Hacking the worlds largest mall

renderman · 01-18-2008

crossposted from the DC forums:

So with the TJX data loss in the news I decided to see if a year later anyone has learned anything.
During the busy holiday shopping season, I audited the wireless networks of retailers in West Edmonton Mall, one of the biggest malls in the world.

In short: No one has learned anything

As well I took the opportunity to scan the bluetooth devices of the shopping public. over 400 devices later, it seems the public needs a bit of schooling on proper bluetooth security

The Renderlab: Hacking West Edmonton Mall

streaker69 · 01-18-2008

Isn't the Mall of America the worlds largest mall?

bobfunland · 01-18-2008

Quote:

Originally Posted by streaker69

Isn't the Mall of America the worlds largest mall?

Nope, only in America.
World's Largest Shopping Malls

Barry · 01-18-2008

Quote:

Originally Posted by streaker69

Isn't the Mall of America the worlds largest mall?

He said one of the biggest malls. Don't they teach you amish guys how to read?

streaker69 · 01-18-2008

Quote:

Originally Posted by Barry

He said one of the biggest malls. Don't they teach you amish guys how to read?

Yes, how about you alaskonians read the thread title.

renderman · 01-18-2008

It all depends on how your measuring things and what counts. Some lists don't take the amusement park or water park into account.

At any rate, it's friggin huge.

Barry · 01-18-2008

Quote:

Originally Posted by streaker69

Yes, how about you alaskonians read the thread title.

Yea, missed that part. My bad.

beakmyn · 01-18-2008

Nice article. Because I notice these things you may want to run grammar check there's some issues with allot/alot/a lot and use of possesive.

I've used a few wireless barcode scanner from Symbol. Some are just WM2003 PDA running proprietary frontends to the the backend SQL database. They send the barcode being scanned back. And they play solitare

I've got a symbol wireless scanner at my desk now for a client. I'll grab the FCC ID. It pairs with the base. But I don't believe it normal 2.4Ghz wireless. The local supermarket uses bluetooth scanners at the checked (paired with base stations)

Oh and if you want to have fun. Watch the bluetooth for people's name and them call them out to see who looks. If you're really evil you take it farther. Ned? Ned Ryerson?!

streaker69 · 01-18-2008

Quote:

Originally Posted by beakmyn

Oh and if you want to have fun. Watch the bluetooth for people's name and them call them out to see who looks. If you're really evil you take it farther. Ned? Ned Ryerson?!

If you've never been to Punxsutawney, you really need to visit it sometime.

renderman · 01-18-2008

Quote:

Originally Posted by beakmyn

Nice article. Because I notice these things you may want to run grammar check there's some issues with allot/alot/a lot and use of possesive.

I've used a few wireless barcode scanner from Symbol. Some are just WM2003 PDA running proprietary frontends to the the backend SQL database. They send the barcode being scanned back. And they play solitare

I've got a symbol wireless scanner at my desk now for a client. I'll grab the FCC ID. It pairs with the base. But I don't believe it normal 2.4Ghz wireless. The local supermarket uses bluetooth scanners at the checked (paired with base stations)

Oh and if you want to have fun. Watch the bluetooth for people's name and them call them out to see who looks. If you're really evil you take it farther. Ned? Ned Ryerson?!

When you type out the article in vi on the server direct, there's not much for grammar checking. I'll import it into OO over the weekend and find the problems.

I can understand things like the symbol barcode scanners not being able to support WPA, but that scares me when that network hooks into your database and presumably is not scrubbing the input. Lot's of stock can go missing quickly if the database is tinkered with

streaker69 · 01-18-2008

Quote:

Originally Posted by renderman

When you type out the article in vi on the server direct, there's not much for grammar checking. I'll import it into OO over the weekend and find the problems.

I can understand things like the symbol barcode scanners not being able to support WPA, but that scares me when that network hooks into your database and presumably is not scrubbing the input. Lot's of stock can go missing quickly if the database is tinkered with

No, that kind of thing never happens, no one ever exploits that kind of thing. /sarcasm

BarCode Thieves Steal from Walmart Stores and Target - Mr Wave Theory

wrzwaldo · 01-19-2008

Well done renderman!

renderman · 1 Week Ago

Quick update.

Greyhatter and others were curious about the number of WEP/WPA/OPEN nets discovered. I ran some quick tools to get stats. These include the public nets for the mall and hotel, but still give you an idea of what's there:

The Renderlab: Statistics for wireless devices in West Edmonton Mall

For the impatient:

Total found Networks: 489
Access-Points: 427 / 87%
Ad-Hoc: 5 / 1%
Other: 57 / 12%

WEP encrypted: 105 / 21%
WPA encrypted: 136 / 28%
Not encrypted: 248 / 51%

Hidden ESSID: 79 / 19%

Channel:
1: 117 / 24%
2: 2 / 0%
3: 5 / 1%
4: 10 / 2%
5: 2 / 0%
6: 165 / 34%
7: 3 / 1%
8: 8 / 2%
9: 6 / 1%
10: 1 / 0%
11: 113 / 23%
12: 0 / 0%
13: 0 / 0%
14: 0 / 0%

DaKahuna · 6 Days Ago

I think I'll take my EEE PC to the mall with me on my next trip and see what I get there. Will not be able to do GPS as it is fully enclosed but it would be interesting to see how many there are at this mall.

I was standing outside the Apple Store today and picked up 12 Apple's (Mostly Air and iMAC) and 4 phones running bluetooth. I think that would be a good thing to scan at the mall also - what bluetooth devices are running.

brwrdrvr · 6 Days Ago

Quote:

Originally Posted by DaKahuna

I think I'll take my EEE PC to the mall with me on my next trip and see what I get there. Will not be able to do GPS as it is fully enclosed but it would be interesting to see how many there are at this mall.

