Attacks/Breaches

9/23/2011
10:15 AM
50%
50%

Wardriving Burglars Hacked Business Wi-Fi Networks

Three men are indicted for using a tricked-out Mercedes with specialized antennas and network-cracking tools to steal financial data via businesses' wireless networks.

Strategic Security Survey: Global Threat, LocalPain
Strategic Security Survey: Global Threat, Local Pain
(click image for larger view and for full slideshow)
Three men were indicted last week by a federal grand jury for hacking at least 13 Seattle-area businesses' wireless networks to steal sensitive information, as well as burglarizing the premises of at least 41 businesses.

The 10-count indictment, handed down in Seattle federal court, alleges that Joshuah Allen Witt, 34, Brad Eugene Lowe, 36, and John Earl Griffin, 36, stole credit card numbers and payroll information via businesses' wireless networks, enabling them to steal more than $750,000 in cash and computer equipment, among other items.

"The ring obtained credit card numbers and used them to purchase tens of thousands of dollars of high tech equipment and luxury goods that they used or sold," according to the indictment. "They hijacked payroll information so that payroll funds would be distributed to accounts under their control and sent company funds to reloadable debit cards, allowing them to rapidly cash out the company accounts." In addition, said authorities, the ring also used computer equipment stolen from a business to later hack into that business's network.

Intriguingly, the indictment accuses the trio of engaging in wardriving, using a black 1988 Mercedes sedan filled with network tools and specialized antennas in what news reports have termed their "rolling base of operations." As that suggests, wardriving refers to the practice of driving around, looking for accessible wireless networks or wireless data traffic, and then poaching data.

[ Here is something else to worry about: Wardriving Evolves Into Warflying ]

Specifically, the gang would target networks secured with Wired Equivalent Privacy (WEP), a 12-year-old, outdated, and insecure standard, which is still used by many Wi-Fi routers. "Once a suspect has gained unauthorized access to a wireless network, computers in the vehicle can be used to run programs such as port scanning software and password recovery software designed to breach security on machines within the network," said Seattle Police Detective Chris Hansen in an April court filing, according to the Seattle Post-Intelligencer. After breaching the network, the gang allegedly extracted every piece of financial information or access-related credential they could find.

Hansen also told the court that Griffin was first arrested in October 2010, after he attempted to use a gift card, which had been stolen during a break-in at a local business, at a Seattle wine bar, according to the Seattle Post-Intelligencer. But Griffin wasn't charged with the additional offenses until a federal jury handed down its indictment last week.

One of the affected businesses was Concur Technologies. According to a breach notification sent to the New Hampshire Attorney General's Office in December 2010, a November 2010 break-in to the premises of the business resulted in the theft of computer equipment containing unencrypted data on 1,017 employees, including their names, addresses, dates of birth, and social security numbers.

Authorities said that the gang's hacks of internal networks initially led investigators to suspect that some of the attacks had been perpetrated by insiders.

This isn't the first gang to be accused of wardriving, or cracking wireless networks that use WEP. Notably, Albert Gonzalez, the mastermind behind the exploit of TJX Companies--resulting in the compromise of 45.6 million credit and debit card numbers over an 18-month period--also employed these practices. According to the federal indictment handed down against Gonzalez in 2008, he engaged in wardriving along Route 1 near Miami, ultimately breaking into the wireless networks not just of TJX, but also Barnes & Noble, Boston Market, DSW, OfficeMax, and Sports Authority.

After the TJX breach came to light, one of the questions posed by security experts was: Why are businesses still using WEP? Three years later, the question still stands, and should compel any business that doesn't know whether or not it's using WEP to immediately audit its systems.

"Any company worth its salt should have realized that using WEP is about as much use to secure you as cotton or wool. It's not going stop anything," said Graham Cluley, senior technology consultant at Sophos, in an interview. "With PCI, for instance, they said that companies should stop using WEP, years ago. You need more sensible, hardened encryption, if you're going to have wireless communications."

See the latest IT solutions at Interop New York. Learn to leverage business technology innovations--including cloud, virtualization, security, mobility, and data center advances--that cut costs, increase productivity, and drive business value. Save 25% on Flex and Conference Passes or get a Free Expo Pass with code CPFHNY25. It happens in New York City, Oct. 3-7, 2011. Register now.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
BelajarA985
50%
50%
BelajarA985,
User Rank: Apprentice
8/23/2015 | 5:47:42 AM
Rate the article
I do agree with what you are writing about. because as it is should be
6 Security Trends for 2018/2019
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/15/2018
6 Reasons Why Employees Violate Security Policies
Ericka Chickowski, Contributing Writer, Dark Reading,  10/16/2018
Getting Up to Speed with "Always-On SSL"
Tim Callan, Senior Fellow, Comodo CA,  10/18/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Latest Comment: Too funny!
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-10839
PUBLISHED: 2018-10-16
Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use this flaw to crash the Qemu process resulting in DoS.
CVE-2018-13399
PUBLISHED: 2018-10-16
The Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escalate privileges because of weak permissions on the installation directory.
CVE-2018-18381
PUBLISHED: 2018-10-16
Z-BlogPHP 1.5.2.1935 (Zero) has a stored XSS Vulnerability in zb_system/function/c_system_admin.php via the Content-Type header during the uploading of image attachments.
CVE-2018-18382
PUBLISHED: 2018-10-16
Advanced HRM 1.6 allows Remote Code Execution via PHP code in a .php file to the user/update-user-avatar URI, which can be accessed through an "Update Profile" "Change Picture" (aka user/edit-profile) action.
CVE-2018-18374
PUBLISHED: 2018-10-16
XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter.