Hilton Awards Program Flaw Exposed All Accounts

Hilton Awards Program Flaw Exposed All Accounts

A recent offer from the Hilton HHonors program to give members 1,000 free points for agreeing to change their passwords led to the discovery of a flaw in the site that could let anyone hijack a Hilton Honors account simply by guessing the 9-digit account number.

Brandon Potter and JB Snyder of the security firm Bancsec discovered the flaw once they realized they could steal other accounts by knowing the account number. It only took a small amount of changes to the HTML content.

Once inside the accounts, a hacker could change the password, view past and upcoming travel, redeem points for travel and hotel reservations, and even have points sent as cash or prepaid cards to another account.

“Hilton Worldwide recently confirmed a vulnerability on a section of our Hilton HHonors website, and we took immediate action to remediate the vulnerability,” Hilton wrote in an emailed statement. “As always, we encourage Hilton HHonors members to review their accounts and update their online passwords regularly as a precaution. Hilton Worldwide takes information security very seriously and we are committed to safeguarding our guests’ personal information.”

Snyder attributes the flaw to a web application weakness called a cross-site request forgery (CSRF), which is when an attack occurs on a user’s computer causing the web browser to perform unwanted actions on a trusted site.

This flaw not only exposed account information related to Hilton, but personal information as well, such as email and physical addresses and the last four digits of any credit card on file.

“If they have so much personal information on people, they should be required to do Web application testing before publishing changes to the internet,” Snyder said. “Especially if they have millions of users like I’m sure they do.”

About the Author

Matt Holden is an Associate Content Editor for 1105 Media, Inc. He received his MFA and BA in journalism from Ball State University in Muncie, Indiana. He currently writes and edits for Occupational Health & Safety magazine, and Security Today.


Featured Cybersecurity


New Products

  • ALTO Neoxx Electronic Padlock

    ALTO Neoxx Electronic Padlock

    Built to withstand all access control needs, the tough new SALTO Neoxx electronic padlock takes security beyond your expectations. 3

  • ComNet CNGE6FX2TX4PoE

    The ComNet cost-efficient CNGE6FX2TX4PoE is a six-port switch that offers four Gbps TX ports that support the IEEE802.3at standard and provide up to 30 watts of PoE to PDs. It also has a dedicated FX/TX combination port as well as a single FX SFP to act as an additional port or an uplink port, giving the user additional options in managing network traffic. The CNGE6FX2TX4PoE is designed for use in unconditioned environments and typically used in perimeter surveillance. 3

  • LiftMaster Garage Door Opener

    LiftMaster Garage Door Opener

    LiftMaster Transforms the Garage Door Opener Into a Sleek Smart Home Device That Does More Than Open and Close the Garage Door 3