Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The curious case of the Raspberry Pi in the network closet (2019)

blog.haschek.at

Post reply on HN
Print view View original

191–200 of 269 posts

Re: The curious case of the Raspberry Pi in the network closet (2019)

#191

Post by anonymousiam »

suifbwish wrote: post #53
tinus_hn wrote: post #28

Earlier quoted context omitted.

This should really only ever happen with wireless connections. You should always be able to tell what switchport a computer is connected to and work from there.

One of the many reasons that I dislike the push towards wifi/wireless for everything. It makes my hair stand on end to see people using wireless keyboards (which people usually have for at least 5 years). People seem so disgusted when you even suggest that these things are inherently bad ideas which will inevitably lead to consequences and immediately push you into a naysayer/antiprogressive category verbally or sile…

I have a few commercial-grade WAPs, but they are about four years old and do not do MIMO. I wonder if any of the current hardware records RTT to sufficient accuracy so the distance from the antenna to the client is recorded/available. I also wonder if the phased-array antenna processor records the vector to the client. Such information is available from the hardware, but can anyone tell me if ANY WAP vendors are providing it via their management interface?

Such features could alleviate some of the parent poster's concerns.

Re: The curious case of the Raspberry Pi in the network closet (2019)

#192

Post by cgriswald »

AlecSchueler wrote: post #173
spac wrote: post #161

Earlier quoted context omitted.

just came here to say that while I understand the sentiment, people in their 20s can vote, and should be considered adults, not kids.

Legally that's true but I think you know as well as anyone that people don't just suddenly mature on the day of their 18th birthday.

I wonder what effect treating legal adults as children has on their maturity trajectory.

Re: The curious case of the Raspberry Pi in the network closet (2019)

#194

Post by nitrogen »

jaywalk wrote: post #186
nitrogen wrote: post #168

Earlier quoted context omitted.

Having a list of allowed MAC addresses, enforced per-port by a managed switch (or at least by the DHCP server and router), is a first step, though naturally it's easy to spoof a MAC address.

MAC address filtering isn't a first step towards 802.1x, precisely because of the reason you mentioned. It's damn near pointless for all but the most basic security scenarios.

Obviously it's not a first step toward certificates, but it is a first step away from "anyone can casually plug in a hidden Pi."

Re: The curious case of the Raspberry Pi in the network closet (2019)

#195

Post by nickelcitymario »

ChuckNorris89 wrote: post #190
PragmaticPulp wrote: post #140

Earlier quoted context omitted.

> Wow, imagine hating your boss so much you go to so much creative and illegal lengths (that can backfire against you) to track him, instead of using same skills legally to finding a better job. I’ve mentored a lot of juniors. It’s not uncommon for young people, especially those with less developed social skills, to have an undeserved fear of their boss or anyone else with authority. It’s common with young people who…

>I’ve mentored a lot of juniors. It’s not uncommon for young people, especially those with less developed social skills. Sure, but even as a junior employee, we're still talking about mature adults here, not kindergarten kiddies, who can vote, pay taxes and are held accountable for their actions in front of the law, so they should be aware that deliberately backdooring their employer so that they can surveillance the…

> Why not seek therapy from professionals

No disagreement here, but to answer your question: If someone is struggling with social anxiety, they actually have to somehow overcome their anxiety enough to seek that help. It can be a real catch-22. (Not a justification for this person's actions by any means. Just explaining motivation.)

Re: The curious case of the Raspberry Pi in the network closet (2019)

#196

Post by travisjungroth »

cgriswald wrote: post #192
AlecSchueler wrote: post #173

Earlier quoted context omitted.

Legally that's true but I think you know as well as anyone that people don't just suddenly mature on the day of their 18th birthday.

I wonder what effect treating legal adults as children has on their maturity trajectory.

It’s super complex. There are cases where the person “gets it” and just getting caught is enough to cause growth. Accountability in the form of punishment may be a waste of time or even harmful to growth because the experience is too painful to integrate. On the other hand, someone who is always let off the hook may never develop a true sense of responsibility and things only get worse. There’s no single factor to tell what’s the right thing to do all the time.

But within the theme of this thread, I strongly doubt the optimum solution is “full punishment in every case for everyone the moment they cross the age of majority.”

Re: The curious case of the Raspberry Pi in the network closet (2019)

#197

Post by mrtesthah »

boringg wrote: post #97

Thanks OP - great read. Seems like a very sloppy network logger - I mean there's a whole raspberry pi for physical evidence! True there are probably a lot of other network hardware so it could hide in plain sight. Either way fascinating that they thought they could get away with it.

You have to wonder why they didn’t rather create a transparent bridge on the network whose traffic they were trying to log; such a device could’ve even been hidden along a network cable.

Re: The curious case of the Raspberry Pi in the network closet (2019)

#199

Post by eternityforest »

PragmaticPulp wrote: post #140
ChuckNorris89 wrote: post #112

Earlier quoted context omitted.

>he was tracking the movement data of the boss to avoid him whenever possible. Wow, imagine hating your boss so much you go to so much creative and illegal lengths (that can backfire against you) to track him, instead of using same skills legally to finding a better job. I just don't get, something doesn't feel right about this being the true reason. To me it looks more like he wanted a covert backdoor in the company…

> Wow, imagine hating your boss so much you go to so much creative and illegal lengths (that can backfire against you) to track him, instead of using same skills legally to finding a better job. I’ve mentored a lot of juniors. It’s not uncommon for young people, especially those with less developed social skills, to have an undeserved fear of their boss or anyone else with authority. It’s common with young people who…

Doesn't anxiety tend to not make you want to sprinkle boxes of malware in network closets?

Like, I would be absolutely terrified to even accidentally overhear someone talking about this and possibly be dragged into it that way.

Re: The curious case of the Raspberry Pi in the network closet (2019)

#200

Post by eternityforest »

etothepii wrote: post #30
discardable_dan wrote: post #24

Earlier quoted context omitted.

This, truly, is the thing to worry about: if it happened here, it likely happened at other companies. Turning a blind eye is a blank check to do it again.

The issue here is that this isn't just "one bad apple" that if we can remove everything will be ok. Which is what motivates the idea that punishing this bad actor will make everything better. There is a systematic issue at the heart of the way we do network security. You can by a lighting / usb cable that can do all of these things and more for $120 if he'd used that he'd never have gotten caught. We treat network se…

Without changing things so radically that we might not even be able to continue having a "Do everything in software with one click" society, social deterrence is going to to be important.

Unless people are manually verifying GPG keys in person all the time, you're gonna need to trust someone. Even with a two man rule you need some degree of trust. Trust is easier when people know they might go to jail if they break it.

Post reply on HN