How Adversaries Exploit Networks

A crew with a laptop and an antenna, driving past shopping strips in Miami in July 2005 to hunt for wireless networks to break into, picked up the network of a Marshalls clothing store, according to federal court records. Marshalls belongs to the TJX Companies, which also owns T.J. Maxx. The store ran a wireless network for its handheld devices, and the crew could pick it up without setting foot inside. Two things about that network let strangers outside get onto it.

The first is where its signal went. A store's walls stop people, but not radio, and an access point announces its network several times a second in beacon frames that anyone nearby can hear. How near depends on the listener's antenna. A directional antenna, even one built at home from an open metal can, picks up a network from much farther off than a laptop's own. Searching for wireless networks from a car is called wardriving. The second is how it was protected. It used WEP, the first Wi-Fi encryption standard, and by 2005 free tools could recover a WEP key from traffic recorded off the air. With the key, the car's laptop could read the network's traffic and join it.

On a WEP network like this one, the key was often the only thing checked. A device that had it was treated as one of the network's own, with no sign-in and no list of approved devices. And the store's network was connected to the rest of the company. From it, the attackers reached TJX's central servers in Framingham, Massachusetts, collected usernames and passwords, and set up software that copied card numbers as they passed through. They stayed for about a year and a half. TJX discovered the intrusion in December 2006 and announced it in January 2007; at least 45.6 million card numbers had been taken.

The leader of the crew was Albert Gonzalez of Miami, who was working as a Secret Service informant during the same years his crew was breaking into TJX. Federal prosecutors charged him and ten others in August 2008 over the hacking of TJX and eight other retailers and the sale of the stolen card numbers. He pleaded guilty, and in March 2010 a federal judge in Boston sentenced him to 20 years in prison, one of the longest sentences ever imposed in the United States for hacking. TJX put its own costs from the breach at more than 250 million dollars.

Take a high school's network. Where it meets the internet, anyone on the internet can reach it. The router at that edge runs a firewall, which decides what traffic from outside may come in. Without one, or with one set up badly, an adversary anywhere could send the school's network traffic built to do harm.

The school's Wi-Fi is weak in the back corner of the robotics lab, so a student brings a small travel router from home and plugs it into the wall jack behind the parts shelf. It works: the team's laptops get a strong signal, and they're on the school network. The student meant no harm. What has the router changed about who gets onto the school's network, and what they're asked first?

Anyone who knows the travel router's password can now join, or anyone at all if the student left it open, and the router hands each of them straight to the school's network. The school's own checks never see who they are. An access point added this way, without the network's owners setting it up, is called a rogue access point. An adversary could plant one on purpose.

The wall jack was the other half of the problem. The switch behind it accepted whatever was plugged in. A laptop plugged into the same jack would have landed on the school's network just as easily, and from there could flood the switch or pose as another machine, as in MAC flooding and ARP poisoning.

The same switch setting closes both doors: with port security on, the switch port behind the robotics lab jack accepts only the one device the school set it up for, so a travel router plugged in there gets nowhere.