etc. I'll be happy when they can do retinal or finger print scans through my laptop.
Oct 2, 14, 11:38 am
#34
Join Date: Aug 2004
Programs: HHonors Diamond, SPG Gold
Posts: 135
same problem
My account was just hacked also...I logged in a few nights ago and noticed my account was missing some points (about 200k) but didnt see any transactions listed in account history so i thought maybe it was a glitch, logged in next day and couldnt login anymore...couldnt request password, etc. so i called hhonors help line they just said to email hilton loss prevention because my account was closed...Got an automated response saying in 7-10 days they will review my request...
What a pain in the ......Hilton obviously has some security issues...
I'm glad i wasnt trying to book a vacation right now, i'd be screwed probably....I'm hoping I get all my points and account back...The person on the hhonors help line didnt sound suprised at all, wondering if this is happening a ton
What a pain in the ......Hilton obviously has some security issues...
I'm glad i wasnt trying to book a vacation right now, i'd be screwed probably....I'm hoping I get all my points and account back...The person on the hhonors help line didnt sound suprised at all, wondering if this is happening a ton
Oct 2, 14, 11:38 am
#35
Join Date: Oct 2009
Location: ARN
Programs: SK EBG, BAEC Gold, LH FTL, FBP, CCG, HH Diamond
Posts: 1,533
Why all the hate for the simple 4-digit pin? It's so much easier to remember one number for everything (including my ATM card) then all of these passwords that require lower case letters, capital letters, numbers, etc. I'll be happy when they can do retinal or finger print scans through my laptop.
Because a four digit PIN number can be cracked in seconds. There are only 10000 combinations.
And passwords are not difficult if you do them right. It doesn't have to be a *random* combination, it can have meaning to you...
Oct 2, 14, 4:37 pm
#36
FlyerTalk Evangelist
Join Date: Jan 2005
Location: home = LAX
Posts: 25,779
I've seen other websites (certainly bank sites) where any attempt to log in incorrectly more than a few times resulted in a temporary lock-out. And that was even with passwords, not just 4-digit PINs.
But does the Hilton HHonors site have this security feature? Or does it let someone (or some "bot") endlessly try every PIN possible?
... However: Even if the system locks you out after trying to log into one account several times with the wrong PIN, it may not lock you out if you try to log into zillions of different accounts (one time each). And statistically, if you try 10000 accounts with the same 4-digit PIN, one of them is likely to have that 4-digit PIN. So perhaps that's how the hack is working, not by guessing PINs, but by picking a PIN and guessing the account numbers that use that PIN?
Last edited by sdsearch; Oct 2, 14 at 4:44 pm
Oct 2, 14, 4:46 pm
#37
FlyerTalk Evangelist
Join Date: Sep 2003
Location: HH Diamond, Marriott Gold, IHG Gold, Hyatt something
Posts: 32,877
And there 20 or so PIN numbers that are often picked by customers. You search these only, and you'd get 10-20% success.
(Hint, choosing 1111 for a pin is not a good idea!)
(Hint, choosing 1111 for a pin is not a good idea!)
Oct 2, 14, 8:58 pm
#40
A FlyerTalk Posting Legend
Join Date: Sep 2009
Location: Minneapolis: DL DM charter 2.3MM
Programs: A3*Gold, SPG Plat, HyattDiamond, MarriottPP, LHW exAccess, ICI, Raffles Amb, NW PE MM, TWA Gold MM
Posts: 100,080
Oct 2, 14, 10:37 pm
#41
Join Date: Jan 2009
Location: Singapore
Programs: HHonors Diamond; A3 *Nothing ; BA Exec. Club Gold
Posts: 1,611
This seems a quite significant breach,
I have changed my PIN just to be sure but thought it was better to switch to a username/password login which is less logical compared to using an account number can can be found easily.
Now I have a username and password I still see that I can login with my account number and (changed) pin that means now there are two ways into my account..
Not a great security protocol.
Globalist
I have changed my PIN just to be sure but thought it was better to switch to a username/password login which is less logical compared to using an account number can can be found easily.
Now I have a username and password I still see that I can login with my account number and (changed) pin that means now there are two ways into my account..
Not a great security protocol.
Globalist
Oct 3, 14, 12:22 am
#42
Join Date: Apr 2005
Posts: 522
This seems a quite significant breach,
I have changed my PIN just to be sure but thought it was better to switch to a username/password login which is less logical compared to using an account number can can be found easily.
Now I have a username and password I still see that I can login with my account number and (changed) pin that means now there are two ways into my account..
Not a great security protocol.
Globalist
I have changed my PIN just to be sure but thought it was better to switch to a username/password login which is less logical compared to using an account number can can be found easily.
Now I have a username and password I still see that I can login with my account number and (changed) pin that means now there are two ways into my account..
Not a great security protocol.
Globalist
And note that the thread (currently) ends with this post made on July 9, 2014 by the HHonorsRepresentative:
Oct 3, 14, 4:13 am
#43
Join Date: Apr 2005
Location: ATL
Posts: 794
My HHonors account was hacked on 9/28/14 and a large number of points were stolen. I discovered this on 9/29/14 and called and spoke to a Guest Services rep. I was given the phone number and order number for Maritz rewards and I was able to block the fulfillment of the fraudulent order. I will supposedly get the points back.
I asked the HHonors rep whether my account number should be changed (just as I would do if a credit card account was impaired). The rep did not think so but this doesn't really make sense to me. Of course changing the account number is a hassle because it is linked to credit cards, but still it would be more secure.
Anyone have any similar experience?
I asked the HHonors rep whether my account number should be changed (just as I would do if a credit card account was impaired). The rep did not think so but this doesn't really make sense to me. Of course changing the account number is a hassle because it is linked to credit cards, but still it would be more secure.
Anyone have any similar experience?
Oct 3, 14, 7:24 am
#44
Join Date: Nov 2013
Programs: HH Diamond, IHG Spire, Marriott Gold, AA Plat. Pro
Posts: 400
Based on all of these issues. I just changed my password and PIN last night. However, I'm wondering if their site isn't falling victim to the BASH Shellshock bug or another BASH vulnerability that was recently detected. Based on the fact that their web forms don't typically work all that well, I'd find it hard to believe they have all their ducks in a row on the security side as well. I would assume this vulnerability could be used to snag account numbers. From there it may just be a matter of brute force trying PIN numbers. However, I'm not a security guy...I'm a storage guy so that's a guess from me.
Moral of the story is change your PIN and password based on what's going on.
Moral of the story is change your PIN and password based on what's going on.
