The PlugBot: A covert penetration testing device | Hacker News Reader

The PlugBot: A covert penetration testing device

theplugbot.com

41 pointsthere20 comments

FYI the device pictured is a SheevaPlug and is most of what is cool about this IMHO

http://en.wikipedia.org/wiki/SheevaPlug

This would be a fun project but it strikes me as a little lame that they want donations for what I imagine would be writing a few bash scripts.

We already use Sheevas for this and tons more. Taking the default debian, plugging in a usb stick and running snort is indeed a 10 minute operation.

For more elegance, use a guru plug with its dual gigE ports, turn it into a transparent bridge, and just put it inline with the ethernet cable of your target.

http://www.globalscaletechnologies.com/t-guruplugdetails.asp...

Once you realize you've got a fully capable linux server/router right there in the wall socket, all kinds of wild applications start springing to mind.

Well, their intent is to GPL the code. Everybody has to pay their bills, and asking for donations isn't exactly the cardinal sin of open source development.

The fact that it is a SheevaPlug is probably the least remarkable thing about this project. What appears to be unique is that they're looking at this from a high level. They're asking the question: "What moving parts are required for a robust, remote-access penetration tool." The "Drop Zone" concept is probably the most intriguing.

Installing Linux plus a few security tools on a SheevaPlug is really simple. But that's not what this project appears to be. Have a look at the overview document:

http://theplugbot.com/assets/PlugBot_Overview.pdf

It's going to take more than writing a few bash scripts to have a robust framework for uploading results to a drop zone, and retrieving new command packages.

This reminds me a little bit of worms like Stuxnet, which reach out to outside sources for new information. They're more than a monitor. They're an agent.

Pretty cool... and terrifying.

You could do something similar already by leaving behind an iPhone (with custom software) plugged in somewhere in the office. It could probably be less conspicuous than this thing.

An iPhone would have to be connected to the network through WiFi. If you're doing penetration testing in the enterprise space, it's unlikely that you're able to connect to their core network through WiFi. I do network consulting for a medium-large business ($300 mil market cap) that I consider to be pretty typical from a network security standpoint. They focus on securing their edge-facing access points, and thus they don't allow any access to their core networks through WiFi. It's all VLAN'd off in a DMZ. An iPhone would only be useful if you could penetrate their firewall at the DMZ... but then you might as well just attack from an internet facing point.

This device is a lot more dangerous, as it connects to an Ethernet port. Unsecured Ethernet ports are a lot easier to come by in most businesses. I've only ever worked with one company that secured their Ethernet network at such a low level (802.1X), and they were a very, very large multi-national corporation with a big manufacturing segment. They had to secure at the Ethernet layer as a matter of certification for the products they manufacture. Very few companies go through the trouble of implementing security at the Ethernet layer because of the expense and trouble involved.

I think plugging in something in the powerstrip under a desk and connecting it to an open ethernet port would take a very long time to be noticed in most offices whereas an iphone would be moved to lost and found or stolen or asked around whose it was.

Many moons ago I did something like this at a place I worked. Instead of a phone, I took the guts of a dreamcast running Linux and duct taped under the CTO's desk because he refused to stop claiming that our network was significantly more secure than it actually was (which is to say, he claimed it it was very secure, when in reality it wasn't secured at all).

Unfortunately, it didn't have the desired effect; and the network admin was pissed that he had to count all of the connection lights on the switches in the network closet once a week.

Rogue devices on your network are hard to detect and defeat.

Not if you know what you're doing. A good practice is to shutdown any switch interfaces that aren't in use. Once you've done that, you can implement a rudimentary access policy using MAC based ACLs. While a MAC based ACL won't prevent an attacker from gaining access to your network like a real authentication system (802.1X), it will help you notice the disruption. If you shut all ports that aren't in use, and you implement MAC ACLs, someone will notice the disruption. You'd have to unplug a network device in order to get an active port, and if you plugged in a hub, you'd have to spoof a MAC address, which would disrupt traffic to/from the device belonging to the MAC you just stole.

Even rudimentary measures can help secure a network to some degree.

If the PlugBot would have two Ethernet ports, working as a completely transparent bridge, shutting down ports and enabling 802.1X won't help much. Bot will just patiently wait for target to authenticate, then proceed with IP and MAC spoofing for its operations (filtering on the bridge).

802.1X-2010 and MACsec would address this issue, but they require more expensive hardware and not yet widely supported.

Reminds me of the Network Monkey http://www.hak5.org/store/network-monkey

I know that this is just Sheeva hardware, but I think this application begs for a second Ethernet port. Then you could use it as a “tap,” wouldn't need to find a an empty network port, could spoof the MAC of the device behind it, etc. Even better, put power over Ethernet in it and use it to replace the power injector already attached to that Polycom in the conference room...

This version has 2 gigE ports and only costs $20 more.

http://www.globalscaletechnologies.com/t-guruplugdetails.asp...

You could run tor hidden services on these things, to keep wikileaks afloat covertly. Install them above dropped ceilings, if possible.

Is there a way I can actually get my hands on one ? I'd love to.

You can get the SheevaPlug DevKit for $99 (http://www.globalscaletechnologies.com/p-22-sheevaplug-dev-k...). As far as the software they're using, it's not available yet but will be GPL (source: http://theplugbot.com/about).

It just looks like a regular Sheevaplug: http://en.wikipedia.org/wiki/SheevaPlug

looks like a sheevaplug...

http://www.plugcomputer.org/

then just install debian and compile whatever script^H^H^H^H^H^Hpenetration test tools you need.

The hardware is not what's unique about this project. Look at the overview:

http://theplugbot.com/assets/PlugBot_Overview.pdf

This involves a web server component with a reporting interface and some method of proxying "command packages" between the operator and the plug, which resides behind a firewall.

This should be a Kickstarter project.

It took me a minute. Apparently, I have a dirty mind...

Reply on news.ycombinator.com