How TK Maxx got owned

A month or so ago, it transpired that the UK retailer, TK Maxx, who are owned by the US retailing giant, TJX, has been subjected to the largest single credit card fraud in history. In the UK, the Information Commissioner launched an investigation into whether or not the company had breached data-protection laws. A report in the Wall Street Journal Online has now stated the cause of the security breach, and frankly it scary.

Putting it simply, there wasn't really a security breach because it looks like there wasn't really very much security. According to the WSJ, the retailing giant was using a largely unsecured wireless network to transfer the data between tills, pricing scanner and other devices. This meant that anyone with an antenna and a laptop could sit outside a store and sniff the network, all that was left to do was decode the network traffic, et voila!

What worries me most is that this is not the first time I have heard of such things happening. I recall a conversation I read once whilst on an IRC channel on Dal.Net. It was a number of years ago when IEEE 802.11 was still a fresh and new technology to most. A tiny group of hackers had sat outside the store of a multinational retailer (they didn't say who) and discovered that they had total access to the companies corporate network.

Now these guys were not, in my opinion at least, stealing anything more than bandwidth. It was at a time when wardriving and more importantly warchalking was a very niche hacky type thing to do. The mission was to find free bandwidth and use it, downloads to get you know, Napster was still king back in those days (N.B. Stealing bandwidth will get you prosecuted today in case you don't know).

The point was though, that concern over security when coupled with wireless was rarely thought of, and the impact has the potential to be disastrous. This sort of "network leak" is not new of course, there are tales years ago of the manager who would bring a modem into work and connect his machine to the Internet whilst still being on his corporate network creating a route in for the black hat mischief maker.

Another story I recall was of a hospital in the UK where someone had installed an unsecured wireless access point for their own usage without speaking to the internal system and network team. The result was a wardriver found it. Thankfully that wardriver was also ethical and informed the hospital that they had a massive security hole (imagine the mess someone could do shutting down key hospital systems? It doesn't bear thinking about).

I also know of one major UK ISP which actually ended up disabling its entire wireless network when it was realised that the team who set it up had failed to segment it properly. When the more nerdy people in the company found that the ISP's geographical location was mapped on a warchalking website it was turned off straight away.

Wireless is undoubtedly a fantastic technology, but it seems that even though it's been around for ten years, there is a still a lack of consideration taken by "professionals" when they implement it. In a corporate network, wireless should only really be used within a DMZ if you can help it.

The bottom line is simple, if you're going to use wireless in your business then first thing to do is to secure it with a strong 128bit encryption key, and the second thing to do is demilitarize it too... unless of course you actually want someone else to own your network.