I was standing outside the Apple Store today and picked up 12 Apple's (Mostly Air and iMAC) and 4 phones running bluetooth. I think that would be a good thing to scan at the mall also - what bluetooth devices are running.

Scan for bluetooth as you drive around town. You will be amazed. Also when you go somewhere to shop, park as close to the main walking path to the entrance as you can and leave the scanner running. Most people have no idea that their phone's bluetooth are enabled and discoverable.

This is what I do because I hate to shop, so I sit in the van and scan. Oh and before someone says something. No I have never been questioned by security. I don't look as suspicious as some of you do. Even in a van.

01-18-2008	#1 (permalink)
renderman Drunken Stumbler Join Date: Jun 2002 Location: Anywhere but Utah Posts: 1,781	Hacking the worlds largest mall crossposted from the DC forums: So with the TJX data loss in the news I decided to see if a year later anyone has learned anything. During the busy holiday shopping season, I audited the wireless networks of retailers in West Edmonton Mall, one of the biggest malls in the world. In short: No one has learned anything As well I took the opportunity to scan the bluetooth devices of the shopping public. over 400 devices later, it seems the public needs a bit of schooling on proper bluetooth security The Renderlab: Hacking West Edmonton Mall __________________ Never drink anything larger than your head! Scaramental Wine Taster for the Church Of WiFi Buy our book: RFID Security "I reject your reality, and substitute my own!" – Adam Savage CoWF WPA Hash Tables

01-18-2008	#2 (permalink)
streaker69 Psychic Amish Stumbler Join Date: Jul 2004 Location: Virginville, BlueBall, Bird In Hand, Intercourse, Paradise, PA Posts: 11,532	Isn't the Mall of America the worlds largest mall? __________________ "One of these days, I'm going to cut you to pieces." If you're offended by this post, please feel free to report it to one of the many helpful moderators of this forum. Thank you.

01-18-2008	#6 (permalink)
renderman Drunken Stumbler Join Date: Jun 2002 Location: Anywhere but Utah Posts: 1,781	It all depends on how your measuring things and what counts. Some lists don't take the amusement park or water park into account. At any rate, it's friggin huge. __________________ Never drink anything larger than your head! Scaramental Wine Taster for the Church Of WiFi Buy our book: RFID Security "I reject your reality, and substitute my own!" – Adam Savage CoWF WPA Hash Tables

01-18-2008	#8 (permalink)
beakmyn root\.workspace\.garbage. Join Date: Aug 2003 Posts: 4,735	Nice article. Because I notice these things you may want to run grammar check there's some issues with allot/alot/a lot and use of possesive. I've used a few wireless barcode scanner from Symbol. Some are just WM2003 PDA running proprietary frontends to the the backend SQL database. They send the barcode being scanned back. And they play solitare I've got a symbol wireless scanner at my desk now for a client. I'll grab the FCC ID. It pairs with the base. But I don't believe it normal 2.4Ghz wireless. The local supermarket uses bluetooth scanners at the checked (paired with base stations) Oh and if you want to have fun. Watch the bluetooth for people's name and them call them out to see who looks. If you're really evil you take it farther. Ned? Ned Ryerson?! __________________ No matter where you go, there you are. ┌──────────────────────────────┐ ╞ NS Icons Explained\|et hoc genus omne ╡ └──────────────────────────────┘ Last edited by beakmyn : 01-18-2008 at 05:50 PM.

1 Week Ago	#13 (permalink)
renderman Drunken Stumbler Join Date: Jun 2002 Location: Anywhere but Utah Posts: 1,781	Quick update. Greyhatter and others were curious about the number of WEP/WPA/OPEN nets discovered. I ran some quick tools to get stats. These include the public nets for the mall and hotel, but still give you an idea of what's there: The Renderlab: Statistics for wireless devices in West Edmonton Mall For the impatient: Total found Networks: 489 Access-Points: 427 / 87% Ad-Hoc: 5 / 1% Other: 57 / 12% WEP encrypted: 105 / 21% WPA encrypted: 136 / 28% Not encrypted: 248 / 51% Hidden ESSID: 79 / 19% Channel: 1: 117 / 24% 2: 2 / 0% 3: 5 / 1% 4: 10 / 2% 5: 2 / 0% 6: 165 / 34% 7: 3 / 1% 8: 8 / 2% 9: 6 / 1% 10: 1 / 0% 11: 113 / 23% 12: 0 / 0% 13: 0 / 0% 14: 0 / 0% __________________ Never drink anything larger than your head! Scaramental Wine Taster for the Church Of WiFi Buy our book: RFID Security "I reject your reality, and substitute my own!" – Adam Savage CoWF WPA Hash Tables

01-19-2008	#12 (permalink)
wrzwaldo I amuse you? Join Date: Dec 2003 Posts: 9,136	Well done renderman!

6 Days Ago	#14 (permalink)
DaKahuna Dirty Ol' Man Join Date: Jan 2006 Location: If you find out, let me know! Posts: 394	I think I'll take my EEE PC to the mall with me on my next trip and see what I get there. Will not be able to do GPS as it is fully enclosed but it would be interesting to see how many there are at this mall. I was standing outside the Apple Store today and picked up 12 Apple's (Mostly Air and iMAC) and 4 phones running bluetooth. I think that would be a good thing to scan at the mall also - what bluetooth devices are running.

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode