Security Focus reports, a Michigan man entered a guilty plea last Friday in federal court in Charlotte, North Carolina for his role in a scheme to steal credit card numbers from the Lowe’s chain of home improvement stores by taking advantage of an unsecured Wi-Fi network at a store in suburban Detroit.
Brian Salcedo, 21, faces an a unusually harsh 12 to 15 year prison term under federal sentencing guidelines, based largely on a stipulation that the potential losses in the scheme exceeded $2.5m. But Salcedo has agreed to cooperate with the government in the prosecution of one or more other suspects, making him eligible for a sentence below the guideline range.
According to statements provided by Timmins and Botbyl following their arrest, as recounted in an FBI affidavit filed in the case, the pair first stumbled across an unsecured wireless network at the Southfield, Michigan Lowe’s last spring, while “driving around with laptop computers looking for wireless Internet connections,” i.e., wardriving. The two said they did nothing malicious with the network at that time.
It was six months later that Botbyl and his friend Salcedo hatched a plan to use the network to steal credit card numbers from the hardware chain, according to the affidavit.
The hackers used the wireless network to route through Lowe’s corporate data center in North Carolina and connect to the local networks at stores in Kansas, North Carolina, Kentucky, South Dakota, Florida, and two stores in California. At two of the stores – in Long Beach, California and Gainseville, Florida – they modified a proprietary piece of software called “tcpcredit” that Lowe’s uses to process credit card transactions, building in a virtual wiretap that would store customer’s credit card numbers where the hackers could retrieve them later.
At some point, Lowe’s network administrators and security personnel detected and began monitoring the intrusions, and called in the FBI. In November, a Bureau surveillance team staked out the Southfield Lowe’s parking lot, and spotted a white Grand Prix with suspicious antennas and two young men sitting inside, one of them typing on a laptop from the passenger seat, according to court documents. The car was registered to Botbyl.
The Lowe’s Wi-Fi system was installed to allow scanners and telephones to connect to the store’s network without the burden of cables, according to the indictment.
WiFi Planet offers some security tips.
