, SecurityFocus 2003-11-12
In a rare wireless hacking prosecution, federal officials this week accused two Michigan men of repeatedly cracking the Lowe's chain of home improvement stores' nationwide network from a 1995 Pontiac Grand Prix parked outside a suburban Detroit store.Paul Timmins, 22, and Adam Botbyl, 20, were charged Monday with penetrating and intentionally damaging a Lowe's system in violation of the federal Computer Fraud and Abuse Act.
According to an affidavit filed by FBI agent Denise Stemen, intruders first hopped onto the wi-fi network at the Lowe's store in Southfield, Michigan on October 25th, at 11:20 p.m, and used the store's network to access the company's central data center at Lowe's North Carolina headquarters.
They returned at least six times over the following two weeks and used the network to access store networks at seven other Lowe's locations around the country, in Kansas, North Carolina, Kentucky, South Dakota, Florida, and two stores in California. The intruders deployed unspecified hacking software at some of the stores, in one case crashing the point of sale terminals at a Lowe's in Long Beach, California, according to the affidavit.
At some point, Lowe's network administrators and security personnel detected and began monitoring the intrusions, and called in the FBI. Last Friday evening a Bureau surveillance team staked out the Southfield Lowe's parking lot, and spotted a white Grand Prix with suspicious antennas and two young men sitting inside. The car was registered to Botbl, and the passenger, later identified as Timmins, was seen typing on a laptop.
After 20 minutes, the pair quit for the night, and the FBI followed them to a Little Ceasar's pizza restaurant, then to a local multiplex. While the hackers took in a film, Lowe's network security team poured over log files and determined that the intruders had installed a virtual wiretap in a program that handles credit card transactions for all the Lowe's stores nationwide -- though the altered program had collected only six credit card numbers.
"They were not able to access nationwide credit card files or get into corporate systems," says Lowe's spokesperson Gina Balaya. "They did access six credit card transactions from one store."
The scene at the parking lot repeated the next night; this time the FBI watched as the car settled into a spot near the lumber entrance, and driver and passenger worked in parallel on their own laptops.
The Bureau filed a criminal complaint on Monday, and the hackers were each released on an unsecured $10,000 bond, according to a spokesperson for the U.S. Attorney's office in Detroit. They're allowed to use computers only for work and school. Timmins works as a networking specialist for a Michigan software company; Botbyl is a student at the ITT Technical Institute.
Timmins and Botbyl, known online as "noweb4u" and "itszer0" respectively, are also part of the Michigan 2600 scene -- an informal collection of technology geeks that meet, blog, eat pizza and attend hacker conventions together, but generally balk at penetrating systems or otherwise committing felonies.
"My initial reaction when I heard the charges was one of skepticism," says Karl Mozurkewich, founder of the Michigan software company Utropicmedia, and a member of the group. "Eighty percent of the people in the 2600 group in Michigan are more the curious type. There's probably 20 percent that actually want to go out and see what they can get away with."
Timmins declined to discuss the charges; Botbyl could not be reached for comment.
Mozurkewich speculates that the hack may have begun as a war driving exercise -- a legal pastime in which hackers search out and map wireless access points -- that went too far. "The sense I'm getting is they were messing around, and things just snowballed," says Mozurkewich. "We don't agree with this kind of behavior at all, but it's understandable to some point. It just goes to show a certain amount of immaturity."
Security researcher Mark Loveless says Lowe's may have invited trouble. Loveless says he's noticed that at least some Lowe's stores don't take the basic precaution of turning on wi-fi's standard encryption -- called WEP -- to declare their network off limits. "There's a Starbucks near a Lowes that I go to a lot, and I've gone in there with a box running Windows, and actually [connected to] Lowe's network unintentionally," says Loveless. "It kind of pisses me off, because I've used a credit card at Lowe's before."
Balaya, the Lowe's spokesperson, declined to say whether the Southfield store used encryption. "I couldn't release any information about the security of the system," she says.
In February, a jury acquitted Houston security consultant Stefan Puffer of similar federal charges for penetrating a Texas county's wireless network to demonstrate its insecurity to a newspaper reporter. Puffer was not accused of modifying software or stealing data, and the jury concluded that he didn't cause damage to the system.