Attacks/Breaches
9/23/2011
10:15 AM
Connect Directly
RSS
E-Mail
50%
50%

Wardriving Burglars Hacked Business Wi-Fi Networks

Three men are indicted for using a tricked-out Mercedes with specialized antennas and network-cracking tools to steal financial data via businesses' wireless networks.

Strategic Security Survey: Global Threat, LocalPain
Strategic Security Survey: Global Threat, Local Pain
(click image for larger view and for full slideshow)
Three men were indicted last week by a federal grand jury for hacking at least 13 Seattle-area businesses' wireless networks to steal sensitive information, as well as burglarizing the premises of at least 41 businesses.

The 10-count indictment, handed down in Seattle federal court, alleges that Joshuah Allen Witt, 34, Brad Eugene Lowe, 36, and John Earl Griffin, 36, stole credit card numbers and payroll information via businesses' wireless networks, enabling them to steal more than $750,000 in cash and computer equipment, among other items.

"The ring obtained credit card numbers and used them to purchase tens of thousands of dollars of high tech equipment and luxury goods that they used or sold," according to the indictment. "They hijacked payroll information so that payroll funds would be distributed to accounts under their control and sent company funds to reloadable debit cards, allowing them to rapidly cash out the company accounts." In addition, said authorities, the ring also used computer equipment stolen from a business to later hack into that business's network.

Intriguingly, the indictment accuses the trio of engaging in wardriving, using a black 1988 Mercedes sedan filled with network tools and specialized antennas in what news reports have termed their "rolling base of operations." As that suggests, wardriving refers to the practice of driving around, looking for accessible wireless networks or wireless data traffic, and then poaching data.

[ Here is something else to worry about: Wardriving Evolves Into Warflying ]

Specifically, the gang would target networks secured with Wired Equivalent Privacy (WEP), a 12-year-old, outdated, and insecure standard, which is still used by many Wi-Fi routers. "Once a suspect has gained unauthorized access to a wireless network, computers in the vehicle can be used to run programs such as port scanning software and password recovery software designed to breach security on machines within the network," said Seattle Police Detective Chris Hansen in an April court filing, according to the Seattle Post-Intelligencer. After breaching the network, the gang allegedly extracted every piece of financial information or access-related credential they could find.

Hansen also told the court that Griffin was first arrested in October 2010, after he attempted to use a gift card, which had been stolen during a break-in at a local business, at a Seattle wine bar, according to the Seattle Post-Intelligencer. But Griffin wasn't charged with the additional offenses until a federal jury handed down its indictment last week.

One of the affected businesses was Concur Technologies. According to a breach notification sent to the New Hampshire Attorney General's Office in December 2010, a November 2010 break-in to the premises of the business resulted in the theft of computer equipment containing unencrypted data on 1,017 employees, including their names, addresses, dates of birth, and social security numbers.

Authorities said that the gang's hacks of internal networks initially led investigators to suspect that some of the attacks had been perpetrated by insiders.

This isn't the first gang to be accused of wardriving, or cracking wireless networks that use WEP. Notably, Albert Gonzalez, the mastermind behind the exploit of TJX Companies--resulting in the compromise of 45.6 million credit and debit card numbers over an 18-month period--also employed these practices. According to the federal indictment handed down against Gonzalez in 2008, he engaged in wardriving along Route 1 near Miami, ultimately breaking into the wireless networks not just of TJX, but also Barnes & Noble, Boston Market, DSW, OfficeMax, and Sports Authority.

After the TJX breach came to light, one of the questions posed by security experts was: Why are businesses still using WEP? Three years later, the question still stands, and should compel any business that doesn't know whether or not it's using WEP to immediately audit its systems.

"Any company worth its salt should have realized that using WEP is about as much use to secure you as cotton or wool. It's not going stop anything," said Graham Cluley, senior technology consultant at Sophos, in an interview. "With PCI, for instance, they said that companies should stop using WEP, years ago. You need more sensible, hardened encryption, if you're going to have wireless communications."

See the latest IT solutions at Interop New York. Learn to leverage business technology innovations--including cloud, virtualization, security, mobility, and data center advances--that cut costs, increase productivity, and drive business value. Save 25% on Flex and Conference Passes or get a Free Expo Pass with code CPFHNY25. It happens in New York City, Oct. 3-7, 2011. Register now.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-4973
Published: 2014-09-23
The ESET Personal Firewall NDIS filter (EpFwNdis.sys) driver in the Firewall Module Build 1183 (20140214) and earlier in ESET Smart Security and ESET Endpoint Security products 5.0 through 7.0 allows local users to gain privileges via a crafted argument to a 0x830020CC IOCTL call.

CVE-2014-5392
Published: 2014-09-23
XML External Entity (XXE) vulnerability in JobScheduler before 1.6.4246 and 7.x before 1.7.4241 allows remote attackers to cause a denial of service and read arbitrary files or directories via a request containing an XML external entity declaration in conjunction with an entity reference.

CVE-2014-6646
Published: 2014-09-23
The bellyhoodcom (aka com.tapatalk.bellyhoodcom) application 3.4.23 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

CVE-2014-6647
Published: 2014-09-23
The ElForro.com (aka com.tapatalk.elforrocom) application 2.4.3.10 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

CVE-2014-6648
Published: 2014-09-23
The iPhone4.TW (aka com.tapatalk.iPhone4TWforums) application 3.3.20 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

Best of the Web
Dark Reading Radio