Security Sweep Finds Retailer's Wi-Fi Networks At Risk

Datamation content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.

Despite the well-publicized wireless woes of retailer TJX earlier this year, it seems many retailers have failed to move to protect themselves from the loss of customer data.

AirDefense, the Alphretta, Georgia-based wireless intrusion prevention vendor, conducted a “war drive” survey recently of over 3,000 retailers in eight major cities–Atlanta, Boston, Chicago, Los Angeles, New York City, San Francisco, London and Paris.

In those locations, 2,500 wireless devices were discovered by wireless
monitors, and 85 percent of the devices could be compromised in one way or
another due to flaws in security configurations.

In fact, AirDefense found that 25 percent of retailers use either Wired
Equivalency Protocol (WEP) encryption — the weakest level of encryption that can be broken in under a minute — or no encryption at all to protect
their wireless data.

After a number of high-profile cases of retail data loss involving wireless networks, “I would hope there was more awareness,” said Richard Rushing, the chief security officer of AirDefense. “I had hopes and dreams that it would be better. But my dreams were dashed after the first shopping center.”

Rushing wasn’t entirely surprised by the findings—they were an improvement over past AirDefense war drives of retail establishments “I remember doing retailers before, and it was 85 to 90 percent that were unencrypted a few years ago.”

However, he was still taken aback by the scale of the vulnerabilities “I thought that the Payment Card Industry (PCI) standard would have forced fixes. But the problem was they never looked at their wireless networks after they did PCI.”

Visa and MasterCard had set a deadline for retailers to comply
with with PCI for handling credit card data passed in June of 2005. In September of 2006, American Express, JCB. Discover Financial Services joined MasterCard and Visa to form the PCI Security Standards Council, and the standard was expanded across all
their payment card brands.

The standard requires merchants to build and maintain a secure network, firewalling cardholder data from the rest of the network. It also requires encrypted transmission of
cardholder data.

Yet, despite these requirements, many retail networks remain vulnerable—even after they’ve allegedly complied with PCI standards.

“Fifty percent of the networks are leaking out traffic that has no business being leaked out,” said Rushing. “And you have to assume some of this is consumer transactions.”

Some legacy devices, like barcode scanners, attach to the closest wireless access point available, he said. This means that someone could easily spoof a wireless access point with a laptop or handheld PC and obtain information on how to connect to the network. All it takes for me is to come closer, and say, ‘I’m an access point.’ It’s the same as how a Bluetooth handset would always connect to the closest phone.”

As a result of devices like these, and misconfigured or unsecured networks, the war drive found that over half of the retail networks checked were “enticing to hackers,” Rushing said. Aside from the 25 percent that were essentially unprotected, many were otherwise misconfigured and carried a wide variety of corporate network traffic.

It was weak encryption that led to the theft of customer credit card
data from TJX, the parent company of T.J. Maxx, Marshalls, HomeGoods
and other stores. Last January, the company admitted that hackers
had stolen data from over 45 million credit and debit card
transactions over a two-year period.

This article was first published on InternetNews.com. To read the full article, click here.