by Serguey Shinder
In October 2024 we paid a security firm to test one of our branches, a mid sized builders' merchant on an industrial estate outside Doncaster. The tester did not come inside. He sat in his car in our customer car park, joined the free Wi-Fi we offer to trade customers while they wait for loads, and within forty minutes he had reached the branch's stock server, the office printer, and the recorder for the security cameras, which still had its installer's password.
None of it needed anything clever. The customer Wi-Fi had its own name and its own password printed on a card at the counter, so everybody assumed it was separate. It was not. It handed out addresses on the same network as everything else in the building. The only thing kept apart was the card terminals, because the card schemes had insisted on it years earlier. Everything else, we had simply never been asked about.
I had always pictured the branch network as inside, and the internet as outside. The branch felt like a building with a locked door. What I had not pictured was that the Wi-Fi reached the car park, the yard, the bus stop and probably the unit next door, and that every device on it was trusted the moment it joined, simply because it had joined. The printer accepted jobs from anybody. The stock server answered anybody who asked. Nothing had ever needed to tell a customer's phone from a member of staff, because the network had never been built to make that distinction.
We checked the other branches. Forty one of our forty eight were set up the same way. The other seven were newer and had been installed by a different contractor, who had separated the guest network without anybody asking.
The fix was more tedious than difficult. Customer Wi-Fi in every branch now reaches the internet and nothing else, and devices on it cannot see each other either. Staff devices, the tills, the printers and the cameras each sit on their own network, and the only connections allowed between them are ones we have written down and can explain. Every device in every branch is on a list with an owner, and default passwords are checked against it twice a year. The test is repeated annually, in a different branch each time, chosen by the testers.
The tester's report was eleven pages. The sentence I remember was on the first one: the attacker does not need to enter the premises.
A network that trusts whoever joins it does not have an inside. It has a password printed on a card at the counter.
– Serguey Asael Shinder
Leave a Reply