This article was shared here before and since then I was failing to find it again. Thanks for reposting!
The curious case of the Raspberry Pi in the network closet (2019)
41–50 of 269 posts
Re: The curious case of the Raspberry Pi in the network closet (2019)
#42Earlier quoted context omitted.
I've also had this problem once, on a university campus though. "net send 'If you can read this, please call IT SUPPORT at ... and tell us'". It worked :)
This should really only ever happen with wireless connections. You should always be able to tell what switchport a computer is connected to and work from there.
Switch port? Jump back a few decades and try combined kilometers of shared coax runs that effectively become embedded into a building over years of redecoration...
Re: The curious case of the Raspberry Pi in the network closet (2019)
#43Author of the article here. Since I first published this blog post I was getting messages from people asking how it ended. Sadly it's pretty anticlimactic as the owner of the place had a meeting with the guy who put the Pi there (without me as he didn't want the Pi-dropper to feel ambushed) and in the end decided not to escalate it to legal and just basically told him to pack his things and get out. So no legal after…
> told him to pack his things and get out
I though the suspects were an ex-employee, and some guy that didn't work there (the part-owner), so was an actual current employee implicated in the end?
Re: The curious case of the Raspberry Pi in the network closet (2019)
#44Earlier quoted context omitted.
This, truly, is the thing to worry about: if it happened here, it likely happened at other companies. Turning a blind eye is a blank check to do it again.
The issue here is that this isn't just "one bad apple" that if we can remove everything will be ok. Which is what motivates the idea that punishing this bad actor will make everything better. There is a systematic issue at the heart of the way we do network security. You can by a lighting / usb cable that can do all of these things and more for $120 if he'd used that he'd never have gotten caught. We treat network se…
> The issue here is that this isn't just "one bad apple" that if we can remove everything will be ok. Which is what motivates the idea that punishing this bad actor will make everything better.
I think they are talking about this particular, singular, bad apple and the other companies that bad apple is also attacking right now and stopping that harm as opposed to "sending a message" to other bad apples.
Re: The curious case of the Raspberry Pi in the network closet (2019)
#45Earlier quoted context omitted.
Read The Cuckoo's Egg by Cliff Stoll. An oldie but a goldie.
I’ve owned a copy for a while now. This might just be the push I needed to pick it up.
I read the whole book over a long weekend, I just couldn't put it down.
Make sure you don't have any work deadlines in the few days after you start it.
Re: The curious case of the Raspberry Pi in the network closet (2019)
#46>And what do we do, when we want to find out a location associated with a wifi name? We go to wigle.net, enter the SSID (=wifi name) and it tells us where on the world it is found.
I've always enjoyed having unique/personal SSIDs, but had never seriously considered this consequence. I wonder what the worlds generic SSIDs are.
Re: The curious case of the Raspberry Pi in the network closet (2019)
#47Author of the article here. Since I first published this blog post I was getting messages from people asking how it ended. Sadly it's pretty anticlimactic as the owner of the place had a meeting with the guy who put the Pi there (without me as he didn't want the Pi-dropper to feel ambushed) and in the end decided not to escalate it to legal and just basically told him to pack his things and get out. So no legal after…
> So no legal after play and just a slap on the wrist The problem with this is you have no idea what harm the guy actually may have caused; nor what other RPis he may have set up around the company or around town. Next time he may be more careful with his username, set up the disk to be encrypted w/ a network key, &c, making future exploits more difficult to track down.
An encrypted disk would be kind of useless in such a device as it would require the user to login every time the device reboots, unless they intend for it to never be rebooted. I’m not sure what you mean by network key in this case.
Re: The curious case of the Raspberry Pi in the network closet (2019)
#48Earlier quoted context omitted.
I've also had this problem once, on a university campus though. "net send 'If you can read this, please call IT SUPPORT at ... and tell us'". It worked :)
This should really only ever happen with wireless connections. You should always be able to tell what switchport a computer is connected to and work from there.
Back in the 90s, I recall something similar. Due to cost of hardware, networking wasn't as hi-tech as it is now. So it would be common for medium sized office buildings to have CAT3/5 cables trunked from everywhere in the building down to a central patch room, in which there would be 1000s of patch ports and patch cables stringing everywhere into discrete hubs that had no-onboard management. To trace a connection you'd have to start with the wall or floor port number that the end device was plugged into, and hope it's mapped correctly to a patch panel/port number in the patch room, and then manually trace any patch cable from there onwards to the hub etc.
The whole system falls apart when you have no idea where in the building the end device is, if you are lucky there may be a managed switch on the network route somewhere that may help you narrow down the location somewhat.
So yes, it did happen sometimes that the only way to find a box was to send a desktop alert and hope the admin of that box contacted you.
Re: The curious case of the Raspberry Pi in the network closet (2019)
#49>And what do we do, when we want to find out a location associated with a wifi name? We go to wigle.net, enter the SSID (=wifi name) and it tells us where on the world it is found. I've always enjoyed having unique/personal SSIDs, but had never seriously considered this consequence. I wonder what the worlds generic SSIDs are.
If you're ok with people's devices making attempts at connecting, eduroam, or some variant of Starbuck's Wifi might be good options. There'll be APs broadcasting those SSIDs all over the world.
Re: The curious case of the Raspberry Pi in the network closet (2019)
#50Earlier quoted context omitted.
> So no legal after play and just a slap on the wrist The problem with this is you have no idea what harm the guy actually may have caused; nor what other RPis he may have set up around the company or around town. Next time he may be more careful with his username, set up the disk to be encrypted w/ a network key, &c, making future exploits more difficult to track down.
An encrypted disk would be kind of useless in such a device as it would require the user to login every time the device reboots, unless they intend for it to never be rebooted. I’m not sure what you mean by network key in this case.
No, you can have the initrd boot to a dropbear sshd that allows the operator to ssh in on reboots and provide the key.