Hackers in a parking lot used a radio antenna to intercept wireless traffic at a Marshall store in St. Paul, capturing employee passwords and accessing TJX's central database in Framingham to steal credit-card numbers worldwide. Security expert Robert Siciliano says the attack required minimal effort and the system was wide open.
Kima, thank you. Breaking news now on a major identity breach. Bianca?
Also tonight, Mark, there's new insight on the TJX security breach, the biggest known theft of credit cards ever, a result of a wireless network at one store. According to the Wall Street Journal, two summers ago at a St. Paul's Marshall store, hackers in the parking lot intercepted wireless data flowing between electronic equipment in the store. They did it with a telescope-like radio antenna, something like this. And once they were in that one store system, the suspects were able to access TJX's main database at Framingham headquarters, stealing employees' usernames and passwords. The hackers created their own accounts on the database. That allowed them to collect credit card numbers remotely from any computer in the world with internet access. Local security expert Robert Siciliano doubts these hackers will ever be captured, and he adds what they did was not hard.
It's really simple. They just sniffed out a wireless connection at this particular store. When they found that wireless connection, they simply just tapped into it, that they decrypted that code wirelessly just using hardware and software that all these hackers have access to. And from there, they were able to get right inside the system. Really didn't take much effort, much planning, um, to get into the system. The system was basically wide open.
Funding Siciliano says consumers have no way of knowing if retailers are protecting their information. According to reports, a lack of firewall and basic security systems led to the breach at TJX. The best advice, he says, check your credit card statements for any fraud. For 18 months, TJX had no idea what was going on. Now it's upgrading its security. Our calls for comment today were not returned.
