Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The curious case of the Raspberry Pi in the network closet (2019)

blog.haschek.at

Post reply on HN
Print view View original

111–120 of 269 posts

Re: The curious case of the Raspberry Pi in the network closet (2019)

#111

Post by heelix »

magicalhippo wrote: post #23

Reminds me of this[1] good old quote from the IRC days hm. I've lost a machine.. literally _lost_. it responds to ping, it works completely, I just can't figure out where in my apartment it is. [1]: http://bash.org/?5273

I've had something similar happen to me. I was freaking out that there was something I did not know on my network, as I was going through some router configurations. Searched my office, Bride's office, asked my kid - nothing. Had a pie connected to the back of a TV, drawing power and connected to my network. It bothered me for months that _something_ was there, in my house - that I had completely forgotten was mine. Christmas time rolls around and we try to plug the kid's new console into the wall mounted TV... and there it is taped to the back of the monitor.

Re: The curious case of the Raspberry Pi in the network closet (2019)

#112

Post by ChuckNorris89 »

geek_at wrote: post #101
kumarvvr wrote: post #62

Earlier quoted context omitted.

Seem pertinent to atleast get an affidavit from the ex-employee detailing what he as done, agree to hold on to the hardware as evidence, put liability on the employee for any time-bombs that might have been stored, ask him explicitly to give in writing all the activities he performed, etc. Just to have a thread to pull on, in the future, when something might go wrong.

We did get a hand written statement from him and the original evidence (hardware) is still untouched and locked away. In his statement he wrote that the pi logged to the SD card but there was no data on the SD card (well not on the data partition) and I'm pretty sure that was a lie and it just logged to Balena. But even though we could never decipher what the nodejs program actually did (because it was so heavily obf…

>he was tracking the movement data of the boss to avoid him whenever possible.

Wow, imagine hating your boss so much you go to so much creative and illegal lengths (that can backfire against you) to track him, instead of using same skills legally to finding a better job.

I just don't get, something doesn't feel right about this being the true reason. To me it looks more like he wanted a covert backdoor in the company network for IP-theft, black-mail or other such data exfiltration purposes.

If only he knew that in a year he could avoid his boss all the time thanks to covid-WFH.

Re: The curious case of the Raspberry Pi in the network closet (2019)

#113

Post by xattt »

quassy wrote: post #63
xattt wrote: post #60

Earlier quoted context omitted.

Is “gifted person” code for something? Are they from some sort of enrichment program?

It's in the article: The author found information about the presumed attacker on a site where parents write about their gifted (= highly talented) children.

Thanks! I couldn’t handle the tension and jumped to the end of the article to see how it unfolded.

Re: The curious case of the Raspberry Pi in the network closet (2019)

#114

Post by neilv »

I was a confused by a screenshot in the article, with the caption:

> Not the actual site but a similar one

Looks like the article, when speaking of tracing down a wrongdoing suspect, used a screenshot of a Web page of an uninvolved Web site. The screenshot included photos of actual people presumably uninvolved, and a name, phone number, and email address also presumably uninvolved.

While I'd guess this probably reduces Internet vigilantism and accusations of libel (at least involving the actual suspect), I suspect that a journalism professor, editor, or lawyer would advise not to do it that way.

Re: The curious case of the Raspberry Pi in the network closet (2019)

#115

Post by kube-system »

goodpoint wrote: post #95
michaelt wrote: post #20

Earlier quoted context omitted.

Using an SD card means you can reset the Pi to factory settings by swapping the card for another; and undo the reset by swapping the cards back. This is substantially simpler for beginners than using network boot, or messing around with a bootloader via serial console.

Having an 8GB eMMC does not preclude having an SD slot. Any beginner can plug in an auto-installer on the SD card and use the same SD for different devices. Simpler and cheaper. If that's not enough, the eMMC could even come preinstalled with an OS.

Having soldered eMMC also means that you have complicated the effort required to securely wipe the device. It doesn’t get any easier than ejecting an SD card.

Re: The curious case of the Raspberry Pi in the network closet (2019)

#116

Post by mannykannot »

geek_at wrote: post #101
kumarvvr wrote: post #62

Earlier quoted context omitted.

