Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The curious case of the Raspberry Pi in the network closet (2019)

blog.haschek.at

Post reply on HN
Print view View original

101–110 of 269 posts

Re: The curious case of the Raspberry Pi in the network closet (2019)

#101

Post by geek_at »

kumarvvr wrote: post #62
geek_at wrote: post #3

Author of the article here. Since I first published this blog post I was getting messages from people asking how it ended. Sadly it's pretty anticlimactic as the owner of the place had a meeting with the guy who put the Pi there (without me as he didn't want the Pi-dropper to feel ambushed) and in the end decided not to escalate it to legal and just basically told him to pack his things and get out. So no legal after…

Seem pertinent to atleast get an affidavit from the ex-employee detailing what he as done, agree to hold on to the hardware as evidence, put liability on the employee for any time-bombs that might have been stored, ask him explicitly to give in writing all the activities he performed, etc. Just to have a thread to pull on, in the future, when something might go wrong.

We did get a hand written statement from him and the original evidence (hardware) is still untouched and locked away.

In his statement he wrote that the pi logged to the SD card but there was no data on the SD card (well not on the data partition) and I'm pretty sure that was a lie and it just logged to Balena.

But even though we could never decipher what the nodejs program actually did (because it was so heavily obfuscated) our internal working theory is that he was tracking the movement data of the boss to avoid him whenever possible.

Re: The curious case of the Raspberry Pi in the network closet (2019)

#102

Post by myself248 »

xwdv wrote: post #66
xattt wrote: post #60

Earlier quoted context omitted.

Is “gifted person” code for something? Are they from some sort of enrichment program?

“Gifted” individuals are selected at early ages to run through rigorous education programs that greatly push them ahead of their peers. It is a pipeline to create intellectual elites and captains of industry. Gifted kids are widely accepted as the most intelligent kids of a school and held up as the finest examples of the school’s educational abilities.

Wow, that's a warped description if I ever heard one. I always felt like "gifted" was a label given to kids who were out-of-place in a normal classroom, to justify having special education so they were less likely to disrupt class or kill themselves out of boredom.

Re: The curious case of the Raspberry Pi in the network closet (2019)

#103

Post by Abimelex »

geek_at wrote: post #101
kumarvvr wrote: post #62

Earlier quoted context omitted.

Seem pertinent to atleast get an affidavit from the ex-employee detailing what he as done, agree to hold on to the hardware as evidence, put liability on the employee for any time-bombs that might have been stored, ask him explicitly to give in writing all the activities he performed, etc. Just to have a thread to pull on, in the future, when something might go wrong.

We did get a hand written statement from him and the original evidence (hardware) is still untouched and locked away. In his statement he wrote that the pi logged to the SD card but there was no data on the SD card (well not on the data partition) and I'm pretty sure that was a lie and it just logged to Balena. But even though we could never decipher what the nodejs program actually did (because it was so heavily obf…

how hard can you obfuscate nodejs? I'm pretty sure if you drop the code in some infosec channels they will happily take the challenge and tell you what it does ;)

Re: The curious case of the Raspberry Pi in the network closet (2019)

#104

Post by fnord77 »

eertami wrote: post #46

>And what do we do, when we want to find out a location associated with a wifi name? We go to wigle.net, enter the SSID (=wifi name) and it tells us where on the world it is found. I've always enjoyed having unique/personal SSIDs, but had never seriously considered this consequence. I wonder what the worlds generic SSIDs are.

https://wigle.net/stats#ssidstats

Re: The curious case of the Raspberry Pi in the network closet (2019)

#105

Post by mabbo »

boringg wrote: post #97

Thanks OP - great read. Seems like a very sloppy network logger - I mean there's a whole raspberry pi for physical evidence! True there are probably a lot of other network hardware so it could hide in plain sight. Either way fascinating that they thought they could get away with it.

While the device itself is sloppy, for many organizations it's probably easier to install and less likely to be detected than a software-based attack.

