Every wireless access point in a building is, by design, a little radio beacon. Many times a second it announces itself to everyone in range — its network name, what kind of security it uses, what hardware it’s running on. That’s not a flaw; it’s how WiFi has to work, so your phone can find networks to join. But it means that long before anyone types a password, a WiFi network is already telling the whole room a surprising amount about itself.
On a recent stay at a mid-sized city-centre hotel, we listened to what a property’s access points were saying — and only that. No hacking. No accessing anyone else’s device. No breaking into anything. We connected to the open guest network like any other paying guest, and otherwise did nothing an ordinary phone in the lobby doesn’t already do: receive the public signals filling the air. What that alone revealed is worth every hotel operator’s attention.
The rules we set before we started
This matters, so it goes first. A security assessment is defined as much by what you refuse to do as by what you do.
Everything described here came from one of two sources: the wireless beacon frames the hotel’s access points broadcast publicly to everyone in radio range, or standard read-only diagnostics on the single guest network we were authorised to use. We did not connect to the staff, payment, or management networks. We did not probe another guest’s device. We did not capture passwords or attempt to crack anything. We did not scan the network for hosts.
Why so careful? Partly because it’s the right way to work. Partly because in most countries unauthorised access to a computer network is a criminal offence, full stop — good intentions are not a defence. Any deeper testing — the kind that would definitively answer some of the questions below — only ever happens with a client’s written authorisation and an agreed scope. If a security firm isn’t explicit about that boundary, that’s a red flag in itself.
So everything that follows was, in effect, being announced to the room. We just paid attention.
What the air was saying
Within a few minutes, the networks broadcasting from the property painted a clear picture. Names have been changed, but the shape of what we saw is exactly as found.
A payment network, broadcasting by name. Among the networks on the air was one whose name made its purpose obvious — the card-payment network. It was secured with a shared password, the same kind of setup a home uses for its WiFi. Now, a network being visible isn’t itself a breach; every secured network is visible. But a payment environment announcing itself by name, on a shared key, is the security equivalent of a shop labelling which drawer holds the cash. If that network carries actual cardholder data, it sits squarely inside the hotel’s PCI-DSS obligations — and “discoverable by name on a shared password” is not where you want that conversation to start.
Two management networks, also named in plain sight. The systems that run the building — the admin side — were likewise broadcasting under obvious names on shared keys. Worse, they weren’t all coming from the same equipment. Most of the hotel’s networks were clearly part of one managed, modern WiFi system. But a couple were coming from a separate, older, standalone access point that didn’t match the rest — the digital equivalent of a spare router someone plugged in years ago and forgot. That kind of unmanaged, unremembered device is very often the way in: nobody’s patching it, nobody’s watching it, and it may quietly bridge to things it shouldn’t.
Open, unencrypted guest WiFi. The guest network — the one we were using — had no encryption at all. Convenient, and extremely common in hospitality. It also means anything a guest sends over a connection that isn’t itself encrypted (a plain http:// site, an old app) can be read over the air by anyone nearby. When something goes wrong on guest WiFi, it’s the hotel’s name in the headline, not the guest’s.
Predictable names that invite impersonation. Because the networks were named so recognisably, it would be trivial for someone to set up a fake network with the same name — an “evil twin” — that guests’ devices would happily connect to, handing whatever they type straight to the attacker. This attack is over twenty years old and still works, because it relies on trust in a name, not on any clever exploit.
Ageing wireless security. The networks used WPA2 rather than the newer WPA3, and showed no sign of the protections (like management-frame protection) that blunt common wireless attacks. Not a crisis on its own, but part of a pattern.
The finding we didn’t claim
Here’s the part most write-ups leave out, and the part that should make you trust the rest more.
Early on, one diagnostic seemed to suggest hundreds of guest devices were visible to us — which would have meant the network let guests see and reach each other, a real problem. We looked closer. It turned out to be an artefact of how a laptop’s own network housekeeping works, not evidence of anything about the hotel. So we retracted it. Whether the guest network actually keeps guests isolated from one another is a genuinely open question — and answering it properly needs active, on-site testing that we’d only do with written permission.