Seem pertinent to atleast get an affidavit from the ex-employee detailing what he as done, agree to hold on to the hardware as evidence, put liability on the employee for any time-bombs that might have been stored, ask him explicitly to give in writing all the activities he performed, etc. Just to have a thread to pull on, in the future, when something might go wrong.

We did get a hand written statement from him and the original evidence (hardware) is still untouched and locked away. In his statement he wrote that the pi logged to the SD card but there was no data on the SD card (well not on the data partition) and I'm pretty sure that was a lie and it just logged to Balena. But even though we could never decipher what the nodejs program actually did (because it was so heavily obf…

At one point you wrote "It is beyond me why a co-founder of a company would distribute these devices around town but well.." I take it, however, that the installer turned out to be someone else. Now I am curious as to whether this company advertises itself as a supplier of such things, and if so, what it claims about their capabilities. Given that the code has not been reverse engineered, can you be sure its capabilities are limited to data exfiltration? I'm also wondering what the perpetrator was up to, if the device's purpose was indeed to help him avoid the boss.

Re: The curious case of the Raspberry Pi in the network closet (2019)

#117

Post by asteroidp »

discardable_dan wrote: post #24
gwd wrote: post #21

Earlier quoted context omitted.

> So no legal after play and just a slap on the wrist The problem with this is you have no idea what harm the guy actually may have caused; nor what other RPis he may have set up around the company or around town. Next time he may be more careful with his username, set up the disk to be encrypted w/ a network key, &c, making future exploits more difficult to track down.

This, truly, is the thing to worry about: if it happened here, it likely happened at other companies. Turning a blind eye is a blank check to do it again.

File that under "not this companies problem"

Re: The curious case of the Raspberry Pi in the network closet (2019)

#118

Post by vel0city »

imwillofficial wrote: post #96
suifbwish wrote: post #53

Earlier quoted context omitted.

One of the many reasons that I dislike the push towards wifi/wireless for everything. It makes my hair stand on end to see people using wireless keyboards (which people usually have for at least 5 years). People seem so disgusted when you even suggest that these things are inherently bad ideas which will inevitably lead to consequences and immediately push you into a naysayer/antiprogressive category verbally or sile…

Explain to me exactly how wireless keyboards are “ inherently bad ideas”, and not something that can be fixed with a robust technical solution?

Some wireless keyboards don't bother with any kind of protection to the data stream between the keyboard and the wireless receiver. That's the most obvious instance of bad keyboards. However, these days most wireless keyboards do use some kind of encryption on the pairing between the keyboard and the receiver, so that is a bit of a moot point.

Even if the data stream itself is encrypted there's still a little bit of data leakage. Your keyboard isn't constantly sending data, it really only chirps when there's an actual keypress event. So if you look at the actual physical RF, you 'll notice patterns related to the user's typing. There is some research in trying to guess key presses based on typing cadence, although I'm not sure exactly how effective it really is.

I say all of this typing on a Logitech Unifi keyboard amd routinely use bluetooth keyboards. As others have mentioned it really depends on your threat profile, and in the case of wireless keyboards you probably aren't near the level where this paranoia is justified. Are you typing state secrets that a foreign government body really wants in a public place? Probably want to have a wired keyboard...or maybe just not type such things in such places. Are you typing out a comment on Hacker News in a private space? Probably have nothing to worry about with a wireless keyboard.

Re: The curious case of the Raspberry Pi in the network closet (2019)

#119

Post by aembleton »

goodpoint wrote: post #99

Reminder (from a security guy): what the author did is risky. If you are really worried about a compromised server or a suspicious device call security consultant / forensic experts.

What are the potential risks around what he did?

Re: The curious case of the Raspberry Pi in the network closet (2019)

#120

Post by natpalmer1776 »

teddyh wrote: post #107
suifbwish wrote: post #47

Earlier quoted context omitted.

An encrypted disk would be kind of useless in such a device as it would require the user to login every time the device reboots, unless they intend for it to never be rebooted. I’m not sure what you mean by network key in this case.

> An encrypted disk would be kind of useless in such a device as it would require the user to login every time the device reboots There is actually a solution for that (shameless plug): https://www.recompile.se/mandos

While I'm sure I could configure this on a system, the level of understanding required to actually create it honestly is fantastic.

Is this something you created yourself, or was it a community project?

Post reply on HN