12 ms·
The curious case of the Raspberry Pi in the network closet
- dmitripopov 8y agoCSI: Cyber :)
- vectorEQ 8y agonice detective work :D cool
- mirimir 8y agoYeah, and a big F for that "gifted person".
- tapland 8y agoTo the ex-employee. There was no conclusion drawn as to the involvement of the gifted kid other than the pi initially being set up by them.
- mirimir 8y agoYeah, but it was the setup that included all that information about him. That's why I said "F". An OPSEC fail. For the ex-employee, it was failure in judgment. And also OPSEC failure, for not checking the device for compromising information.
- cm-t 8y agoIntereseting, at every hint found in the blogpost, i was trying to guess the next steps, fun !
- walrus01 8y agoThis person's wiring closet needs to have all Ethernet switch ports in a default 'shut' state and assigned to a quarantine vlan. It's amateur hour if you can just plug in any random rpi, it gets a DHCP lease, access to the company lan, and a route to the outside internet.
- sschueller 8y agoThat would be best practice. However I don't mind being able to get LAN internet at a hotel that wants me to pay $24 per day for wifi when they have VoiP phones that have internet access...
- megous 8y agoHa! Good to know.
- retSava 8y agoI often bring a small wifi router with me, hook it up to Ethernet (often taking the TV or phone ethernet connection), then set up a local wifi that I can connect a Chromecast to. That in turn sits in the tv, of course. That gives me internet and streamability/casting to the tv :)
- walrus01 8y agoI often find that tethering to T-Mobile LTE is better than whatever misconfigured, screwed up NAT/gateway a hotel has.
- joezydeco 8y agoAgreed. Every single hotel I’ve been to in the last year or so has pitiful bandwidth, which is completely saturated after dark once everyone fires up Netflix and lets it run all night long.
- alanfranzoni 8y agoOr, even better, your services need authentication and authorization even on internal network, with some sort of SSO and/or federated authentication, so it actually doesn't matter where you are. Google's own BeyondCorp initiative works kind of this way. Getting a route to the outside internet is not such a big deal; access to internal data is. By the way: it's "amateur hour" if, as you say, that happens for a switch in a public/semipublic area in an office structure. On the contrary, I've seen a lot of "all-enabled" switches if those were accessible just from INSIDE the datacenter, where few people had access. It's not a really reasonable scenario.
- pjc50 8y agoI hadn't realised that the wifi->address mapping was so publicly available. That means a list of wifi addresses that you've connected your phone to is also a location history. :(
- C1sc0cat 8y agointeresting doesn't have mine in the UK maybe its just USA
- zaphirplane 8y agoIt does now ;)
- mosselman 8y agoI thought the same when I went to my country, but after a longer while a heatmap pops up. My wifi isn't in it though.
- Arnt 8y agoIt's wherever a contributor has been. Our home SSID isn't there, but a neighbour's network is visible on the street outside and is listed.
- geek_at 8y agono, I'm from Austria and it works here too. But it doesn't magically get all SSIDs from the planet, someone in your are must have the wigle app that records those info. It's crowd sourced
- bigiain 8y agoMine too - from an address I moved out of ~6 months ago though...
- DuckyC 8y agoThis is exactly what android does when it uses WiFi for location tracking
- 8y ago
- leowoo91 8y agoPlugging out is kinda bad idea, I would start with cold boot attack just in case sd card would be encrypted.
- ratsimihah 8y agoMy thoughts as well. Great job regardless, someone is in trouble! :/
- mehrdadn 8y agoWhat would that involve? I'm guessing making a bookable SD card that dumps memory, unplugging and quickly replugging the power cable, and then booting that card? Or do you need something more specialized?
