Slashdot Mirror
Wardrivers Target Seattle Businesses
angry tapir writes "Seattle police are investigating a group of criminals who they say have been cruising around town in a black Mercedes stealing credit card data by tapping into wireless networks belonging to area businesses. The group has been at it for about five years, according to an affidavit signed by Detective Chris Hansen, a fraud investigator with the Seattle Police Department."
SECURE YOUR WIRELESS ACCESS POINTS. Otherwise, unwanted traffic is your fault.
Why don't you have a seat over there? ... What were you thinking?
fak3r.com
It's important to catch guys with laptops in a Mercedes, than gangbangers, murderers, or those guys who drive around in vans offering little girls candy.
Did someone in the Department find a $20 charge on his credit card, or is this just a simple case of "We serve nobody and protect nobody, but if you're using a laptop and an antenna in receipt of lawful radio signals, WE WILL FIND YOU!"?
I have done lots of wardriving. I can't afford a Mercedes tho. Does this put me halfway between the van-driving child-molesters and the war-drivers in the Merc? Should I fear if I ever go to Seattle?
E
If my coworkers and I shared your finacial information by tossing paper planes to one another, you'd think us nuts. Replace paper with electromagnetic waves and all is well.
It would be easy to set up a weakly protect access point that did nothing but generate bogus transactions with bad credit card numbers - that could pollute the crook's database, particularly if they don't do a good job of recording of which card number came from which network.
And if the bogus numbers were timestamped and logged then when the bad card numbers are used (and bounced) one could use the bounced transactions to build a map of where the crooks were on any given day.
We discovered that the company below us a few years back (here in Seattle) had not only an open wifi but also had all of their drives shared. We immediately went down stairs and warned them after one of us accidentally connected to their wifi and saw a whole bunch of computers (with official sounding names even) pop up in the file explorer.
Their reaction? "Whatever." They never put a password on it. I was actually surprised by their disinterest in locking down when alerted. Even after we told them that people could just drive by and steal all their company records... so stupid.
Wireless Security is no longer an academic problem; as we can see from the article, it's now going beyond miscreants merely stealing access/internet bandwidth, or possibly pirating/illegal activities using the internet connection.
This goes to more serious crimes that more severely impact the operator of the network connected to the wireless AP.
SMBs can no longer safely dismiss wireless security with excuses such as "only a real expert hacker could break in anyways; there's no harm anyone's actually going to do; etc".
With money to be made breaching networks, practitioners of one of the oldest professions in the world, will be learning to breach insecure WiFi networks, to ply their trade of stealing....
More so, the more credit card computers get plugged into LANs without at least isolation from the wireless segment.
I thought all business that deal with CC transactions must be within a secured network. In fact, there's even PCI guidelines on recommended settings to secure your WiFi access points. Unless business are using WPA/WPA2, shouldn't they be busted for not adhering to PCI security protocol? I've included a link to a PDF below for anyone interested.
https://www.pcisecuritystandards.org/pdfs/PCI_DSS_Wireless_Guidelines.pdf
Life is not for the lazy.
Now people are going to think that Wardriving is synonymous with stealing credit card numbers, when it's just the act of finding wi-fi from a car.
"a group of criminals who they say have been cruising around town in a black Mercedes stealing credit card data by tapping into wireless networks belonging to area businesses."
If the criminals hadn't been wandering around blabbing about their exploits and saying it for everyone to hear then maybe the police wouldn't have even noticed them.
Firstly, let's be clear, I want the people stealing the information caught, and locked up. They are criminals.
The business should be fined though if they did nothing to protect their information. This is like leaving a toddler at home alone all day (though not to the same degree.)
// file: mice.h
#include "frickin_lasers.h"
My money's on the Mix-a-Lot Posse.
Benzo? check.
Tinted windows? check.
One member of the gang, Larry, an allegedly-funny 'white guy' and 'real estate investor' has struggled in recent years to make payments on his many properties.
I predict the Benzo is an SEL, a 190 or an SEC, and that a search of the Benzo will reveal traces of buttermilk biscuits.
When google gave us a wake-up call that someone in a van could drive around and gather all sorts of information we didn't realize we were broadcasting.
"Why don't you have a seat over there"
This looks like the Russian Mafia.
In the real world most businesses really don't care about security, particularly SMBs. They are such easy targets it's ridiculous. They pay their tech dude to come in and do a little bit of work, fix things if they're broken, etc.
"I have a virus on my system popping up stuff all the time and blocking my internet" is a case of calling a technician in.
"I want you to audit my network for security" is a question they wouldn't even know how to ask and whether or not they should ask, and they really wouldn't know whether or not the auditor did a good job.
Did I mention the technician might just be some local dude who has only ever set up basic linksys devices and worked at geeksquad?
The cost of doing business in an insecure manner is cheaper than the cost of doing business otherwise. And this article obviously shows it. Instead of going after the businesses for doing things in this manner, they're going after the guys driving around pointing it out.
They should charge each of these businesses for stolen credit card information until they get it through their heads they have to follow compliance rules.
Why aren't the connections with card processors encrypted end-to-end with SSL/TLS? Then the wifi security, which is outside the card processors' hands, would be irrelevant, and the card numbers would not be exposed to internet routers either. This is the responsibility of the card processors IMO. Everyone knows you don't send credit card numbers over the internet without TLS.
should be outlawed!
Rick B.
I want the people stealing the information caught, and locked up. They are criminals.
If the suspects were actually breaking into the business and removing papers from filing cabinets, you could call that "stealing information". What's actually occurring is that these businesses are broadcasting their information in an insecure manner. In a free country, how can it be a crime to pick up on that information?
Now, if they then use that information to commit fraud, that's where the true crime is taking place.
I only wardrive in a grey Ford.