6 ms·
Stuff like this is why physical pentesting is so effective. If you sneak into a company and stick a raspi in a corner, nobody tends to notice a black box amidst
by sillysaurus3 9y ago
Stuff like this is why physical pentesting is so effective. If you sneak into a company and stick a raspi in a corner, nobody tends to notice a black box amidst a bunch of cables. But that black box can attack the dev machines in a variety of ways: it can be a honeypot wifi AP until someone accidentally connects to it, at which point you have creds for the real network. Then you can connect to the real network and look for workstations to attack. Or, as this article points out, you might be able to use a tricky bluetooth attack to get onto the workstations directly.
I'm not sure there's any way to protect against this. Physical pentesters tend to get caught less than 10% of the time. It's very easy to sneak into a building if you know what you're doing and have confidence. And "knowing what you're doing" generally consists of "dress up like a construction worker xor interviewee."
- keyme 9y agoI'll add that extending the range of a Bluetooth transmitter significantly (hundreds of meters) is possible using a directional antenna and a power amplifier. This means that sitting in a building next door, or just having a direct line of sight to the target, is enough to perform such attacks.
- emerongi 9y agoThe beauty of just dropping your black boxes everywhere is that once you have a 0-day, you can just run it on your full fleet of machines scattered everywhere. Once you find a new 0-day, you can run that one etc. Less effort with a lot more payoff.
- lawnchair_larry 9y agoThere's no way anybody has actually done this. Are you guys just fantasizing?
- B1FF_PSUVM 9y agoTomorrow's news today?
- sjwright 9y agoWorse still, the raspberry pi can sit quietly, doing nothing, until a few seconds after a relevant 0-day exploit is discovered. You could have great security practices, you could patch the moment vendors release them, and still be vulnerable. The only solution is layered security. (And to be clear, 802.11i barely qualifies as a layer.)
- ams6110 9y agoWell, you could ban any unknown devices that appear on your network. That's not too difficult.
- GFischer 9y agoDelivery people... I've had my laptop stolen by a fake delivery worker who cleaned up the building. An UPS or DHL uniform will get you most everywhere, and you have an excuse for carrying bulky stuff. Edit: Kevin Mitnick's The Art of Deception is an oldie but goodie detailing most of this stuff. https://www.goodreads.com/book/show/18160.The_Art_of_Deception https://www.goodreads.com/book/show/18160.The_Art_of_Decepti...
- StillBored 9y agoHmm, what kind of company lets a UPS/etc man past the front desk? It seems pretty standard practice everywhere I've ever worked that packages went to a designated spot (front desk, loading dock, etc) and the final recipient was pinged via email/whatever to come pick it up.
- losteric 9y agoMy huge employer does - UPS takes the cargo elevator but get access to the mailroom, inside secured the premise. Come to think of it, couldn't a device just be hidden in a package? Like a small statue delivered to a bad address?
- paulie_a 9y agoMost companies. A clip board, a smile and a sense you know where you are going is a pretty powerful combo. Hell I wandered into the phone system/networking closet at a fairly prominent Chicago hotel, on accident, after walking past multiple security guards.
- drunkenmonkey 9y agoSince Van Eck phreaking tools exist which can read keystrokes and RAM states on specific machines from blocks away, and since no one talks about these tools, I am leaving this comment here.
- problems 9y agoFrom blocks away? Bullshit. Maybe from the next room using a CRT monitor. I'd love to see the study saying they're able to reliably get keystrokes or screen images from any significant distance.
- jacquesm 9y agoWhat a bunch of nonsense. Reading out RAM states and keystrokes from one room over is already quite a feat, to read RAM states or keystrokes from 'blocks away' is science fiction and if it could be done would be news to me. Yes, it is possible to recreate the contents of screens from quite far away, it is possible to piece together a lot of data from magnetic fields leaking from computers but this is not simple nor something that easily lends itself to longer distances. In short, the reason nobody talks about those tools is because they don't exist.
- drunkenmonkey 9y agoEnjoy the dark ages.
- revelation 9y agoWell, you either do the whole honeypot routine (and enterprise WLAN running MSCHAPv2 is certainly a very good target) or you just stick it directly into the next RJ45. At most there is a MAC filter.
- 3pt14159 9y agoCompanies need to invest in high quality cameras. Facial recognition software is getting so good even HUMINT is having a problem with it. Soon I see these things integrated with facial recognition software so realtime alerts can detect false-delivery persons and known criminals.
- aaron695 9y ago> Stuff like this is why physical pentesting is so effective. It's also why physical pentesting is a scam. Like you say, people can get caught and you're screwed if you're not working for a pentesting company. You have to travel to the target which is an expensive PITA. You need to know the culture (in company and in country). Then to top it off you are in the countries jurisdiction, in person. Look what happened to Aaron Swartz (Which might be more an inside job, his father did work for MIT so he might have had some inside information) Most intelligent people won't do it. It also involves a skill set quit different to computer hacking and most social engineering. I'd like to know of examples of real world incidents.