Researcher To Demonstrate Flaws In Wireless Warehouse Networks

A security researcher at next week's Black Hat Europe will demonstrate a simple, low-cost method for hacking wireless networks commonly used in shipping and warehousing facilities.

Rob Havelt, practice manager for penetration testing at Trustwave's SpiderLabs unit, will demonstrate how easy it is to attack legacy 802.11 FHSS networks, which are often seen as inherently secure because so few off-the-shelf tools are available for remote eavesdropping.

The 802.11 FHSS technology has been outmoded in most wireless applications, but it is still commonly used in warehousing facilities because it works so well with inventory management equipment, such as handheld bar-code scanners and printers.

"Penetrating an 802.11 FHSS network is mistakenly believed to be financially and technologically out of reach for the common hacker, costing thousands of dollars and requiring a high skill set," Trustwave says. However, using easy-to-obtain tools, such as GNURadio and the USRP, Havelt will present code and techniques to penetrate such networks at a low cost, the company says.

"This demonstration will prove particularly important for those organizations that discount the risk 802.11 FHSS networks pose to security," Trustwave says. "These access points, generally connected to the corporate LAN, if compromised, could expose personally identifiable information, such as Social Security numbers and/or cardholder data."

Often, no controls are in place between these networks and corporate LAN environments, leaving a large hole for hackers to penetrate, according to the company.

"This demonstration will prove to naysayers that these legacy wireless networks need to be reviewed for security issues and included in the scope for compliance with the Payment Card Industry Data Security Standard if the entity stores, processes, or transmits cardholder data," adds Robert McCullen, chairman and CEO of Trustwave. "We've seen security firms ignore the need to scope these types of networks, giving erroneous advice to their clients and providing a false sense of security."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.