Feeds

Wireless hacking bust in Michigan

Warparking

  • alert
  • submit to reddit

Top three mobile application threats

In a rare wireless hacking prosecution, federal officials this week accused two Michigan men of repeatedly cracking the Lowe's chain of home improvement stores' nationwide network from a 1995 Pontiac Grand Prix parked outside a suburban Detroit store.

Paul Timmins, 22, and Adam Botbyl, 20, were charged Monday with penetrating and intentionally damaging a Lowe's system in violation of the federal Computer Fraud and Abuse Act.

According to an affidavit filed by FBI agent Denise Stemen, intruders first hopped onto the wi-fi network at the Lowe's store in Southfield, Michigan on October 25th, at 11:20 p.m, and used the store's network to access the company's central data center at Lowe's North Carolina headquarters.

They returned at least six times over the following two weeks and used the network to access store networks at seven other Lowe's locations around the country, in Kansas, North Carolina, Kentucky, South Dakota, Florida, and two stores in California. The intruders deployed unspecified hacking software at some of the stores, in once case crashing the point of sale terminals at a Lowe's in Long Beach, California, according to the affidavit.

At some point, Lowe's network administrators and security personnel detected and began monitoring the intrusions, and called in the FBI. Last Friday evening a Bureau surveillance team staked out the Southfield Lowe's parking lot, and spotted a white Grand Prix with suspicious antennas and two young men sitting inside. The car was registered to Botbl, and the passenger, later identified as Timmins, was seen typing on a laptop.

After 20 minutes, the pair quit for the night, and the FBI followed them to a Little Ceasar's pizza restaurant, then to a local multiplex. While the hackers took in a film, Lowe's network security team poured over log files and determined that the intruders had installed a virtual wiretap in a program that handles credit card transactions for all the Lowe's stores nationwide -- though the altered program had collected only six credit card numbers.

"They were not able to access nationwide credit card files or get into corporate systems," says Lowe's spokesperson Gina Balaya. "They did access six credit card transactions from one store."

Warparking

The scene at the parking lot repeated the next night; this time the FBI watched as the car settled into a spot near the lumber entrance, and driver and passenger worked in parallel on their own laptops.

The Bureau filed a criminal complaint on Monday, and the hackers were each released on an unsecured $10,000 bond, according to a spokesperson for the U.S. Attorney's office in Detroit. They're allowed to use computers only for work and school. Timmins works as a networking specialist for a Michigan software company; Botbyl is a student at the ITT Technical Institute.

Timmins and Botbyl, known online as "noweb4u" and "itszer0" respectively, are also part of the Michigan 2600 scene -- an informal collection of technology geeks that meet, blog, eat pizza and attend hacker conventions together, but generally balk at penetrating systems or otherwise committing felonies.

"My initial reaction when I heard the charges was one of skepticism," says Karl Mozurkewich, founder of the Michigan software company Utropicmedia, and a member of the group. "Eighty percent of the people in the 2600 group in Michigan are more the curious type. There's probably 20 percent that actually want to go out and see what they can get away with."

Timmins declined to discuss the charges; Botbyl could not be reached for comment.

Mozurkewich speculates that the hack may have begun as a war driving exercise -- a legal pastime in which hackers search out and map wireless access points -- that went too far. "The sense I'm getting is they were messing around, and things just snowballed," says Mozurkewich. "We don't agree with this kind of behavior at all, but it's understandable to some point. It just goes to show a certain amount of immaturity."

Security researcher Mark Loveless says Lowe's may have invited trouble. Loveless says he's noticed that at least some Lowe's stores don't take the basic precaution of turning on wi-fi's standard encryption -- called WEP -- to declare their network off limits. "There's a Starbucks near a Lowes that I go to a lot, and I've gone in there with a box running Windows, and actually [connected to] Lowe's network unintentionally," says Loveless. "It kind of pisses me off, because I've used a credit card at Lowe's before."

Balaya, the Lowe's spokesperson, declined to say whether the Southfield store used encryption. "I couldn't release any information about the security of the system," she says.

In February, a jury acquitted Houston security consultant Stefan Puffer of similar federal charges for penetrating a Texas county's wireless network to demonstrate its insecurity to a newspaper reporter. Puffer was not accused of modifying software or stealing data, and the jury concluded that he didn't cause damage to the system.

Copyright ©

Combat fraud and increase customer satisfaction

More from The Register

next story
A black box for your SUITCASE: Now your lost luggage can phone home – quite literally
Breakfast in London, lunch in NYC, and your clothes in Peru
Broadband Secretary of SHEEP sensationally quits Cabinet
Maria Miller finally resigns over expenses row
AT&T threatens to pull out of FCC wireless auctions over purchase limits
Company wants ability to buy more spectrum space in auction
EE dismisses DATA-BURNING glitch with Orange Mail app
Bug quietly slurps PAYG credit - yet EE denies it exists
Like Google, Comcast might roll its own mobile voice network
Says anything's possible if regulators approve merger with Time Warner
Turnbull leaves Australia's broadband blackspots in the dark
New Statement of Expectations to NBN Co offers get-out clauses for blackspot builds
Facebook claims 100 MEEELLION active users in India
Who needs China when you've got the next billion in your sights?
Facebook splats in-app chat, whacks brats into crack yakety-yak app
Jibber-jabbering addicts turfed out just as Zuck warned
prev story

Whitepapers

Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.