From POS Systems to PMS to mapping the Attack Surface of a Modern Hotel

Walk through any hotel—whether it's an intimate 20-room boutique inn or a sprawling 2,000-room luxury resort—and you aren't just walking through a building. You are walking through a massive, interconnected network. Behind the marble lobby and the freshly fluffed pillows sits a complex mesh of digital systems. The terrifying part? Many of these systems were never designed with modern security in mind.

Before you can effectively defend a hotel, you have to look at it through the eyes of an attacker: as a map of doors. And every single door has a lock that can be picked.

Today, we are doing exactly that. We are mapping the true attack surface of a modern hotel, one system at a time.

What Exactly Is an "Attack Surface"?

In cybersecurity, an attack surface is every possible point where an unauthorized user could try to inject or extract data from your environment. An average household might have a handful of these points. A modern hotel has dozens—and unlike a highly restricted bank or corporate office, a hotel's "visitors" (your guests) are actively invited to plug their personal, often compromised devices into your network every single day.

Here is the full map of your property's vulnerabilities.

1. The Property Management System (PMS): The Crown Jewels

The PMS is the undisputed brain of your hotel. Reservations, guest profiles, payment records, room assignments, and staff logins—it all lives here.

• Why attackers love it: A single breach exposes the personal and financial data of every current, past, and future guest. The infamous Marriott/Starwood breach, which exposed the data of roughly 500 million guests, was ultimately a PMS-adjacent compromise.
• Common weaknesses:
  • Legacy versions of PMS software running unpatched on ancient Windows servers.
  • Shared or default administrator logins (yes, "admin/admin" is still found in real-world audits).
  • Remote access ports left wide open so vendors can "service" the system.
  • Forgotten integrations with booking engines and channel managers that haven't been reviewed since the day they were installed.

2. Point-of-Sale (POS) Systems: The Digital Cash Register Heist

Front desk terminals, restaurant and bar systems, the spa checkout—any place a guest swipes a card is a POS endpoint.

• Why attackers love it: Specialized POS malware scrapes card data directly from memory, quietly harvesting thousands of credit card numbers long before detection. Hotel POS environments are notoriously fragmented, combining different vendors and terminals onto networks that quietly bridge together.
• Common weaknesses:
  • Payment terminals running end-of-life operating systems (Windows XP still haunts hotel restaurants).
  • Flat, unsegmented networks where the bar's POS can talk directly to the guest Wi-Fi.
  • Low-tech physical skimming devices attached directly to terminals by rogue guests or staff.

3. Guest Wi-Fi: The Open Front Door

It is the one network every single guest expects to touch the moment they walk in.

• Why attackers love it: It’s the ultimate launchpad. Evil twin access points, ARP spoofing, credential phishing via fake captive portals, and pivoting from the guest network directly into back-office systems are classic hospitality attack patterns.
• Common weaknesses:
  • Guest Wi-Fi sharing a VLAN with internal back-office systems.
  • No client isolation, allowing guests (or attackers in the lobby) to scan each other's devices.
  • Shared WPA passwords conveniently printed on every key card holder.

4. The Booking Engine & Website: Your Public-Facing Perimeter

The reservation widget, the main hotel website, and the channel manager constantly syncing with Online Travel Agencies (OTAs).

• Why attackers love it: It is exposed to the entire internet 24/7 and handles highly sensitive payment data during checkout.
• Common weaknesses:
  • Web skimmers (Magecart-style malicious scripts) injected secretly into booking pages.
  • Unvalidated redirects in booking flows—a favorite tactic for phishing campaigns that mimic legitimate reservation confirmations.
  • Poorly secured APIs leaking reservation data through easily guessable booking IDs.

5. Door Locks & Smart Room Controls: The Silent IoT Risk

Mobile keys, RFID locks, in-room tablets, smart thermostats, connected TVs, and voice assistants.

• Why attackers love it: Physical access combined with connected hardware equals immediate compromise. Researchers have repeatedly demonstrated how to easily clone hotel key cards, hijack in-room tablets to spy on guests, or bypass network security entirely through a smart TV.
• Common weaknesses:
  • Lock controllers reachable from the internal network using default or hardcoded manufacturer credentials.
  • In-room devices that constantly phone home to third-party clouds that nobody is auditing.
  • "Shadow IT": You cannot secure what you don't know exists.

6. Back Office & Corporate Links: The Quiet Backdoor

HR systems, email, building management systems (HVAC, elevators, CCTV), and remote access for corporate staff.

• Why attackers love it: This is exactly where the devastating 2023 MGM Resorts attack began. A simple "vishing" (voice phishing) call to the IT help desk led to credential theft, allowing attackers to move laterally across an entire resort empire.
• Common weaknesses:
  • Lack of Multi-Factor Authentication (MFA) on email and remote access portals.
  • Flat corporate networks deeply interconnected with property-level networks.
  • Third-party vendors granted permanent remote access with zero monitoring.

Putting It All Together: The Attack Path

Here is how a real attack chains these doors together in the wild:

1. A phishing email is sent to a front desk employee, resulting in stolen PMS credentials.
2. The attacker uses those credentials to move laterally from the PMS server to the payment network.
3. POS malware is deployed on the restaurant terminal, harvesting card data for months in complete silence.
4. The attacker pivots again—this time moving to the corporate network via a site-to-site VPN.
5. Ransomware encrypts the PMS on a busy Friday afternoon. Check-in is forced to fall back to paper. The agonizing clock starts on the ransom decision.

Notice anything? No exotic zero-day exploits were required. Just an untrained employee, a flat network, and unpatched systems.

Securing the Map: Your Priority Checklist

You cannot fix everything overnight, so tackle it in this order:

• Segment the network: Guest, payment, PMS, IoT, and corporate systems must never share the same broadcast domain. This single, critical change breaks most attack chains at step one.
• Enforce MFA everywhere: Especially on email, PMS access, and remote vendor portals.
• Kill shared logins: Implement individual accounts, least privilege, and immediate revocation upon an employee's departure.
• Inventory every connected device: Yes, even the smart thermostat in room 412. Patch them or completely isolate them.
• Monitor relentlessly: Centralized logging turns a breach that would be discovered in ten months into one discovered in ten days.

The Takeaway

Defending a hotel requires more than just buying software; it requires a deep understanding of your property's unique digital footprint. Map your doors, change the locks, and make sure that when an attacker finally comes knocking, they realize they picked the wrong hotel.