We’re telling you this deliberately. Plenty of “we found X” security stories are really “we assumed X”. The honest version distinguishes what was observed from what was inferred from what still needs checking — and doesn’t inflate the scary number to make a better story. If a report doesn’t draw those lines, be sceptical of it.
Why this is a hospitality problem specifically
None of this means the hotel was careless. It means the hotel is normal. This is roughly what almost any hotel’s WiFi is quietly broadcasting, and almost nobody is listening on the business’s behalf.
Hotels carry a security load most businesses simply don’t:
- A constant churn of unknown guest devices, every day.
- Card payments, and the PCI-DSS obligations that ride along with them.
- Property-management and point-of-sale systems that must never share a network with guests.
- A growing estate of connected devices — door locks, smart TVs, thermostats, CCTV — each a potential foothold.
- A brand where a single “hotel WiFi hacked” story does damage that outlasts any technical fix.
And underneath it all, a WiFi setup that was very often installed once, signed off once, and never independently reviewed since.
The same story, a week later, at an airport
Lest this seem like one unlucky hotel, here’s the same pattern from a completely different setting. Waiting for a flight at a major UK airport, we connected to the open passenger WiFi — again, as any traveller would — and looked at nothing beyond what our own laptop could see about its own connection. We did not scan the network or touch another device; the boundary set out at the top of this piece applied unchanged.
The connection told the same story hospitality does:
- Open authentication, no encryption. The network used open authentication with no cipher — fully unencrypted over the air, exactly like the hotel’s guest WiFi. Every unencrypted request a passenger makes is readable by anyone in range with a wireless card.
- One large, flat network. Our laptop was handed an address on a segment sized to hold several hundred devices, all sharing the same space. Whether those devices are walled off from one another is, once again, a question that needs authorised testing to answer — but the size of the shared segment is plainly observable, and it’s large.
- An unfamiliar name-lookup service. Every website name our device tried to resolve was being sent to a third-party DNS resolver we didn’t recognise, rather than one of the mainstream ones. On an untrusted network, that quietly hands your browsing metadata to a party you have no relationship with.
The lesson isn’t that this airport is careless either. It’s that “large public venue, open WiFi, one flat network, whatever name-lookup service the operator chose” is simply the default across hospitality and travel — and almost nobody using it is thinking about any of this. Tellingly, the one safeguard entirely within a traveller’s own control — a VPN — was the very thing our own laptop didn’t have switched on when we first looked. If the people who do this for a living can forget it, so can everyone else on that concourse.
What a hotel can actually do
The reassuring part is that the fixes are well understood:
- Stop advertising sensitive networks. Payment and management networks shouldn’t be broadcasting recognisable names on shared passwords. Hide them, move them to certificate-based access, or get them off WiFi entirely and onto isolated wired connections.
- Find and account for every access point. The old, forgotten device is the one that gets you. Know what’s on your property and who manages it.
- Separate your networks properly. Guests, staff, payments and IoT devices each belong on their own segment, firewalled from the others, so a problem in one can’t spread to all.
- Modernise the wireless security. WPA3 and protected management frames where the hardware supports it; turn on the controller’s rogue-network and evil-twin detection.
- Validate, don’t assume. Whether guest isolation and segmentation are actually enforced is a question to test, with authorisation — not to hope about.
- Keep watching. A one-off assessment is a snapshot. New devices appear, configurations drift. Continuous monitoring is what turns “secure last spring” into “secure now”.
The uncomfortable takeaway
The striking thing about all of this is how little it took. No special access, no exotic tools, no laws bent — just attention to signals the building was already sending to everyone in it. If a curious guest with a laptop can see this much in a few minutes, so can anyone with worse intentions and a bit more patience.
That’s exactly why it’s worth having someone look on your behalf, deliberately and ethically, before someone else does it for their own reasons. If you run a hotel and you’ve never had your wireless independently assessed, that’s the gap worth closing — and closing it starts with nothing more disruptive than listening.