Slashdot Mirror
Wardrivers Target Seattle Businesses
angry tapir writes "Seattle police are investigating a group of criminals who they say have been cruising around town in a black Mercedes stealing credit card data by tapping into wireless networks belonging to area businesses. The group has been at it for about five years, according to an affidavit signed by Detective Chris Hansen, a fraud investigator with the Seattle Police Department."
take a seat over there...
SECURE YOUR WIRELESS ACCESS POINTS. Otherwise, unwanted traffic is your fault.
Why don't you have a seat over there? ... What were you thinking?
fak3r.com
It's important to catch guys with laptops in a Mercedes, than gangbangers, murderers, or those guys who drive around in vans offering little girls candy.
Did someone in the Department find a $20 charge on his credit card, or is this just a simple case of "We serve nobody and protect nobody, but if you're using a laptop and an antenna in receipt of lawful radio signals, WE WILL FIND YOU!"?
I have done lots of wardriving. I can't afford a Mercedes tho. Does this put me halfway between the van-driving child-molesters and the war-drivers in the Merc? Should I fear if I ever go to Seattle?
E
If my coworkers and I shared your finacial information by tossing paper planes to one another, you'd think us nuts. Replace paper with electromagnetic waves and all is well.
It would be easy to set up a weakly protect access point that did nothing but generate bogus transactions with bad credit card numbers - that could pollute the crook's database, particularly if they don't do a good job of recording of which card number came from which network.
And if the bogus numbers were timestamped and logged then when the bad card numbers are used (and bounced) one could use the bounced transactions to build a map of where the crooks were on any given day.
We discovered that the company below us a few years back (here in Seattle) had not only an open wifi but also had all of their drives shared. We immediately went down stairs and warned them after one of us accidentally connected to their wifi and saw a whole bunch of computers (with official sounding names even) pop up in the file explorer.
Their reaction? "Whatever." They never put a password on it. I was actually surprised by their disinterest in locking down when alerted. Even after we told them that people could just drive by and steal all their company records... so stupid.
Wireless Security is no longer an academic problem; as we can see from the article, it's now going beyond miscreants merely stealing access/internet bandwidth, or possibly pirating/illegal activities using the internet connection.
This goes to more serious crimes that more severely impact the operator of the network connected to the wireless AP.
SMBs can no longer safely dismiss wireless security with excuses such as "only a real expert hacker could break in anyways; there's no harm anyone's actually going to do; etc".
With money to be made breaching networks, practitioners of one of the oldest professions in the world, will be learning to breach insecure WiFi networks, to ply their trade of stealing....
More so, the more credit card computers get plugged into LANs without at least isolation from the wireless segment.
I thought all business that deal with CC transactions must be within a secured network. In fact, there's even PCI guidelines on recommended settings to secure your WiFi access points. Unless business are using WPA/WPA2, shouldn't they be busted for not adhering to PCI security protocol? I've included a link to a PDF below for anyone interested.
https://www.pcisecuritystandards.org/pdfs/PCI_DSS_Wireless_Guidelines.pdf
Life is not for the lazy.
Now people are going to think that Wardriving is synonymous with stealing credit card numbers, when it's just the act of finding wi-fi from a car.
"a group of criminals who they say have been cruising around town in a black Mercedes stealing credit card data by tapping into wireless networks belonging to area businesses."
If the criminals hadn't been wandering around blabbing about their exploits and saying it for everyone to hear then maybe the police wouldn't have even noticed them.
Firstly, let's be clear, I want the people stealing the information caught, and locked up. They are criminals.
The business should be fined though if they did nothing to protect their information. This is like leaving a toddler at home alone all day (though not to the same degree.)
// file: mice.h
#include "frickin_lasers.h"
My money's on the Mix-a-Lot Posse.
Benzo? check.
Tinted windows? check.
One member of the gang, Larry, an allegedly-funny 'white guy' and 'real estate investor' has struggled in recent years to make payments on his many properties.
I predict the Benzo is an SEL, a 190 or an SEC, and that a search of the Benzo will reveal traces of buttermilk biscuits.
Some small and medium businesses of Seattle don't implement PCI. They have probably falsified some stickers as well to make the customer feel good. They get wardriven all the way to the Afghanistan. This is all unpossible.
