Attacks/Breaches
9/23/2011
10:15 AM
50%
50%

Wardriving Burglars Hacked Business Wi-Fi Networks

Three men are indicted for using a tricked-out Mercedes with specialized antennas and network-cracking tools to steal financial data via businesses' wireless networks.

Strategic Security Survey: Global Threat, LocalPain
Strategic Security Survey: Global Threat, Local Pain
(click image for larger view and for full slideshow)
Three men were indicted last week by a federal grand jury for hacking at least 13 Seattle-area businesses' wireless networks to steal sensitive information, as well as burglarizing the premises of at least 41 businesses.

The 10-count indictment, handed down in Seattle federal court, alleges that Joshuah Allen Witt, 34, Brad Eugene Lowe, 36, and John Earl Griffin, 36, stole credit card numbers and payroll information via businesses' wireless networks, enabling them to steal more than $750,000 in cash and computer equipment, among other items.

"The ring obtained credit card numbers and used them to purchase tens of thousands of dollars of high tech equipment and luxury goods that they used or sold," according to the indictment. "They hijacked payroll information so that payroll funds would be distributed to accounts under their control and sent company funds to reloadable debit cards, allowing them to rapidly cash out the company accounts." In addition, said authorities, the ring also used computer equipment stolen from a business to later hack into that business's network.

Intriguingly, the indictment accuses the trio of engaging in wardriving, using a black 1988 Mercedes sedan filled with network tools and specialized antennas in what news reports have termed their "rolling base of operations." As that suggests, wardriving refers to the practice of driving around, looking for accessible wireless networks or wireless data traffic, and then poaching data.

[ Here is something else to worry about: Wardriving Evolves Into Warflying ]

Specifically, the gang would target networks secured with Wired Equivalent Privacy (WEP), a 12-year-old, outdated, and insecure standard, which is still used by many Wi-Fi routers. "Once a suspect has gained unauthorized access to a wireless network, computers in the vehicle can be used to run programs such as port scanning software and password recovery software designed to breach security on machines within the network," said Seattle Police Detective Chris Hansen in an April court filing, according to the Seattle Post-Intelligencer. After breaching the network, the gang allegedly extracted every piece of financial information or access-related credential they could find.

Hansen also told the court that Griffin was first arrested in October 2010, after he attempted to use a gift card, which had been stolen during a break-in at a local business, at a Seattle wine bar, according to the Seattle Post-Intelligencer. But Griffin wasn't charged with the additional offenses until a federal jury handed down its indictment last week.

One of the affected businesses was Concur Technologies. According to a breach notification sent to the New Hampshire Attorney General's Office in December 2010, a November 2010 break-in to the premises of the business resulted in the theft of computer equipment containing unencrypted data on 1,017 employees, including their names, addresses, dates of birth, and social security numbers.

Authorities said that the gang's hacks of internal networks initially led investigators to suspect that some of the attacks had been perpetrated by insiders.

This isn't the first gang to be accused of wardriving, or cracking wireless networks that use WEP. Notably, Albert Gonzalez, the mastermind behind the exploit of TJX Companies--resulting in the compromise of 45.6 million credit and debit card numbers over an 18-month period--also employed these practices. According to the federal indictment handed down against Gonzalez in 2008, he engaged in wardriving along Route 1 near Miami, ultimately breaking into the wireless networks not just of TJX, but also Barnes & Noble, Boston Market, DSW, OfficeMax, and Sports Authority.

After the TJX breach came to light, one of the questions posed by security experts was: Why are businesses still using WEP? Three years later, the question still stands, and should compel any business that doesn't know whether or not it's using WEP to immediately audit its systems.

"Any company worth its salt should have realized that using WEP is about as much use to secure you as cotton or wool. It's not going stop anything," said Graham Cluley, senior technology consultant at Sophos, in an interview. "With PCI, for instance, they said that companies should stop using WEP, years ago. You need more sensible, hardened encryption, if you're going to have wireless communications."

See the latest IT solutions at Interop New York. Learn to leverage business technology innovations--including cloud, virtualization, security, mobility, and data center advances--that cut costs, increase productivity, and drive business value. Save 25% on Flex and Conference Passes or get a Free Expo Pass with code CPFHNY25. It happens in New York City, Oct. 3-7, 2011. Register now.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-8891
Published: 2015-03-06
Unspecified vulnerability in the Java Virtual Machine (JVM) in IBM SDK, Java Technology Edition 5.0 before SR16-FP9, 6 before SR16-FP3, 6R1 before SR8-FP3, 7 before SR8-FP10, and 7R1 before SR2-FP10 allows remote attackers to escape the Java sandbox and execute arbitrary code via unspecified vectors...

CVE-2014-8892
Published: 2015-03-06
Unspecified vulnerability in the Java Virtual Machine (JVM) in IBM SDK, Java Technology Edition 5.0 before SR16-FP9, 6 before SR16-FP3, 6R1 before SR8-FP3, 7 before SR8-FP10, and 7R1 before SR2-FP10 allows remote attackers to bypass intended access permissions and obtain sensitive information via un...

CVE-2015-1170
Published: 2015-03-06
The NVIDIA Display Driver R304 before 309.08, R340 before 341.44, R343 before 345.20, and R346 before 347.52 does not properly validate local client impersonation levels when performing a "kernel administrator check," which allows local users to gain administrator privileges via unspecified API call...

CVE-2015-1637
Published: 2015-03-06
Schannel (aka Secure Channel) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly restrict TLS state transitions, which makes it easier for r...

CVE-2014-2130
Published: 2015-03-05
Cisco Secure Access Control Server (ACS) provides an unintentional administration web interface based on Apache Tomcat, which allows remote authenticated users to modify application files and configuration files, and consequently execute arbitrary code, by leveraging administrative privileges, aka B...

Dark Reading Radio
Archived Dark Reading Radio
How can security professionals better engage with their peers, both in person and online? In this Dark Reading Radio show, we will talk to leaders at some of the security industry’s professional organizations about how security pros can get more involved – with their colleagues in the same industry, with their peers in other industries, and with the IT security community as a whole.