- Piskvorrr 8y agoI don't think that you can, manually, swap SD cards (on a running system! That alone would trigger all sorts of quirks, unless you're running off initramfs, tmpfs or an external storage device.) and toggle power so quickly that the RPi reboots but doesn't erase RAM. I mean, you might get very lucky, but the boot process is heavily stacked against you - the bootloader on your SD card gets executed fairly late in the boot sequence: https://raspberrypi.stackexchange.com/questions/10442/what-is-the-boot-sequence https://raspberrypi.stackexchange.com/questions/10442/what-i...
- gppk 8y agoIt didn't really talk about what it "logged", that would have been interesting to know what data was being stolen. Great article though, very interesting read.
- Darkstryder 8y agoAs the article concludes with "Legal has taken over, I did my part and the rest is over my pay grade.", I think the author is not allowed to disclose this publicly.
- throwawaylolx 8y agoI think the author just doesn't know what it does. From his Reddit post [1]: >Still no idea what it actually does except for the program being called "logger", the bluetooth dongle and it being only feet away from secretary / ceo office [1] https://www.reddit.com/r/sysadmin/comments/9xveq5/rogue_raspberrypi_found_in_network_closet_need/ https://www.reddit.com/r/sysadmin/comments/9xveq5/rogue_rasp...
- jstanley 8y agoIf OP shared the nodejs app I think somebody would be able to figure out what it does. I'd certainly have a go.
- retSava 8y agoOne can speculate something along, "the neighbor kid, ABC, is pretty smart, perhaps he can help me set up some way to know if someone is around at work?".
- blueatlas 8y agoOr, management asking the ex. employee to drop a logger on the network to snoop because "we really don't want our IT guys to know".
- willvarfar 8y agothe article makes the massive assumption that the 'gifted person' whose name and home address were exposed is also the person who wanted it in the closet. Either that person has phenomenally bad tradecraft, or they are actually innocent. There are so many plausible ways in which the 'gifted person' is not in on the plot; for example, they may have sold the pi to the disgruntled employee before the employee was disgruntled or with no idea of the use that the disgruntled employee would put it too. Have to kind of hope thats how it all ends up. When I was young I often set up computers and stuff for others. These days I try and get slopy shoulders when people ask me for tech support, and if there were a young gifted wizkid nearby I'd be sending a lot of innocent business their way....
- salex89 8y agoInitially he suspected, but didn't jump to conclusions. It was only confirmed after matching the WiFI SSID.
- mcv 8y agoI didn't see that assumption anywhere in the article. He just followed the leads, collected the evidence and connected the dots. The device was set up in the gifted kid's home, and used a webservice paid for by the gifted kid's company. The device clearly comes from the gifted kid. Was he also the one who wanted the device in the closet? That's the one thing we don't know. That, and the relationship between the gifted kid and the ex-employee. Further legal investigation will no doubt follow. Maybe gifted kid is involved in something illegal, maybe not. Hopefully we'll hear more about this in the future.
- alanfranz 8y agoThat's an amateur job. Resin explains it - you try to do some exfiltration via an external commercial service? Come on. If the author had setup an encrypted partition where all the "real stuff" was found, and the key for such partition was in-memory only, possibly going alone one of the small rpi UPS/batteries to prevent minor electrical hiccups to make the whole operation fail.... it would have been almost impossible to get back at the author. Also, using a nice "black box" that looked like a sort of electronic device, instead of some randomly put together rpi+pieces, would have made the device mostly invisible. So: an amateurish hacking job.
- fps_doug 8y agoEncryption was the first thing I expected when he showed the partition table; so much about the "gifted child" :-) But even if you don't care, at least DON'T SIGN UP WITH YOUR REAL NAME to that service. What the freaking heck? I really hope they get what they deserve.
- dingaling 8y ago> Also, using a nice "black box" that looked like a sort of electronic device Disguised as one of those generic thermostat boxes on a wall it'd go unnoticed by 99.999% of people. Bonus points for a twiddly wheel.
