Case Study 2: TJX — The $256 Million WEP Cracking Breach and Dragonblood WPA3 Attacks

Part A: The TJX Companies Breach (2005-2007)

Background

In January 2007, The TJX Companies -- parent company of T.J. Maxx, Marshalls, HomeGoods, and other retail chains -- disclosed what was at the time the largest data breach in history. Attackers had stolen at least 94 million credit and debit card numbers (some estimates suggest over 200 million) over a period of approximately 18 months. The breach ultimately cost TJX over $256 million in settlements, fines, legal fees, and remediation.

The breach began with a deceptively simple attack: cracking WEP-encrypted wireless networks at TJX retail stores.

The Attack

Phase 1: Wireless Exploitation

In 2005, a group of hackers led by Albert Gonzalez began targeting retail companies with weak wireless security. At several TJX stores (notably in Miami, Florida and other locations), the attackers discovered that wireless networks were protected by WEP encryption -- a protocol that had been known to be fundamentally broken since 2001.

The attackers used standard, freely available tools to crack the WEP encryption:

1. Reconnaissance: Driving to TJX store locations and scanning for wireless networks from the parking lot (a practice known as "war driving")
2. Capture: Using a laptop with a compatible wireless adapter in monitor mode, they captured WEP-encrypted wireless traffic
3. Injection: Used ARP replay injection to generate additional encrypted packets and accelerate IV collection
4. Cracking: Used aircrack-ng (or its predecessor tools) to crack the WEP key from captured packets
5. Access: Connected to the TJX wireless network using the cracked key

The entire WEP cracking process could be completed in minutes.

Phase 2: Network Penetration

Once connected to the wireless network, the attackers discovered a critical architectural failure: the wireless network was not segmented from the rest of TJX's corporate network. The wireless access points connected to the same network infrastructure used by point-of-sale terminals, back-office systems, and corporate servers.

From the wireless network, the attackers:

1. Intercepted payment data: Captured credit card data in transit between POS terminals and payment processing systems. At many locations, this data traversed the network without additional encryption.
2. Installed malware: Deployed data-harvesting software on TJX's central processing systems in Framingham, Massachusetts
3. Established persistence: Created backdoor access that allowed them to return to the network repeatedly over 18 months
4. Exfiltrated data: Transferred stolen card data out of TJX's network through encrypted channels

Phase 3: Data Theft at Scale

Over approximately 18 months (mid-2005 to late 2006), the attackers systematically harvested payment card data. The stolen data included:

• Credit and debit card numbers
• Expiration dates
• Card verification values (CVV)
• Cardholder names (for some records)
• Transaction details

The stolen card data was sold on underground markets, used for fraudulent purchases, and used to create counterfeit cards.

Root Cause Analysis

The TJX breach resulted from multiple compounding security failures:

1. WEP encryption: The use of WEP -- known to be broken for years -- as the primary wireless security protocol was a fundamental and indefensible failure
2. No network segmentation: The wireless network provided direct access to payment processing infrastructure, violating basic security architecture principles
3. Inadequate monitoring: The intrusion went undetected for 18 months, indicating insufficient network monitoring and intrusion detection
4. Unencrypted card data: Payment card data traversed internal networks without additional encryption beyond the broken WEP layer
5. Non-compliance: TJX was not compliant with the Payment Card Industry Data Security Standard (PCI DSS), which explicitly required strong encryption (WEP was not accepted even then) and network segmentation

Financial and Regulatory Impact

The breach's financial impact was staggering:

• $256 million: Total estimated cost to TJX
• $40.9 million: Settlement with Visa
• $24 million: Settlement with MasterCard
• $9.75 million: Settlement with 41 state attorneys general
• $10-20 million: Customer notification and credit monitoring costs
• Additional costs: Legal fees, forensic investigation, technology upgrades, enhanced security measures

The breach also led to: - Strengthening of PCI DSS requirements, particularly around wireless security - Increased regulatory attention to retail payment card security - Industry-wide reassessment of wireless security practices - Criminal prosecution of the attackers (Albert Gonzalez received a 20-year federal prison sentence)

Lessons from TJX

The TJX breach remains one of the most instructive wireless security failures:

1. Known vulnerabilities demand immediate action: WEP had been publicly broken for years. Using it to protect a network carrying millions of credit card numbers was indefensible.

