Intellectual Property Law

Study Reveals Large Holes in NYC Retailer Wireless Security

By IBLS Editor

The recent National Retail Federation trade show in New York City had a surprise that shocked many small business owners when WLAN wireless defense company AirDefense announced it had tested wireless business security in Gotham and found it at an appallingly bad level. The study was conducted just before the show and the specific results then disclosed to attendees, taken from an under-cover four-day scan of local retailers' wireless nets. The search of almost 800 stores in the five NYC boroughs was conducted between Thursday, Jan. 10th and Sunday, Jan. 13th. The show was held January 14-16, 2008, at the Javits Center, 655 West 34th Street, New York City.

Unbelievably, a third of the stores had no security at all -- not even minimal encryption as found on basic Wired Equivalent Privacy (WEP) protocol. Another third had weak encryption, the type intended as basic security for home wireless. The last third of retailers had an acceptable level of security to protect consumers, according to AirDefense Chief Security Officer Richard Rushing. But only one in ten had stellar defenses. Stated Rushing, "AirDefense discovered less than ten percent (10 %) of the 458 Access Points (APs) in use at NRF were using 'bullet proof' encryption such as WPA2." He added, "These are the first retail stores we've seen with bulletproof [wireless] security."

Rushing summed up his analysis by remarking, "It is evident that the majority of companies exhibiting are not taking wireless security seriously or there would be a much higher percentage of 'bullet proof' encryption practices in place protecting APs.  AirDefense also discovered less than one percent of devices were pre-802.11n as retailers are waiting for this standard to be ratified and new technology deployments are lagging as a result. In that respect, retail is taking a wait-and-see approach similar to the Fortune 500, healthcare industry and banking industry."

Rushing also warned that the "Evil Twins" of wireless attack were noted, claiming 80% of the nearly 1,700 wireless devices such as laptops, PDAs, phones and vendor PCs were susceptible to this scourge. He defined "Evil Twins" as the "wireless version of email phishing scams, a technique whereby an attacker tricks victims into connecting to a laptop or PDA by posing as a legitimate hotspot."

While Rushing has conducted similar surveys of large retailers throughout Manhattan in the past, but this time he tested smaller stores. His method was simple, as he went by foot with a notebook PC running the AirDefense monitoring and analysis software, while testing the WLAN traffic in each store. He did not connect to the landlines of these nets or attempt to launch penetration attacks.

One specific detail of the report should send chills up the spine of any retailer and ought to bother shoppers in the Big Apple, as well: AirDefense reports, "Attack tools such as Karma, Hotspotter, and Airsnarf were all seen in the airwaves, trying to capture the probing devices to take advantage of them." So New York thieves are well-ware of this wireless retail security gap and are busily exploiting it. Obviously, the bad guys are light-years ahead of the retail owners as these scam artists are happily ripping off businesses and customers, who are oblivious to the danger.  There are obvious legal ramifications of allowing such shoddy wireless defenses of customers.

Some of the other findings that AirDefense noted were a great deal of antiquated equipment being used, and that retailers regularly gave out such sensitive information as "internal network such as Domain, Authentication Server, User Name, Password and Computer Name?An attacker could and might have captured the corporate username and authentication hash (password), that the unsuspecting user would have sent over the airwaves by just connecting to the wireless network."

Further, many laptops had altered their addresses to try and bypass security systems. And thieves were doing this as well, with, "Large number of users attempting to jam the wireless signals, either by broadcasting a signal to overload the channel or using common techniques to overload Access Points, or the Channel, where thirty-nine (39) of these attacks were found." In addition to the lack of security, the retailers in New York are also fighting for space in the wireless web, as almost 80% had retransmit messages and data for them to finally get through.

Overall, one hopes that the store owners have now realized what danger they are putting their customers and themselves in when they fail to take even the most basic steps towards wireless security.

Full post as published by IBLS Internet Law Blog on January 16, 2008 (boomark / email).