- theamk 8y agoOr even better: find an old ethernet switch, gut it (but keep the connectors) and put Raspberry PI inside. You will need to solder 6 wires for ethernet and power, but the pins are fairly large so this should be easy. Even if discovered, most people would not bother taking it apart --- they'll just assume it is broken and throw it away.
- jordan801 8y agoThis is exactly what I was thinking. Even the network admin would probably be like, "well, I don't think so but I'd better not mess with it, just in case it's how the CEO is getting internet". Unless of course they engineered the network originally.
- ktpsns 8y ago> Legal has taken over, I did my part and the rest is over my pay grade. Wow, I never wanted to work in a company where I had to say this. Really, if the pay grade decides which human you are, I better get no money but can do whatever I want, like go to that person, ring on its door and ask it about its plans.
- pennaMan 8y agoSo you want to personally go to the door of a person who already committed a serious crime? A crime against your workplace even, not against your person. That is a highly questionable action, to say the least.
- locklock 8y agoThat term generally means "it's not my decision to make," it does not necessarily have to do with how much anyone gets paid. In this context he's saying that he did his part, discovering the device, and from that point forward the decision to pursue legal action (or something else) is not his to make.
- saagarjha 8y agoThis sounds like a great way to get into a dangerous situation.
- tapland 8y agoAnd to mess up legal cases.
- ScoJoh 8y agoYepper! Chain of Custody MUST be recorded and preserved. Document Document DOCUMENT! EVERYTHING. From the moment it was found to who/where it went next, to every step you took with it. This guy clearly was following that and did his due diligence of step 1 being, make a backup of the device. Then you have a record of everything as near time of discovery as possible, so if you're investigation hoses everything up, you can restore and start over. The author is also correct in that once he's done his investigation, he passes it all on to the next level to do their job. So in his case, he's done. There is NOTHING else he should be doing. If he does it really could hose up any/all legal action. Kinda like getting to court in a Sexual Assault case and finding on the arresting officer forgot to read the guy his Miranda Rights.... You can have 100% proof this is the guilty party, but he goes free because someone in the chain of custody hosed up their part.
- ziont 8y agogifted my ass
- aboutruby 8y agoReminds me of the people getting paid to install rogue devices like this, e.g. https://www.reddit.com/r/whatisthisthing/comments/9ixdh9/found_hooked_up_to_my_router/e6nh61r/ https://www.reddit.com/r/whatisthisthing/comments/9ixdh9/fou...
- SCHiM 8y agoThe attacker's setup is really, really bad. But it's very interesting to see a drop device being used in the wild. I assume that if amateur solo actors are doing this, then organized crime rings are for sure.
- inetknght 8y agoYes, very much. Not only are they doing it but they're peddling it to the unwary. https://news.ycombinator.com/item?id=18919906 https://news.ycombinator.com/item?id=18919906
- usgroup 8y agoBit of a Agatha Christie style who dun it. Fixed number of people it could be ... and it turns out to be the ex employee ... who would have thought.
- JustSomeNobody 8y agoThe butler ... ahem ... ex-employee always does it. I'm pretty shocked at how obvious they left this. Surely they knew it would be found one day?
- usgroup 8y agoPerhaps it’s more like ”Who framed Roger Rabbit”? Always suspected that Agatha was a bit simplistic. Maybe the real bad guy always gets away!
- deepsy 8y agoYou guys just killed wigle.net :(
- godelmachine 8y agoHave two questions after reading the article 1) What are DNS logs? 2) What are RADIUS logs? Would someone be so good as to answer? Thanks in advance for help you could provide. Edit :- This got downvoted. Don’t know why should anyone asking an honest question be marked down. Am I not allowed to ask technical questions in comments section?
- godelmachine 8y agoDid a quick Google search. Found this. Is it relevant to RADIUS logs I asked above? https://en.m.wikipedia.org/wiki/RADIUS https://en.m.wikipedia.org/wiki/RADIUS
- detaro 8y agoyes, it's that RADIUS. Their WLAN access points use that protocol to check if a username/password they're given is acceptable.
