Wlan @ bestbuy is cleartext?

From: Blue Boar (BlueBoar@thievco.com)
Date: 05/01/02


Date: Wed, 01 May 2002 08:57:14 -0700
From: Blue Boar <BlueBoar@thievco.com>
To: vuln-dev@securityfocus.com

I was asked to anonymously proxy this question to the list. Here ya go.

                                                BB

----------------------------------------------------------------------------------------------------

This past week I went to bestbuy to purchase a D-link wlan card... egar to
get my laptop up and running while in the car I put my card in and
installed the driver. I noticed the traffic light was lit up as if I had a
connection. Out of curriosity I fired up kismet and sure enough there were
packets flying through the air right infront of BestBuy. Well I decided to
run in an try to make a Credit Card purchase real quick to verify that my
info was not going all over the parking lot in the clear. Well after
sorting out my logs I noticed what looked to be like SQL queries and table
headers in my logs ... things such as CUSTOMER_ROUTEID, BANKNAME,
REGISTER_ID and things of that nature... luckily no where in that data did
I find my own credit card. Non the less I decided to run to the store next
to BestBuy while I left me PC on grabbing packets. Well yesterday I sorted
through the data collected and this time I did indeed find a RAW clear text
credit card number....not mine ... but definately a credit card number.

Heres my delima... I checked out a few of the other best buy stores for
"beacon packets" and everyone I drove by was sending them out...so I assume
all BestBuy's are wlan enabled. What I need to find out is ... are
BestBuys's Cash register terminals indeed using wlan and are they indeed
sending out MY data in the clear... I am NOT comfortable using my credit
card at ANY BestBuy as of right now... due to legality though I don't feel
comfortable walking into the store and confronting someone about it.... for
all I know it could be standard BestBuy corp. practices to use nonsecure
wlan. I figured by starting a thread other people that have attempted this
may have more info or some from BestBuy may be reading the list and they
may pipe up.

----------------------------------------------------------------------------------------------------



Relevant Pages

  • Re: Wlan @ bestbuy is cleartext?
    ... BB's bank won't guarantee the Best Buy Card any more, ... Wlan @ bestbuy is cleartext? ...
    (Vuln-Dev)
  • Re: eMusic via BestBuy
    ... At BestBuy you can buy a card for 100 "songs" (probably now defined at the ... latter is a cent per credit cheaper than my new subscription rate ...
    (rec.music.makers.guitar.jazz)
  • Re: video card recommendation
    ... their card so I may just run by Bestbuy and buy whatever they have ... I know I'll pay a bit more at Bestbuy but I can have it ... Sympton is funny characters on screen or ghost characters on ... screen regardless of OS / drivers. ...
    (alt.sys.pc-clone.dell)
  • RE: Wlan @ bestbuy is cleartext?
    ... I think it was definitely noteworthy Blue Boar ... As far as BestBuy may already know; ... gathering credit card numbers, think about it. ... Wlan @ bestbuy is cleartext? ...
    (Vuln-Dev)
  • FW: Wlan @ bestbuy is cleartext?
    ... I think it was definitely noteworthy Blue Boar ... As far as BestBuy may already know; ... credit card numbers, think about it. ... Wlan @ bestbuy is cleartext? ...
    (Vuln-Dev)