Feeds

Wireless hacking bust in Michigan

Warparking

  • alert
  • submit to reddit

Maximizing your infrastructure through virtualization

In a rare wireless hacking prosecution, federal officials this week accused two Michigan men of repeatedly cracking the Lowe's chain of home improvement stores' nationwide network from a 1995 Pontiac Grand Prix parked outside a suburban Detroit store.

Paul Timmins, 22, and Adam Botbyl, 20, were charged Monday with penetrating and intentionally damaging a Lowe's system in violation of the federal Computer Fraud and Abuse Act.

According to an affidavit filed by FBI agent Denise Stemen, intruders first hopped onto the wi-fi network at the Lowe's store in Southfield, Michigan on October 25th, at 11:20 p.m, and used the store's network to access the company's central data center at Lowe's North Carolina headquarters.

They returned at least six times over the following two weeks and used the network to access store networks at seven other Lowe's locations around the country, in Kansas, North Carolina, Kentucky, South Dakota, Florida, and two stores in California. The intruders deployed unspecified hacking software at some of the stores, in once case crashing the point of sale terminals at a Lowe's in Long Beach, California, according to the affidavit.

At some point, Lowe's network administrators and security personnel detected and began monitoring the intrusions, and called in the FBI. Last Friday evening a Bureau surveillance team staked out the Southfield Lowe's parking lot, and spotted a white Grand Prix with suspicious antennas and two young men sitting inside. The car was registered to Botbl, and the passenger, later identified as Timmins, was seen typing on a laptop.

After 20 minutes, the pair quit for the night, and the FBI followed them to a Little Ceasar's pizza restaurant, then to a local multiplex. While the hackers took in a film, Lowe's network security team poured over log files and determined that the intruders had installed a virtual wiretap in a program that handles credit card transactions for all the Lowe's stores nationwide -- though the altered program had collected only six credit card numbers.

"They were not able to access nationwide credit card files or get into corporate systems," says Lowe's spokesperson Gina Balaya. "They did access six credit card transactions from one store."

Warparking

The scene at the parking lot repeated the next night; this time the FBI watched as the car settled into a spot near the lumber entrance, and driver and passenger worked in parallel on their own laptops.

The Bureau filed a criminal complaint on Monday, and the hackers were each released on an unsecured $10,000 bond, according to a spokesperson for the U.S. Attorney's office in Detroit. They're allowed to use computers only for work and school. Timmins works as a networking specialist for a Michigan software company; Botbyl is a student at the ITT Technical Institute.

Timmins and Botbyl, known online as "noweb4u" and "itszer0" respectively, are also part of the Michigan 2600 scene -- an informal collection of technology geeks that meet, blog, eat pizza and attend hacker conventions together, but generally balk at penetrating systems or otherwise committing felonies.

"My initial reaction when I heard the charges was one of skepticism," says Karl Mozurkewich, founder of the Michigan software company Utropicmedia, and a member of the group. "Eighty percent of the people in the 2600 group in Michigan are more the curious type. There's probably 20 percent that actually want to go out and see what they can get away with."

Timmins declined to discuss the charges; Botbyl could not be reached for comment.

Mozurkewich speculates that the hack may have begun as a war driving exercise -- a legal pastime in which hackers search out and map wireless access points -- that went too far. "The sense I'm getting is they were messing around, and things just snowballed," says Mozurkewich. "We don't agree with this kind of behavior at all, but it's understandable to some point. It just goes to show a certain amount of immaturity."

Security researcher Mark Loveless says Lowe's may have invited trouble. Loveless says he's noticed that at least some Lowe's stores don't take the basic precaution of turning on wi-fi's standard encryption -- called WEP -- to declare their network off limits. "There's a Starbucks near a Lowes that I go to a lot, and I've gone in there with a box running Windows, and actually [connected to] Lowe's network unintentionally," says Loveless. "It kind of pisses me off, because I've used a credit card at Lowe's before."

Balaya, the Lowe's spokesperson, declined to say whether the Southfield store used encryption. "I couldn't release any information about the security of the system," she says.

In February, a jury acquitted Houston security consultant Stefan Puffer of similar federal charges for penetrating a Texas county's wireless network to demonstrate its insecurity to a newspaper reporter. Puffer was not accused of modifying software or stealing data, and the jury concluded that he didn't cause damage to the system.

Copyright ©

Reducing security risks from open source software

More from The Register

next story
Auntie remains MYSTIFIED by that weekend BBC iPlayer and website outage
Still doing 'forensics' on the caching layer – Beeb digi wonk
Apple orders huge MOUNTAIN of 80 MILLION 'Air' iPhone 6s
Bigger, harder trouser bulges foretold for fanbois
GoTenna: How does this 'magic' work?
An ideal product if you believe the Earth is flat
Telstra to KILL 2G network by end of 2016
GSM now stands for Grave-Seeking-Mobile network
Seeking LTE expert to insert small cells into BT customers' places
Is this the first step to a FON-a-like 4G network?
Yorkshire cops fail to grasp principle behind BT Fon Wi-Fi network
'Prevent people that are passing by to hook up to your network', pleads plod
BlackBerry: Toss the server, mate... BES is in the CLOUD now
BlackBerry Enterprise Services takes aim at SMEs - but there's a catch
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.