3 ms·

FYI the device pictured is a SheevaPlug and is most of what is cool about this IMHO http://en.wikipedia.org/wiki/SheevaPlug http://en.wikipedia.org/wiki/Sheeva

FYI the device pictured is a SheevaPlug and is most of what is cool about this IMHO http://en.wikipedia.org/wiki/SheevaPlug http://en.wikipedia.org/wiki/SheevaPlug This would be a fun project but it strikes me as a little lame that they want donations for what I imagine would be writing a few bash scripts.

noonespecial 16y ago
We already use Sheevas for this and tons more. Taking the default debian, plugging in a usb stick and running snort is indeed a 10 minute operation. For more elegance, use a guru plug with its dual gigE ports, turn it into a transparent bridge, and just put it inline with the ethernet cable of your target. http://www.globalscaletechnologies.com/t-guruplugdetails.aspx http://www.globalscaletechnologies.com/t-guruplugdetails.asp... Once you realize you've got a fully capable linux server/router right there in the wall socket, all kinds of wild applications start springing to mind.
bradleyland 16y ago
Well, their intent is to GPL the code. Everybody has to pay their bills, and asking for donations isn't exactly the cardinal sin of open source development. The fact that it is a SheevaPlug is probably the least remarkable thing about this project. What appears to be unique is that they're looking at this from a high level. They're asking the question: "What moving parts are required for a robust, remote-access penetration tool." The "Drop Zone" concept is probably the most intriguing. Installing Linux plus a few security tools on a SheevaPlug is really simple. But that's not what this project appears to be. Have a look at the overview document: http://theplugbot.com/assets/PlugBot_Overview.pdf http://theplugbot.com/assets/PlugBot_Overview.pdf It's going to take more than writing a few bash scripts to have a robust framework for uploading results to a drop zone, and retrieving new command packages. This reminds me a little bit of worms like Stuxnet, which reach out to outside sources for new information. They're more than a monitor. They're an agent.

noonespecial 16y ago

We already use Sheevas for this and tons more. Taking the default debian, plugging in a usb stick and running snort is indeed a 10 minute operation. For more elegance, use a guru plug with its dual gigE ports, turn it into a transparent bridge, and just put it inline with the ethernet cable of your target. http://www.globalscaletechnologies.com/t-guruplugdetails.aspx http://www.globalscaletechnologies.com/t-guruplugdetails.asp... Once you realize you've got a fully capable linux server/router right there in the wall socket, all kinds of wild applications start springing to mind.

bradleyland 16y ago

Well, their intent is to GPL the code. Everybody has to pay their bills, and asking for donations isn't exactly the cardinal sin of open source development. The fact that it is a SheevaPlug is probably the least remarkable thing about this project. What appears to be unique is that they're looking at this from a high level. They're asking the question: "What moving parts are required for a robust, remote-access penetration tool." The "Drop Zone" concept is probably the most intriguing. Installing Linux plus a few security tools on a SheevaPlug is really simple. But that's not what this project appears to be. Have a look at the overview document: http://theplugbot.com/assets/PlugBot_Overview.pdf http://theplugbot.com/assets/PlugBot_Overview.pdf It's going to take more than writing a few bash scripts to have a robust framework for uploading results to a drop zone, and retrieving new command packages. This reminds me a little bit of worms like Stuxnet, which reach out to outside sources for new information. They're more than a monitor. They're an agent.