Wardriving Burglars Hacked Business Wi-Fi Networks

Strategic Security Survey: Global Threat, LocalPain

Three men were indicted last week by a federal grand jury for hacking at least 13 Seattle-area businesses' wireless networks to steal sensitive information, as well as burglarizing the premises of at least 41 businesses.

The 10-count indictment, handed down in Seattle federal court, alleges that Joshuah Allen Witt, 34, Brad Eugene Lowe, 36, and John Earl Griffin, 36, stole credit card numbers and payroll information via businesses' wireless networks, enabling them to steal more than $750,000 in cash and computer equipment, among other items.

"The ring obtained credit card numbers and used them to purchase tens of thousands of dollars of high tech equipment and luxury goods that they used or sold," according to the indictment. "They hijacked payroll information so that payroll funds would be distributed to accounts under their control and sent company funds to reloadable debit cards, allowing them to rapidly cash out the company accounts." In addition, said authorities, the ring also used computer equipment stolen from a business to later hack into that business's network.

Intriguingly, the indictment accuses the trio of engaging in wardriving, using a black 1988 Mercedes sedan filled with network tools and specialized antennas in what news reports have termed their "rolling base of operations." As that suggests, wardriving refers to the practice of driving around, looking for accessible wireless networks or wireless data traffic, and then poaching data.

[ Here is something else to worry about: Wardriving Evolves Into Warflying ]

Specifically, the gang would target networks secured with Wired Equivalent Privacy (WEP), a 12-year-old, outdated, and insecure standard, which is still used by many Wi-Fi routers. "Once a suspect has gained unauthorized access to a wireless network, computers in the vehicle can be used to run programs such as port scanning software and password recovery software designed to breach security on machines within the network," said Seattle Police Detective Chris Hansen in an April court filing, according to the Seattle Post-Intelligencer. After breaching the network, the gang allegedly extracted every piece of financial information or access-related credential they could find.

Hansen also told the court that Griffin was first arrested in October 2010, after he attempted to use a gift card, which had been stolen during a break-in at a local business, at a Seattle wine bar, according to the Seattle Post-Intelligencer. But Griffin wasn't charged with the additional offenses until a federal jury handed down its indictment last week.

One of the affected businesses was Concur Technologies. According to a breach notification sent to the New Hampshire Attorney General's Office in December 2010, a November 2010 break-in to the premises of the business resulted in the theft of computer equipment containing unencrypted data on 1,017 employees, including their names, addresses, dates of birth, and social security numbers.

Authorities said that the gang's hacks of internal networks initially led investigators to suspect that some of the attacks had been perpetrated by insiders.

This isn't the first gang to be accused of wardriving, or cracking wireless networks that use WEP. Notably, Albert Gonzalez, the mastermind behind the exploit of TJX Companies--resulting in the compromise of 45.6 million credit and debit card numbers over an 18-month period--also employed these practices. According to the federal indictment handed down against Gonzalez in 2008, he engaged in wardriving along Route 1 near Miami, ultimately breaking into the wireless networks not just of TJX, but also Barnes & Noble, Boston Market, DSW, OfficeMax, and Sports Authority.

After the TJX breach came to light, one of the questions posed by security experts was: Why are businesses still using WEP? Three years later, the question still stands, and should compel any business that doesn't know whether or not it's using WEP to immediately audit its systems.

"Any company worth its salt should have realized that using WEP is about as much use to secure you as cotton or wool. It's not going stop anything," said Graham Cluley, senior technology consultant at Sophos, in an interview. "With PCI, for instance, they said that companies should stop using WEP, years ago. You need more sensible, hardened encryption, if you're going to have wireless communications."

See the latest IT solutions at Interop New York. Learn to leverage business technology innovations--including cloud, virtualization, security, mobility, and data center advances--that cut costs, increase productivity, and drive business value. Save 25% on Flex and Conference Passes or get a Free Expo Pass with code CPFHNY25. It happens in New York City, Oct. 3-7, 2011. Register now.