How frequently does IT run scans of what software is running on the server vs how often does IT physically inspect the server? Remember, one of those things means I have to get up out of this chair and the other does not.

Re: The curious case of the Raspberry Pi in the network closet (2019)

#106

Post by ianai »

etothepii wrote: post #67
Ensorceled wrote: post #44

Earlier quoted context omitted.

> The issue here is that this isn't just "one bad apple" that if we can remove everything will be ok. Which is what motivates the idea that punishing this bad actor will make everything better. I think they are talking about this particular, singular, bad apple and the other companies that bad apple is also attacking right now and stopping that harm as opposed to "sending a message" to other bad apples.

That feels like a choice for the victim. If after the business owner sat down with the perpetrator they decided it is just some script kiddie playing at being a spy then that's up to them. The wider issue remains that some script kiddie with $120 could have done this and got away with it for ever.

Do you have a suggestion for a change to treating network security?

Re: The curious case of the Raspberry Pi in the network closet (2019)

#107

Post by teddyh »

suifbwish wrote: post #47
gwd wrote: post #21

Earlier quoted context omitted.

> So no legal after play and just a slap on the wrist The problem with this is you have no idea what harm the guy actually may have caused; nor what other RPis he may have set up around the company or around town. Next time he may be more careful with his username, set up the disk to be encrypted w/ a network key, &c, making future exploits more difficult to track down.

An encrypted disk would be kind of useless in such a device as it would require the user to login every time the device reboots, unless they intend for it to never be rebooted. I’m not sure what you mean by network key in this case.

> An encrypted disk would be kind of useless in such a device as it would require the user to login every time the device reboots

There is actually a solution for that (shameless plug): https://www.recompile.se/mandos

Re: The curious case of the Raspberry Pi in the network closet (2019)

#108

Post by fortran77 »

gwd wrote: post #21
geek_at wrote: post #3

Author of the article here. Since I first published this blog post I was getting messages from people asking how it ended. Sadly it's pretty anticlimactic as the owner of the place had a meeting with the guy who put the Pi there (without me as he didn't want the Pi-dropper to feel ambushed) and in the end decided not to escalate it to legal and just basically told him to pack his things and get out. So no legal after…

> So no legal after play and just a slap on the wrist The problem with this is you have no idea what harm the guy actually may have caused; nor what other RPis he may have set up around the company or around town. Next time he may be more careful with his username, set up the disk to be encrypted w/ a network key, &c, making future exploits more difficult to track down.

Are all parents who run "gifted children" blogs scammers of some sort? It sure seems like it.

Re: The curious case of the Raspberry Pi in the network closet (2019)

#109

Post by Severian »

sneak wrote: post #50
suifbwish wrote: post #47

Earlier quoted context omitted.

An encrypted disk would be kind of useless in such a device as it would require the user to login every time the device reboots, unless they intend for it to never be rebooted. I’m not sure what you mean by network key in this case.

No, you can have the initrd boot to a dropbear sshd that allows the operator to ssh in on reboots and provide the key.

Something like dnscat2 would ultimately be better in my opinion. Have it connect once to get the disk key, decrypt, and end the process. Then have your device do it's thing, and once a condition is met, spin it back up, transmit the data (using small packet sizes and very large delays to possibly avoid IDS) and exfiltrate what's needed.

Re: The curious case of the Raspberry Pi in the network closet (2019)

#110

Post by philipswood »

snapcaster wrote: post #75
suifbwish wrote: post #53

Earlier quoted context omitted.

One of the many reasons that I dislike the push towards wifi/wireless for everything. It makes my hair stand on end to see people using wireless keyboards (which people usually have for at least 5 years). People seem so disgusted when you even suggest that these things are inherently bad ideas which will inevitably lead to consequences and immediately push you into a naysayer/antiprogressive category verbally or sile…

Can you explain in clear ways how the person you're telling this to will directly be harmed?

To a mildly capable and somewhat determined attacker (who can get relatively close to you) this means your keyboard is probably readable from the radio signals.

A Physical keystroke logger if you want to think of it that way.

Post reply on HN