I really wasn't recommending WEP, as such (though it's certainly better than nothing). IMHO, whether or not Lowe's was using WEP is relevant context to the story, not because WEP would have prevented intrusions altogether, but because it serves as a no-trespassing sign and a barrier against casual entry.

If they weren't using WEP, were running a DHCP server and their access points were beaconing (none of which we know for certain), then they were essentially running a private network in a configuration that renders it indistinguishable from a public hotspot, and prone to easy discovery and use.

That's probably not a legal defense if one is caught tampering with software and collecting credit card numbers, but it could shed light on why Lowe's was hit, instead of Ace Hardware or the Home Depot.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/7438/23712#23712