Security and Car Dealers: The Hidden Truth

mechmike0034 · 07-20-2007, 02:22 PM

I think this fits better here...

Quote:

This morning I grabbed a new laptop and took a trip to a few dealerships in my area to check out security.

Quote:

The Method

I decided before I started this that I would try the same techniques on each store. To make it fair I did them in the same order and in the same way. I was going to wear a lab coat as well but I thought that might stand out. Here’s what I did:

· I scanned for a wireless network and if it existed I tried to connect to it

· I went into each dealership and asked if I could use their internet connection to check my email

· I used a freeware packet sniffer to detect and record network traffic

· I used a printer reverse decryption program to read documents intended for a printer

· I spent zero money on software products beyond the Vista software on the machine

· I used the built-in Windows networking features to check out anything I could that was freely available without a password. If the file, directory or computer had security on it I made no attempt to open it or download it.

The Results

If you have a seatbelt on your office chair now would be a good time to buckle up: The results are really unbelievable. I’m chomping at the bit here to write the conclusions section here but I won’t if you promise that you will read to the end:

· 5 out of 5 dealers had wireless networks at the dealership. 4 out of the 5 actually had multiple wireless access points and in ALL cases I was able to access the dealership network by simply hitting the “connect” button. It’s important to note that some of these networks were ‘ad-hoc’ networks and were obviously created for the use of one or two people using a $60 usb instant wireless network product (the kind used by many consultants and trainers to run their laptops)

· Every store let me hook up my laptop to their network without objection. Two stores actually instructed staff to get me a private room and a network cable.

· Packet sniffing each of the networks was like being in a Harrison Ford movie. Social Security numbers, credit results and huge amounts of personal information just started streaming into my machine. All of the dealerships I sampled offered a huge amount of data available for the asking.

· Printer page interception was more difficult but offered far more data than the packet sniffing. Where the packet sniffing needed to be assembled after the data was downloaded, the printer was always sent a complete page of information. It was very easy to get a nice package of info on every customer who was penciled or bought a car.

· File downloads from unsecure directories included reams of pornography, staff reviews, customer spreadsheets and just about everything you can imagine. Several computers had text files or Excel spreadsheets including passwords for store systems etc. There was virtually no security anywhere once on the network.

This is frightening, and probably not atypical...

Showtime · 07-20-2007, 02:52 PM

So many ways to avoid this.

renovation · 07-20-2007, 04:02 PM

Quote:

Originally Posted by mechmike0034

I think this fits better here...

This is frightening, and probably not atypical...

i bet its very typical .i know some car salesman and they bring there own laptops into work all the time. im guessing its a unsucure network they share to get info .most small companys under lets say 100 workers dont keep a tech staff on hand .

Jeffbx · 07-23-2007, 06:24 AM

Doesn't surprise me in the least. Since dealerships are independently owned & operated, I'm sure their IT department is nothing more than one of the guys that works there that happens to know how to install wireless routers. I'd bet most dentist & doctor's offices (outside of hospitals) are exactly the same.

beatbox32 · 07-23-2007, 10:35 AM

Quote:

Originally Posted by Jeffbx

Doesn't surprise me in the least. Since dealerships are independently owned & operated, I'm sure their IT department is nothing more than one of the guys that works there that happens to know how to install wireless routers. I'd bet most dentist & doctor's offices (outside of hospitals) are exactly the same.

I'm currently a contractor at a large Japanese automotive company. I work with dealers every day on a technical basis and you're almost spot on...except for the fact that they don't even know how to install a wireless router and you need to walk them through that. Imagine the incompetent guy in the parts dept that has a hard time just working within his Windows PC, and then have him maintaining every technical aspect of the dealership.

Scary!

-beatbox32

gwilks98 · 07-23-2007, 11:21 AM

I'm curious to know if he picked up any network traffic while plugged into their network, vs. sitting on the wireless network.

Napoleon54 · 07-23-2007, 11:45 AM

wow.

Paymaster · 07-23-2007, 01:23 PM

I got stuck at a dealership in the middle of nowhere recently. I pulled out my laptop hoping I could get some work done, and there were no wireless networks available at all. Sounds like I found one of the few!

07-20-2007, 02:52 PM	#2
Showtime Lakers fanatic Join Date: Sep 2000 Location: L.A. ->SoCal<- O.C. Posts: 7,338	So many ways to avoid this. __________________ NBA REPORT 10-11/ The 3-Peat! 1948 1949 1950 1952 1953 1954 1972 1980 1982 1985 1987 1988 2000 2001 2002 2009 2010 Reigning NBA CHAMPS!

07-23-2007, 11:21 AM	#6
gwilks98 Vice Admiral Join Date: Aug 2000 Location: StL Posts: 4,300	I'm curious to know if he picked up any network traffic while plugged into their network, vs. sitting on the wireless network. __________________ "I know the pieces fit, cause I watched them fall away." "Cold silence has A tendancy to Atrophy any Sense of compassion." MJK

07-23-2007, 11:45 AM	#7
Napoleon54 Vice Admiral Join Date: Aug 2001 Location: floating inside of a giant egg made of stars Posts: 4,861	wow. __________________ There is all the difference in the world between treating people equally and attempting to make them equal. - Friedrich Hayek

07-23-2007, 01:23 PM	#8
Paymaster Commander Join Date: Jul 2000 Location: Middle Earth Posts: 1,367	I got stuck at a dealership in the middle of nowhere recently. I pulled out my laptop hoping I could get some work done, and there were no wireless networks available at all. Sounds like I found one of the few! __________________ "eh, take your opinion and shove it... somewhere else other than this thread" ~ welfareloser

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

07-23-2007, 06:24 AM	#4
Jeffbx Fleet Admiral Join Date: Mar 2000 Location: Michigan Posts: 9,390	Doesn't surprise me in the least. Since dealerships are independently owned & operated, I'm sure their IT department is nothing more than one of the guys that works there that happens to know how to install wireless routers. I'd bet most dentist & doctor's offices (outside of hospitals) are exactly the same.

User Name
Password
Remember Me?