Airbnb Superhost’s creepy spycam sniffed out by sleuthing infosec pro

An Airbnb Superhost in China who got Supercreepy with a hidden camera tucked inside a router got Superimprisoned for 20 days after a guest pulled out Superinfosec savvy and spotted the weirdly wired device.

The South China Morning Post reports that the guest, known by her online alias of Yunfei, told Beijing Youth Daily that she works in information security and, like so many righteously paranoid technophiles who stay in hotels and Airbnb listings, went about her typical routine of looking for spying apparatus when she checked in to the rental in Eastern China last week.

In Airbnb land, a Superhost is an exemplar of all that is righteous and noble in short-term hosting: we (I am one!) don’t cancel guest reservations and leave them stuck on the tarmac without a place to rest their weary bones, we answer questions quickly so as not to leave them confounded, and we get ratings that average 4.8 stars or above. In return for what one would hope is also moral rectitude and an utter lack of filming guests while they do what humans do behind closed doors, our listings get a boost in search results, and we get sweet benefits like travel credits or professional photography.

This peeping Tom of a so-called Superhost that got busted ain’t that. This host installed multiple motion detectors – one at the apartment’s entrance, and two in the two bedrooms. Weird, given that his listing, in Qingdao in Shandong province, wasn’t exactly a showcase for smart-home technology, Yunfei said:

[The motion sensor monitors were] … odd, since the flat had not been renovated for smart-home automation.

Given that she works in internet and information security, she said she’s in the habit of always checking her hotel rooms. First, she turned the sensors to face the wall and covered them with stickers. Next, she checked the smoke detectors and the TV, into which tiny spy cameras are often tucked. She also cut the power to the TV.

Then, she had a look at that router, which faced a bed. Yunfei said she noticed a light that didn’t look right, and she suspected it might be a hidden webcam.

I checked it carefully and found the line arrangement was different from the usual ones.

Sure enough, the router looked different from a photo of the product. When she took it apart, she found a digital memory card inside.

Upon finding the memory card, Yunfei immediately called the police. They came and grabbed the equipment. She had booked the place for three nights, at a cost of 1,700 yuan (USD $250), but she left and didn’t return. She hadn’t met her host, communicating solely online with him about check-in and a Wi-Fi password.

A spokesman for Airbnb told Beijing Youth Daily that they sincerely apologized to the woman, refunded her money, and yanked the host’s listing. Police later confirmed that they had arrested the host and given him a 20-day jail term.

Nothing like an infosec bod to ruin your fun filmy fantasy

So many hotel rooms and Airbnb flats, so many creeps with webcams hidden in light sockets and coat hooks and who knows where else, so much fun when somebody with an Nmap network scanner checks in!

That’s what happened in Ireland, where New Zealand infosec consultant Andrew Barker checked in to an Airbnb with his family. Barker, who routinely runs scans of networks when they check into lodgings and sign on to the Wi-Fi networks, hit the jackpot when he found a camera camouflaged to look like a smoke alarm.

(Watch directly on YouTube if the video won’t play here.)

His wife, Nealie Barker, wrote up their experiences in a Facebook post last month. She said at the time that it took 33 days and 10 more unsuspecting guests staying in the property (she knows because at least some of those guests contacted her) before Airbnb told her that it had removed the listing and the host.

In fact, Airbnb didn’t take action to permanently ban the host until after Nealie posted about the incident and local New Zealand news stations reported about her family’s experience.

Andrew Barker went on to write this very helpful blog post about increasing your chances of finding a hidden camera.

He explains how to thoroughly vet an Airbnb listing to see if it mentions cameras anywhere. There’s no specific field for disclosing it, he noted, so you have to comb through the listing to see if a camera is mentioned anywhere. Alternatively, if a camera shows up in any of the listing’s photos, then Airbnb considers that ample notification. If a listing makes no mention of a cam, nor includes any photo of one, then it hasn’t been disclosed, and you can get a host in hot water if you find one on the premises.

Network scanners don’t always uncover these webcams. As Barker notes, if a camera is hidden well and isn’t on the same Wi-Fi that a host has granted access to—i.e. if it’s recording to an internal memory card—or is on a network that you don’t have access to, it may be very difficult to identify.

There are other ways to spot a hidden webcam, which we’ve covered in the past. But however you find it, once you find here, here’s what to do:

What to do if you detect an undisclosed camera

Yes, this is yet another cut and paste of the same advice we give every time somebody finds one of these creepster’s spycams. But this is a new and improved version: this time, after considering a good amount of reader input, we decided that you all are correct: putting your clothes on should indeed be a priority!

1. Get your clothes on.
2. Take photos of the device for evidence.
3. Take photos of your accommodation so you can prove that you haven’t trashed the place: some hosts have reportedly made such false accusations.
4. Get out of there.
5. Report it to police. You want to stop that stream before other people get swept up in it.
6. If you’re in an Airbnb rental, report it to Airbnb, along with your evidence, before it happens to another victim.