Anonymously writing the file names of various documents found on their drives and pasting the list on their front door would probably have started to get their attention enough to lock it. Without actually accessing their files, it would be a nice way of saying "your skirt's up, and here's what I can see"
Just a suggestion in 5 years of being clipped you might just want to secure those networks.
I suppose it would have been done by now if they were paying for the loss instead of the cc company.
Oups... Shouldn't these guys have complied with PCI DSS? That should be what the article is about instead of talking about the people trying to access the data.
When google gave us a wake-up call that someone in a van could drive around and gather all sorts of information we didn't realize we were broadcasting.
*looks down at the disassembled barcode scanning guns on his desk*
*looks outside at seattle*
Once again, the police are behind the curve.
"Why don't you have a seat over there"
This looks like the Russian Mafia.
In the real world most businesses really don't care about security, particularly SMBs. They are such easy targets it's ridiculous. They pay their tech dude to come in and do a little bit of work, fix things if they're broken, etc.
"I have a virus on my system popping up stuff all the time and blocking my internet" is a case of calling a technician in.
"I want you to audit my network for security" is a question they wouldn't even know how to ask and whether or not they should ask, and they really wouldn't know whether or not the auditor did a good job.
Did I mention the technician might just be some local dude who has only ever set up basic linksys devices and worked at geeksquad?
The cost of doing business in an insecure manner is cheaper than the cost of doing business otherwise. And this article obviously shows it. Instead of going after the businesses for doing things in this manner, they're going after the guys driving around pointing it out.
They should charge each of these businesses for stolen credit card information until they get it through their heads they have to follow compliance rules.
Why aren't the connections with card processors encrypted end-to-end with SSL/TLS? Then the wifi security, which is outside the card processors' hands, would be irrelevant, and the card numbers would not be exposed to internet routers either. This is the responsibility of the card processors IMO. Everyone knows you don't send credit card numbers over the internet without TLS.
should be outlawed!
Rick B.
I want the people stealing the information caught, and locked up. They are criminals.
If the suspects were actually breaking into the business and removing papers from filing cabinets, you could call that "stealing information". What's actually occurring is that these businesses are broadcasting their information in an insecure manner. In a free country, how can it be a crime to pick up on that information?
Now, if they then use that information to commit fraud, that's where the true crime is taking place.
I only wardrive in a grey Ford.
These criminals are awful, taking advantage of unlocked doors, valuable property left unattended for long periods on the streets, etc. We need tougher laws! We need more police! We need, we need! We really need non-idiot businesses who skim over that 'nerdy tech stuff', and keep hoping for the best. Hint: If you are too stupid to do it yourself, then you will have to hire someone. You have a choice: get secure, or be open to theft. Its a 5 minute job. You can do it once, and be secure for at least 6 months, perhaps forever. If you need optimal security, you can use secure protocols, change passwords every 6 months, and for the most part, have a reasonable expectation of security, at least from the kids, soccer moms, and innocent bystanders who accidentally trip over your open, unsecured network. The pros still have multiple methods in, but with them you at least have a valid charge of 'breaking and entering'. Without any security, you aren't just an idiot, your legal status is in question too.
Loki Stormbringer.
It is against the law. It is actually a federal law and part of the federal computer fraud and abuse act: "intentionally accesses a computer without authorization or exceeds authorized access." This has been used mostly by prosecutors to get plea deals. I can only find one person actually charged - a police officer arrested a man who parked near a cafe the officer frequented every morning to use his laptop but never paid for a cup of coffee. $400 fine. Prosecutors would need to convince a jury or more likely plea bargain.
CNET NEWS article on using WiFi:
"What do prosecutors think?
We asked the U.S. Justice Department on Thursday. A department representative who did not want to be quoted by name said, essentially, that it depends on the details of each case.
The representative said in an e-mail exchange: "Whether access is considered authorized can be determined in part by the precise circumstances of access, just as it would be in the physical world. The prosecutor and jury would look at how the access was accomplished and what was done with the access before definitively determining that it was unauthorized." In other words, the representative said, someone sitting in a company's parking lot at 3 a.m. for the sole purpose of network connectivity might be viewed as a lawbreaker."