The curious case of the Raspberry Pi in the network closet (2019)

Post by numpad0 » Mon, Jan 17, 2022, 11:43 AM UTC

jokoon wrote: post #13

I'm rather curious, why can't the RPi have soldered flash memory? How much would it cost to add 2, 4, or 8GB of flash memory on it? Because I would gladly pay for a Rpi with such memory if it added 10 dollars. I'm suspecting it would require for them to make a new SOC, breaking compability?

Post by discardable_dan » Mon, Jan 17, 2022, 11:58 AM UTC

gwd wrote: post #21

geek_at wrote: post #3

Author of the article here. Since I first published this blog post I was getting messages from people asking how it ended. Sadly it's pretty anticlimactic as the owner of the place had a meeting with the guy who put the Pi there (without me as he didn't want the Pi-dropper to feel ambushed) and in the end decided not to escalate it to legal and just basically told him to pack his things and get out. So no legal after…

> So no legal after play and just a slap on the wrist The problem with this is you have no idea what harm the guy actually may have caused; nor what other RPis he may have set up around the company or around town. Next time he may be more careful with his username, set up the disk to be encrypted w/ a network key, &c, making future exploits more difficult to track down.

Post by wink » Mon, Jan 17, 2022, 12:03 PM UTC

magicalhippo wrote: post #23

Reminds me of this[1] good old quote from the IRC days hm. I've lost a machine.. literally _lost_. it responds to ping, it works completely, I just can't figure out where in my apartment it is. [1]: http://bash.org/?5273

Post by tinus_hn » Mon, Jan 17, 2022, 12:19 PM UTC

wink wrote: post #26

magicalhippo wrote: post #23

Reminds me of this[1] good old quote from the IRC days hm. I've lost a machine.. literally _lost_. it responds to ping, it works completely, I just can't figure out where in my apartment it is. [1]: http://bash.org/?5273

I've also had this problem once, on a university campus though. "net send 'If you can read this, please call IT SUPPORT at ... and tell us'". It worked :)

Post by etothepii » Mon, Jan 17, 2022, 12:20 PM UTC

discardable_dan wrote: post #24

gwd wrote: post #21

Earlier quoted context omitted.

> So no legal after play and just a slap on the wrist The problem with this is you have no idea what harm the guy actually may have caused; nor what other RPis he may have set up around the company or around town. Next time he may be more careful with his username, set up the disk to be encrypted w/ a network key, &c, making future exploits more difficult to track down.

This, truly, is the thing to worry about: if it happened here, it likely happened at other companies. Turning a blind eye is a blank check to do it again.