Feeds

Wireless hacking bust in Michigan

Warparking

  • alert
  • submit to reddit

Business security measures using SSL

In a rare wireless hacking prosecution, federal officials this week accused two Michigan men of repeatedly cracking the Lowe's chain of home improvement stores' nationwide network from a 1995 Pontiac Grand Prix parked outside a suburban Detroit store.

Paul Timmins, 22, and Adam Botbyl, 20, were charged Monday with penetrating and intentionally damaging a Lowe's system in violation of the federal Computer Fraud and Abuse Act.

According to an affidavit filed by FBI agent Denise Stemen, intruders first hopped onto the wi-fi network at the Lowe's store in Southfield, Michigan on October 25th, at 11:20 p.m, and used the store's network to access the company's central data center at Lowe's North Carolina headquarters.

They returned at least six times over the following two weeks and used the network to access store networks at seven other Lowe's locations around the country, in Kansas, North Carolina, Kentucky, South Dakota, Florida, and two stores in California. The intruders deployed unspecified hacking software at some of the stores, in once case crashing the point of sale terminals at a Lowe's in Long Beach, California, according to the affidavit.

At some point, Lowe's network administrators and security personnel detected and began monitoring the intrusions, and called in the FBI. Last Friday evening a Bureau surveillance team staked out the Southfield Lowe's parking lot, and spotted a white Grand Prix with suspicious antennas and two young men sitting inside. The car was registered to Botbl, and the passenger, later identified as Timmins, was seen typing on a laptop.

After 20 minutes, the pair quit for the night, and the FBI followed them to a Little Ceasar's pizza restaurant, then to a local multiplex. While the hackers took in a film, Lowe's network security team poured over log files and determined that the intruders had installed a virtual wiretap in a program that handles credit card transactions for all the Lowe's stores nationwide -- though the altered program had collected only six credit card numbers.

"They were not able to access nationwide credit card files or get into corporate systems," says Lowe's spokesperson Gina Balaya. "They did access six credit card transactions from one store."

Warparking

The scene at the parking lot repeated the next night; this time the FBI watched as the car settled into a spot near the lumber entrance, and driver and passenger worked in parallel on their own laptops.

The Bureau filed a criminal complaint on Monday, and the hackers were each released on an unsecured $10,000 bond, according to a spokesperson for the U.S. Attorney's office in Detroit. They're allowed to use computers only for work and school. Timmins works as a networking specialist for a Michigan software company; Botbyl is a student at the ITT Technical Institute.

Timmins and Botbyl, known online as "noweb4u" and "itszer0" respectively, are also part of the Michigan 2600 scene -- an informal collection of technology geeks that meet, blog, eat pizza and attend hacker conventions together, but generally balk at penetrating systems or otherwise committing felonies.

"My initial reaction when I heard the charges was one of skepticism," says Karl Mozurkewich, founder of the Michigan software company Utropicmedia, and a member of the group. "Eighty percent of the people in the 2600 group in Michigan are more the curious type. There's probably 20 percent that actually want to go out and see what they can get away with."

Timmins declined to discuss the charges; Botbyl could not be reached for comment.

Mozurkewich speculates that the hack may have begun as a war driving exercise -- a legal pastime in which hackers search out and map wireless access points -- that went too far. "The sense I'm getting is they were messing around, and things just snowballed," says Mozurkewich. "We don't agree with this kind of behavior at all, but it's understandable to some point. It just goes to show a certain amount of immaturity."

Security researcher Mark Loveless says Lowe's may have invited trouble. Loveless says he's noticed that at least some Lowe's stores don't take the basic precaution of turning on wi-fi's standard encryption -- called WEP -- to declare their network off limits. "There's a Starbucks near a Lowes that I go to a lot, and I've gone in there with a box running Windows, and actually [connected to] Lowe's network unintentionally," says Loveless. "It kind of pisses me off, because I've used a credit card at Lowe's before."

Balaya, the Lowe's spokesperson, declined to say whether the Southfield store used encryption. "I couldn't release any information about the security of the system," she says.

In February, a jury acquitted Houston security consultant Stefan Puffer of similar federal charges for penetrating a Texas county's wireless network to demonstrate its insecurity to a newspaper reporter. Puffer was not accused of modifying software or stealing data, and the jury concluded that he didn't cause damage to the system.

Copyright ©

Security and trust: The backbone of doing business over the internet

More from The Register

next story
Brit telcos warn Scots that voting Yes could lead to HEFTY bills
BT and Co: Independence vote likely to mean 'increased costs'
Phones 4u slips into administration after EE cuts ties with Brit mobe retailer
More than 5,500 jobs could be axed if rescue mission fails
ISPs' post-net-neutrality world is built on 'bribes' says Tim Berners-Lee
Father of the worldwide web is extremely peeved over pay-per-packet-type plans
New 'Cosmos' browser surfs the net by TXT alone
No data plan? No WiFi? No worries ... except sluggish download speed
Radio hams can encrypt, in emergencies, says Ofcom
Consultation promises new spectrum and hints at relaxed licence conditions
Turnbull: NBN won't turn your town into Silicon Valley
'People have been brainwashed to believe that their world will be changed forever if they get FTTP'
Google+ GOING, GOING ... ? Newbie Gmailers no longer forced into mandatory ID slurp
Mountain View distances itself from lame 'network thingy'
Blockbuster book lays out the first 20 years of the Smartphone Wars
Symbian's David Wood bares all. Not for the faint hearted
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.