- geek_at 8y agoEvery time a device joins the corp. network, it gets an IP Address (DHCP) and a network name (DNS) from our servers. RADIUS is the authentication method for wifi. In larger offices you don't just share the same password for all users, but rather set up a RADIUS server that manages individual accounts. So every employee has their own username and password for wifi. Also called WPA2 Enterprise
- danesparza 8y agoRADIUS predates wifi by a few years. :-) It was originally centralized authentication for dial-in systems: https://en.wikipedia.org/wiki/RADIUS https://en.wikipedia.org/wiki/RADIUS
- _nalply 8y agoI didn't downvote you. Perhaps the downvoters did that because they felt your post not interesting enough. Read the guidelines (link at the bottom of the start page), especially: > On-Topic: Anything that good hackers would find interesting. Something which is common hacker's knowledge and easily googleable is probably boring.
- hawski 8y agoIt is possible that there is a second device that does a sniffing part. This device may be a relay for the second device. They could be connected via Bluetooth, hence the Bluetooth dongle.
- chinathrow 8y agoI agree. Like a keylogger on a wired keyboard which exfiltrates via the bluetooth dongle. That dongle was there for a reason.
- bdamm 8y agoIt might have been better to call the FBI as soon as nobody could identify the device. However, the conclusion was quite satisfying.
- deleted 8y ago[deleted]
- angry_octet 8y agoThis is a textbook case where of amateur sleuthing is a bad idea. We're not all Tsutomu Shimomura. If there is a criminal (or civil) case, there has been no chain of custody. If you find something like this, don't even touch it, get someone qualified. Secondly, it seems highly likely the person who created the image is not the person who emplaced it. The use of a VPN is hardly an indicator of evil intent. At least the author did not put any names in their publication.
- angry_octet 8y agohttps://www.sans.org/course/advanced-incident-response-threat-hunting-training https://www.sans.org/course/advanced-incident-response-threa... https://brettshavers.com/brett-s-blog/entry/digital-forensics-is-really-easy https://brettshavers.com/brett-s-blog/entry/digital-forensic...
- morpheuskafka 8y agoI'm shocked they used a commercial service to store their entire codebase. That could be easily subpeonad and if its a paid plan they will be dead in the water.
- gfisher 8y agoOn the Reddit post this originated from [0], it says that the motivation from the ex-employee was "help us identifying wifi problems and tracking users in the area around the Managers office". Makes me wonder if it was malicious or just stupidity. [0] https://www.reddit.com/r/sysadmin/comments/9xveq5/rogue_raspberrypi_found_in_network_closet_need/ https://www.reddit.com/r/sysadmin/comments/9xveq5/rogue_rasp...
- stevespang 8y agoGreat write up Christian, really enjoyed reading it.
- taneq 8y agoMr Robot, this 'gifted' kid is not.
- kfihihc 8y agoWell, Co-founder of Makerdiary is here :) I love this article, and I wanna promote our works in this thread :) We are build some little Nordic nRF52-based widgets for maker with a lot of documents, you can find more wiki at here[1][2]. And we are try to use MESH network technology to protect our IoT data, here is some tutorial for BLE MESH[3] and OpenThread MESH[4]. BTW, if you are intersted in FIDO U2F security key, please check here[5], an open source FIDO U2F implementation on nRF52 SoC. [1]: https://wiki.makerdiary.com https://wiki.makerdiary.com [2]: https://blog.makerdiary.com https://blog.makerdiary.com [3]: https://blog.makerdiary.com/getting-started-with-bluetooth-mesh-development/ https://blog.makerdiary.com/getting-started-with-bluetooth-m... [4]: https://blog.makerdiary.com/build-a-thread-network-with-nrf52840-mdk/ https://blog.makerdiary.com/build-a-thread-network-with-nrf5... [5]: https://github.com/makerdiary/nrf52-u2f https://github.com/makerdiary/nrf52-u2f