Attacks/Breaches

9/23/2011
10:15 AM
50%
50%

Wardriving Burglars Hacked Business Wi-Fi Networks

Three men are indicted for using a tricked-out Mercedes with specialized antennas and network-cracking tools to steal financial data via businesses' wireless networks.

Strategic Security Survey: Global Threat, LocalPain
Strategic Security Survey: Global Threat, Local Pain
(click image for larger view and for full slideshow)
Three men were indicted last week by a federal grand jury for hacking at least 13 Seattle-area businesses' wireless networks to steal sensitive information, as well as burglarizing the premises of at least 41 businesses.

The 10-count indictment, handed down in Seattle federal court, alleges that Joshuah Allen Witt, 34, Brad Eugene Lowe, 36, and John Earl Griffin, 36, stole credit card numbers and payroll information via businesses' wireless networks, enabling them to steal more than $750,000 in cash and computer equipment, among other items.

"The ring obtained credit card numbers and used them to purchase tens of thousands of dollars of high tech equipment and luxury goods that they used or sold," according to the indictment. "They hijacked payroll information so that payroll funds would be distributed to accounts under their control and sent company funds to reloadable debit cards, allowing them to rapidly cash out the company accounts." In addition, said authorities, the ring also used computer equipment stolen from a business to later hack into that business's network.

Intriguingly, the indictment accuses the trio of engaging in wardriving, using a black 1988 Mercedes sedan filled with network tools and specialized antennas in what news reports have termed their "rolling base of operations." As that suggests, wardriving refers to the practice of driving around, looking for accessible wireless networks or wireless data traffic, and then poaching data.

[ Here is something else to worry about: Wardriving Evolves Into Warflying ]

Specifically, the gang would target networks secured with Wired Equivalent Privacy (WEP), a 12-year-old, outdated, and insecure standard, which is still used by many Wi-Fi routers. "Once a suspect has gained unauthorized access to a wireless network, computers in the vehicle can be used to run programs such as port scanning software and password recovery software designed to breach security on machines within the network," said Seattle Police Detective Chris Hansen in an April court filing, according to the Seattle Post-Intelligencer. After breaching the network, the gang allegedly extracted every piece of financial information or access-related credential they could find.

Hansen also told the court that Griffin was first arrested in October 2010, after he attempted to use a gift card, which had been stolen during a break-in at a local business, at a Seattle wine bar, according to the Seattle Post-Intelligencer. But Griffin wasn't charged with the additional offenses until a federal jury handed down its indictment last week.

One of the affected businesses was Concur Technologies. According to a breach notification sent to the New Hampshire Attorney General's Office in December 2010, a November 2010 break-in to the premises of the business resulted in the theft of computer equipment containing unencrypted data on 1,017 employees, including their names, addresses, dates of birth, and social security numbers.

Authorities said that the gang's hacks of internal networks initially led investigators to suspect that some of the attacks had been perpetrated by insiders.

This isn't the first gang to be accused of wardriving, or cracking wireless networks that use WEP. Notably, Albert Gonzalez, the mastermind behind the exploit of TJX Companies--resulting in the compromise of 45.6 million credit and debit card numbers over an 18-month period--also employed these practices. According to the federal indictment handed down against Gonzalez in 2008, he engaged in wardriving along Route 1 near Miami, ultimately breaking into the wireless networks not just of TJX, but also Barnes & Noble, Boston Market, DSW, OfficeMax, and Sports Authority.

After the TJX breach came to light, one of the questions posed by security experts was: Why are businesses still using WEP? Three years later, the question still stands, and should compel any business that doesn't know whether or not it's using WEP to immediately audit its systems.

"Any company worth its salt should have realized that using WEP is about as much use to secure you as cotton or wool. It's not going stop anything," said Graham Cluley, senior technology consultant at Sophos, in an interview. "With PCI, for instance, they said that companies should stop using WEP, years ago. You need more sensible, hardened encryption, if you're going to have wireless communications."

See the latest IT solutions at Interop New York. Learn to leverage business technology innovations--including cloud, virtualization, security, mobility, and data center advances--that cut costs, increase productivity, and drive business value. Save 25% on Flex and Conference Passes or get a Free Expo Pass with code CPFHNY25. It happens in New York City, Oct. 3-7, 2011. Register now.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
BelajarA985
50%
50%
BelajarA985,
User Rank: Apprentice
8/23/2015 | 5:47:42 AM
Rate the article
I do agree with what you are writing about. because as it is should be
White House Cybersecurity Strategy at a Crossroads
Kelly Jackson Higgins, Executive Editor at Dark Reading,  7/17/2018
The Fundamental Flaw in Security Awareness Programs
Ira Winkler, CISSP, President, Secure Mentem,  7/19/2018
Number of Retailers Impacted by Breaches Doubles
Ericka Chickowski, Contributing Writer, Dark Reading,  7/19/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-14492
PUBLISHED: 2018-07-21
Tenda AC7 through V15.03.06.44_CN, AC9 through V15.03.05.19(6318)_CN, and AC10 through V15.03.06.23_CN devices have a Stack-based Buffer Overflow via a long limitSpeed or limitSpeedup parameter to an unspecified /goform URI.
CVE-2018-3770
PUBLISHED: 2018-07-20
A path traversal exists in markdown-pdf version <9.0.0 that allows a user to insert a malicious html code that can result in reading the local files.
CVE-2018-3771
PUBLISHED: 2018-07-20
An XSS in statics-server <= 0.0.9 can be used via injected iframe in the filename when statics-server displays directory index in the browser.
CVE-2018-5065
PUBLISHED: 2018-07-20
Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have a Use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
CVE-2018-5066
PUBLISHED: 2018-07-20
Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have an Out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.