2. Network segmentation is not optional: Even if the wireless encryption had been stronger, the lack of segmentation between wireless and payment networks meant that any wireless compromise provided access to the most sensitive data.

3. Compliance is a floor, not a ceiling: TJX was not compliant with PCI DSS. Compliance frameworks exist precisely to prevent the types of failures that enabled this breach.

4. Monitoring detects what prevention misses: An 18-month undetected intrusion indicates a complete absence of effective monitoring and incident detection capabilities.

Part B: Dragonblood — Attacking WPA3 Before Widespread Adoption

Background

In April 2019, security researchers Mathy Vanhoef (the discoverer of KRACK) and Eyal Ronen published "Dragonblood: Analyzing the Dragonfly Handshake of WPA3 and EAP-pwd," revealing multiple vulnerabilities in WPA3's new SAE (Simultaneous Authentication of Equals) handshake before the protocol had even achieved widespread adoption.

WPA3 was specifically designed to address WPA2's weaknesses, particularly the vulnerability to offline dictionary attacks. The Dragonfly handshake (SAE) was supposed to make offline attacks impossible by using a password-authenticated key exchange based on elliptic curve cryptography. Dragonblood showed that the implementation of this theoretically sound protocol introduced practical vulnerabilities.

The Dragonblood Vulnerabilities

Downgrade Attack (CVE-2019-9494)

WPA3's transition mode allows networks to support both WPA2 and WPA3 clients simultaneously. This backward compatibility created a downgrade attack vector:

1. The attacker observes that a network operates in WPA3-Transition mode (supporting both WPA2 and WPA3)
2. The attacker creates a rogue AP advertising only WPA2-PSK with the same SSID
3. WPA3-capable clients may connect to the rogue AP using WPA2-PSK
4. The attacker captures the WPA2 four-way handshake
5. The attacker performs an offline dictionary attack against the WPA2 handshake

This attack effectively nullified WPA3's protection against offline dictionary attacks for networks in transition mode.

Side-Channel Attacks (CVE-2019-9494)

The SAE handshake uses a hash-to-curve algorithm to convert the password into a point on an elliptic curve. The specific algorithm used (hunt-and-peck / hash-to-element) exhibited timing side channels:

Cache-based side channel: The number of iterations required by the hash-to-curve algorithm varies depending on the password and MAC addresses. By measuring how long the AP takes to respond to SAE commit messages, the attacker can gain information about the password.

Timing-based side channel: The computational cost of the hash-to-curve algorithm leaks through response timing, enabling the attacker to partition the password space and reduce the number of guesses needed.

The attack process: 1. Send multiple SAE commit messages to the AP with different parameters 2. Measure response times precisely 3. Use timing information to eliminate password candidates 4. The remaining candidate space is small enough for a targeted online brute-force attack

Denial-of-Service (CVE-2019-9494)

The SAE commit message processing is computationally expensive compared to WPA2's four-way handshake. An attacker can flood an AP with forged SAE commit messages, causing:

• High CPU utilization on the AP
• Exhaustion of connection handling resources
• Degraded service or complete denial of service for legitimate clients

The anti-clogging mechanism defined in the SAE specification was found to be insufficient against determined attackers.

Group Downgrade Attack

SAE supports multiple elliptic curve groups. If an AP supports weaker groups alongside stronger ones, an attacker can force the use of a weaker group:

1. Block the AP's response to the client's initial commit message using the strongest group
2. The client retries with the next supported group
3. Repeat until the client uses the weakest supported group
4. Attack the weaker group

Dragonblood Impact and Response

Impact Assessment

The Dragonblood vulnerabilities had several significant implications:

• Undermined WPA3 adoption confidence: Organizations planning WPA3 migration faced uncertainty about whether the new standard was actually more secure
• Transition mode risk: The downgrade attack meant that networks running WPA3 in transition mode (the most common deployment model) were not fully protected against offline attacks
• Implementation complexity: The side-channel attacks demonstrated that even theoretically secure protocols can be undermined by implementation details
• Early lifecycle vulnerability: Discovering significant flaws in a protocol before widespread adoption raised questions about the Wi-Fi Alliance's security review process

Wi-Fi Alliance Response

The Wi-Fi Alliance and WPA3 specification authors responded to Dragonblood with:

