Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The curious case of the Raspberry Pi in the network closet (2019)

blog.haschek.at

Post reply on HN
Print view View original

151–160 of 269 posts

Re: The curious case of the Raspberry Pi in the network closet (2019)

#151

Post by TedDoesntTalk »

Abimelex wrote: post #103
geek_at wrote: post #101

Earlier quoted context omitted.

We did get a hand written statement from him and the original evidence (hardware) is still untouched and locked away. In his statement he wrote that the pi logged to the SD card but there was no data on the SD card (well not on the data partition) and I'm pretty sure that was a lie and it just logged to Balena. But even though we could never decipher what the nodejs program actually did (because it was so heavily obf…

how hard can you obfuscate nodejs? I'm pretty sure if you drop the code in some infosec channels they will happily take the challenge and tell you what it does ;)

An easier solution might be to look at the packets the nodejs program is sending over the network (if you can configure a MITM)

Re: The curious case of the Raspberry Pi in the network closet (2019)

#152

Post by TedDoesntTalk »

vorticalbox wrote: post #144
geek_at wrote: post #101

Earlier quoted context omitted.

We did get a hand written statement from him and the original evidence (hardware) is still untouched and locked away. In his statement he wrote that the pi logged to the SD card but there was no data on the SD card (well not on the data partition) and I'm pretty sure that was a lie and it just logged to Balena. But even though we could never decipher what the nodejs program actually did (because it was so heavily obf…

Any plans to release to code? I would love to take a look.

The license.md does not say it is open source :)

Re: The curious case of the Raspberry Pi in the network closet (2019)

#153

Post by rheophile »

ChuckNorris89 wrote: post #112
geek_at wrote: post #101

Earlier quoted context omitted.

We did get a hand written statement from him and the original evidence (hardware) is still untouched and locked away. In his statement he wrote that the pi logged to the SD card but there was no data on the SD card (well not on the data partition) and I'm pretty sure that was a lie and it just logged to Balena. But even though we could never decipher what the nodejs program actually did (because it was so heavily obf…

>he was tracking the movement data of the boss to avoid him whenever possible. Wow, imagine hating your boss so much you go to so much creative and illegal lengths (that can backfire against you) to track him, instead of using same skills legally to finding a better job. I just don't get, something doesn't feel right about this being the true reason. To me it looks more like he wanted a covert backdoor in the company…

what if this guy is just a hell of an introvert who is more comfortable rigging something like this up than with interacting with this boss. If this kid was in his early 20s I'd probably slap his wrist and impress on him the dangers of screwing with the company network closet. If he is an adult he really ought to know better

Re: The curious case of the Raspberry Pi in the network closet (2019)

#154

Post by TedDoesntTalk »

asteroidp wrote: post #117
discardable_dan wrote: post #24

Earlier quoted context omitted.

This, truly, is the thing to worry about: if it happened here, it likely happened at other companies. Turning a blind eye is a blank check to do it again.

File that under "not this companies problem"

It is possible the perpetrator acquired some embarrassing evidence about the company owner and was blackmailed. We’ll never know.

Re: The curious case of the Raspberry Pi in the network closet (2019)

#156

Post by rheophile »

geek_at wrote: post #3

Author of the article here. Since I first published this blog post I was getting messages from people asking how it ended. Sadly it's pretty anticlimactic as the owner of the place had a meeting with the guy who put the Pi there (without me as he didn't want the Pi-dropper to feel ambushed) and in the end decided not to escalate it to legal and just basically told him to pack his things and get out. So no legal after…

post the nodejs in a git repo so we can see what he was doing.

Re: The curious case of the Raspberry Pi in the network closet (2019)

#157

Post by vorticalbox »

TedDoesntTalk wrote: post #151
Abimelex wrote: post #103

Earlier quoted context omitted.

how hard can you obfuscate nodejs? I'm pretty sure if you drop the code in some infosec channels they will happily take the challenge and tell you what it does ;)

An easier solution might be to look at the packets the nodejs program is sending over the network (if you can configure a MITM)

Its package.json and / or node_modules might also give some clues

Re: The curious case of the Raspberry Pi in the network closet (2019)

#158

Post by charles_f »

gwd wrote: post #21
geek_at wrote: post #3

Author of the article here. Since I first published this blog post I was getting messages from people asking how it ended. Sadly it's pretty anticlimactic as the owner of the place had a meeting with the guy who put the Pi there (without me as he didn't want the Pi-dropper to feel ambushed) and in the end decided not to escalate it to legal and just basically told him to pack his things and get out. So no legal after…

> So no legal after play and just a slap on the wrist The problem with this is you have no idea what harm the guy actually may have caused; nor what other RPis he may have set up around the company or around town. Next time he may be more careful with his username, set up the disk to be encrypted w/ a network key, &c, making future exploits more difficult to track down.

He did get fired though, not as if he just got his raspberry back and went about whistling happily

Re: The curious case of the Raspberry Pi in the network closet (2019)

#159

Post by soheil »

I honestly think instead of the username if an email was found and published the author would be receiving so many offers for work from Silicon Valley companies. There aren't that many talented engineers even in SV who could pull something like this off. Sad to see amoral behavior from otherwise smart creative people who're stuck in shitty jobs with shittier bosses.

Re: The curious case of the Raspberry Pi in the network closet (2019)

#160

Post by goodpoint »

aembleton wrote: post #119
goodpoint wrote: post #99

Reminder (from a security guy): what the author did is risky. If you are really worried about a compromised server or a suspicious device call security consultant / forensic experts.

What are the potential risks around what he did?

- Being suspected or charged of destruction of evidence. It happened.

- Losing access to forensic data by not capturing the contents of the device RAM. Pretty common.

- Becoming witness of a crime and getting personally targeted by some criminal organization in retaliation. This one should be obvious.

- Wasting the opportunity to keep the device on to monitor the activity of the intruder

Post reply on HN