Sticky-note security turned gym into hall of '80s horrors
- Reference: 1775721608
- News link: https://www.theregister.co.uk/2026/04/09/pwned/
- Source link:
Our story this week comes from someone we will Regomize as JC, a proprietor of a company that sells and installs used gym equipment. He had a contract with a hotel to install some cardio equipment with video screens, designed to let exercisers watch Netflix over the LAN.
However, one of JC's employees left the default admin PIN for the equipment on a Post-it note attached to one of the treadmills. This allowed a hotel guest to log into the control panel and queue up '80s music videos. We have no idea what songs the troublesome traveler chose, but we have to imagine that Olivia Newton-John's "Physical" was first on the playlist.
[1]
Hearing the sounds coming from the gym, the staff at the hotel front desk wondered if their gym was haunted. However, they eventually learned that someone had left YouTube playing rather than logging into Netflix. Fortunately, the "attacker" didn't do any real damage, but if someone more enterprising had gained control of these machines, they could have potentially used them for command-and-control attacks.
[2]Showing the Windows 10 desktop was the yeast they could do
[3]Windows asks a networking question on a Stratford billboard
[4]When a billboard survives the wind, but not the boot
[5]To BSOD or not to BSOD? Only Microsoft knows the answer
For his part, JC said that he has taken the incident as a learning opportunity. Now his team isolates all consoles on a guest VLAN, changes the default passwords, and even disables USB ports on fitness equipment. They patch the consoles during burn-in and even lock network plates so no one can pull the Ethernet cables out and attach their own devices to the LAN.
Merritt Maxim, VP and research director at Forrester Research, said he would also restrict outgoing access at the firewall level so that the gym machines could only send and receive data from Netflix. Otherwise, hackers who gained access to the fitness machines could cause a lot more damage.
[6]
Last week, we talked about a [7]coffee maker that became the threat surface for a company. This situation is not much different, with both stories showing how important it is to lock down connected devices, no matter how little they resemble a computer.
Have a story about someone leaving a gaping hole in their network? Share it with us at pwned@sitpub.com. Anonymity available upon request. ®
Get our [8]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2add4v2PR8UyP2N9uXGHSwgAAAA8&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://www.theregister.com/2026/04/08/windows_desktop_bakery/
[3] https://www.theregister.com/2026/04/06/windows_asks_a_networking_question/
[4] https://www.theregister.com/2026/04/03/when_a_billboard_survives_the/
[5] https://www.theregister.com/2026/03/28/rsac_bork/
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44add4v2PR8UyP2N9uXGHSwgAAAA8&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://www.theregister.com/2026/04/02/pwned/
[8] https://whitepapers.theregister.com/
Re: Manual
Which goes to show that anyone who owns any device on which the default password has not been changed royally deserves whatever they get.
Re: Manual
Anyone? What about the sweet little lady down the street?
Re: Manual
"So tea, ..."
Was this real tea, or something almost, but not quite, entirely unlike tea.
The previous school I worked at was a prestigious boarding school with a long history of sporting champions amongst its alumni.
They'd recently built a new gym and sports centre, and one Monday morning one of the house masters presented himself at the IT office and demanded we fix the treadmills.
Now I know there's a common trope where people assume everything with a plug is ITs responsibility, but this guy was quite senior, and quite adamant, so we trudged down to the sports centre.
We were confronted by a line of treadmills, all obviously working, as they had people running on them.
"Not the treadmills," he says, "the screens."
Each treadmill had an Android tablet, where they could check their socials, watch you tube etc.
Nobody had told us about these devices, they were installed over the weekend by a friend of a friend of one of the house masters, he'd clearly used a portable hotspot to set them up, as they were all looking for Jims_iPad
We reluctantly set them all up on our WiFi - reluctantly as despite being brand new treadmills, the were running a very ancient, and no-longer supported flavour of Android, v6 if memory serves.
Once they were back up and running, we checked the router logs, and each treadmill was sending encrypted 300 byte packages to South Korea. Luckily the treadmills and other gear in the gym were running on their own VLAN so had no access to the network.
We never did find out what those packets were, we hoped they were photos of the sweaty staff using the machines...
Was this school in a small town famed for shoes?
WTF
I can not really get my head around fitness equipment as such; the same having a console etc; so piping netflix pap to this stuff is a conceptual bridge too far for y.t.
Talking to a much younger middle aged neighour who sports an obvious "spare tyre", he mentioned he ran a half marathon twice a week.
Curious as to where he ran the 20km to and from and always looking for new places to walk (sod pounding the pavement - it buggers your knees) as our city has extensive parkland and walking tracks.
Totally floored me when he said he put in his 20km on a machine in his living room while watching the TV. The bloke is retired and does sod all otherwise. Probably cracks a few tinnies while doing his weekly marathon. ;)
Re: WTF
You can't outrun a bad diet.
Manual
You can also look this stuff up in manuals without a sticky note.
The leisure centre we used to support, at the reception for the gym, regularly left a post it note stuck to the monitor with the Windows login details for the account they used on reception. Gave up telling them to stop.
The drinks machine they installed in the kitchen had different pouches for drinks. So tea, coffee, hot choc etc. I knew they'd have done a half arsed install with it so downloaded its manual looking for the default admin account for it. And as suspected, they'd never changed it. So when no one was in the kitchen, I'd used the key combo to set it to free vend mode, get my free hot choc, then set it back again. Never felt guilty due to the way they treated me, fuckers. I went back a year later just for brief temp work, needed the money, and it was still the same default password so free vend started again :)