Hacker News Reader

Comment by nostromo | Hacker News Reader

Pretty cool... and terrifying.

You could do something similar already by leaving behind an iPhone (with custom software) plugged in somewhere in the office. It could probably be less conspicuous than this thing.

View on HN

An iPhone would have to be connected to the network through WiFi. If you're doing penetration testing in the enterprise space, it's unlikely that you're able to connect to their core network through WiFi. I do network consulting for a medium-large business ($300 mil market cap) that I consider to be pretty typical from a network security standpoint. They focus on securing their edge-facing access points, and thus they don't allow any access to their core networks through WiFi. It's all VLAN'd off in a DMZ. An iPhone would only be useful if you could penetrate their firewall at the DMZ... but then you might as well just attack from an internet facing point.

This device is a lot more dangerous, as it connects to an Ethernet port. Unsecured Ethernet ports are a lot easier to come by in most businesses. I've only ever worked with one company that secured their Ethernet network at such a low level (802.1X), and they were a very, very large multi-national corporation with a big manufacturing segment. They had to secure at the Ethernet layer as a matter of certification for the products they manufacture. Very few companies go through the trouble of implementing security at the Ethernet layer because of the expense and trouble involved.

Many moons ago I did something like this at a place I worked. Instead of a phone, I took the guts of a dreamcast running Linux and duct taped under the CTO's desk because he refused to stop claiming that our network was significantly more secure than it actually was (which is to say, he claimed it it was very secure, when in reality it wasn't secured at all).

Unfortunately, it didn't have the desired effect; and the network admin was pissed that he had to count all of the connection lights on the switches in the network closet once a week.

Rogue devices on your network are hard to detect and defeat.

Not if you know what you're doing. A good practice is to shutdown any switch interfaces that aren't in use. Once you've done that, you can implement a rudimentary access policy using MAC based ACLs. While a MAC based ACL won't prevent an attacker from gaining access to your network like a real authentication system (802.1X), it will help you notice the disruption. If you shut all ports that aren't in use, and you implement MAC ACLs, someone will notice the disruption. You'd have to unplug a network device in order to get an active port, and if you plugged in a hub, you'd have to spoof a MAC address, which would disrupt traffic to/from the device belonging to the MAC you just stole.

Even rudimentary measures can help secure a network to some degree.

If the PlugBot would have two Ethernet ports, working as a completely transparent bridge, shutting down ports and enabling 802.1X won't help much. Bot will just patiently wait for target to authenticate, then proceed with IP and MAC spoofing for its operations (filtering on the bridge).

802.1X-2010 and MACsec would address this issue, but they require more expensive hardware and not yet widely supported.

Reminds me of the Network Monkey http://www.hak5.org/store/network-monkey

I think plugging in something in the powerstrip under a desk and connecting it to an open ethernet port would take a very long time to be noticed in most offices whereas an iphone would be moved to lost and found or stolen or asked around whose it was.

Reply on news.ycombinator.com