1. Implementation guidance: Updated specifications with requirements for constant-time hash-to-curve implementations to prevent timing side channels
2. Anti-clogging improvements: Enhanced anti-clogging mechanisms to better resist DoS attacks
3. Transition mode guidance: Recommendations for deploying WPA3-only networks where possible, avoiding transition mode in high-security environments
4. Testing requirements: Updated Wi-Fi Alliance certification testing to include Dragonblood-related checks
5. Hash-to-curve update: The introduction of the "hash-to-element" method (based on the SSWU algorithm) that eliminates the timing side channel by performing the hash-to-curve in constant time

Dragonblood 2.0

In August 2019, Vanhoef and Ronen published additional findings: - The initial patches for some side-channel vulnerabilities were insufficient - New side-channel attacks against patched implementations - Brute-force attacks against WPA3's anti-clogging mechanism

These additional findings led to further implementation updates and underscored the difficulty of implementing cryptographic protocols securely.

Connecting TJX to Dragonblood: The Arc of Wireless Security

The TJX breach (WEP, 2005-2007) and Dragonblood (WPA3, 2019) bookend the evolution of wireless security vulnerabilities:

This progression shows that while wireless security has improved dramatically, each new generation introduces new, more subtle vulnerability categories. The shift from trivially broken encryption (WEP) to timing side channels (WPA3) represents enormous progress, but continuous security research remains essential.

Lessons for Ethical Hackers

1. Always test wireless security: The TJX breach demonstrates that wireless security failures can enable the most devastating data breaches. Wireless assessment must be part of comprehensive penetration testing.

2. Check for legacy protocols: WEP should never be found in production environments, but it still appears in legacy deployments. Document any discovery of WEP as a critical finding.

3. Evaluate transition mode risks: When assessing WPA3 deployments, test whether transition mode enables downgrade attacks to WPA2.

4. Passphrase strength matters regardless of protocol: Even with WPA3, weak passphrases reduce security. Assess passphrase strength as part of wireless testing.

5. Network segmentation testing is essential: The TJX breach succeeded because of segmentation failures, not just wireless encryption failures. Always test whether wireless network access provides unintended access to sensitive network segments.

Lessons for Defenders

Blue Team Perspective: The arc from TJX to Dragonblood provides clear defensive guidance:

• Eliminate WEP immediately: There is no acceptable use case for WEP in any environment. Legacy devices that require WEP must be isolated on dedicated, heavily monitored network segments or replaced.
• Deploy WPA3-only where possible: Avoid transition mode in sensitive environments. If transition mode is necessary, monitor for downgrade attacks.
• Keep firmware current: Dragonblood patches require AP firmware updates. Maintain a regular wireless infrastructure patching schedule.
• Segment wireless networks: Even with strong encryption, wireless networks should be segmented from sensitive resources. Apply the principle of least privilege to wireless network access.
• PCI DSS compliance for retail: The TJX breach drove significant improvements to PCI DSS wireless requirements. Ensure full compliance with current PCI DSS wireless security standards.

Discussion Questions

1. TJX used WEP despite it being known as broken for years. What organizational factors might lead to such decisions, and how can security professionals effectively advocate for protocol upgrades?

2. How does WPA3's transition mode create a security trade-off between backward compatibility and attack resistance? How should organizations manage this trade-off?

3. Compare the TJX breach (WEP cracking to data theft) with a hypothetical modern attack using Dragonblood against a WPA3-Transition network. How has the attacker's required skill level changed?

4. What role did PCI DSS non-compliance play in the TJX breach? How effective are compliance frameworks at preventing wireless security failures?

5. Vanhoef discovered both KRACK and Dragonblood through academic protocol analysis. What does this suggest about the importance of independent security research for wireless protocols?

References

• Vanhoef, M. and Ronen, E. (2020). "Dragonblood: Analyzing the Dragonfly Handshake of WPA3 and EAP-pwd." IEEE Symposium on Security and Privacy (S&P).
• Gonzalez, A. (2010). U.S. v. Albert Gonzalez, Case No. 08-CR-10223 (D. Mass.). Criminal proceedings.
• TJX Companies (2007). "TJX Companies, Inc. Victimized by Computer Systems Intrusion." SEC Filing 8-K.
• PCI Security Standards Council (2007). "Wireless Guidelines." PCI DSS Supplement.
• Wi-Fi Alliance (2019). "Wi-Fi Alliance Statement on Dragonblood Research." Official response.
• Vanhoef, M. (2019). "Dragonblood: Analysing WPA3's Dragonfly Handshake." dragonblood.com.