4 ms·

Many moons ago I did something like this at a place I worked. Instead of a phone, I took the guts of a dreamcast running Linux and duct taped under the CTO's de

by icey 16y ago

Many moons ago I did something like this at a place I worked. Instead of a phone, I took the guts of a dreamcast running Linux and duct taped under the CTO's desk because he refused to stop claiming that our network was significantly more secure than it actually was (which is to say, he claimed it it was very secure, when in reality it wasn't secured at all). Unfortunately, it didn't have the desired effect; and the network admin was pissed that he had to count all of the connection lights on the switches in the network closet once a week. Rogue devices on your network are hard to detect and defeat.

bradleyland 16y ago
Not if you know what you're doing. A good practice is to shutdown any switch interfaces that aren't in use. Once you've done that, you can implement a rudimentary access policy using MAC based ACLs. While a MAC based ACL won't prevent an attacker from gaining access to your network like a real authentication system (802.1X), it will help you notice the disruption. If you shut all ports that aren't in use, and you implement MAC ACLs, someone will notice the disruption. You'd have to unplug a network device in order to get an active port, and if you plugged in a hub, you'd have to spoof a MAC address, which would disrupt traffic to/from the device belonging to the MAC you just stole. Even rudimentary measures can help secure a network to some degree.
- drdaeman 16y ago
  If the PlugBot would have two Ethernet ports, working as a completely transparent bridge, shutting down ports and enabling 802.1X won't help much. Bot will just patiently wait for target to authenticate, then proceed with IP and MAC spoofing for its operations (filtering on the bridge). 802.1X-2010 and MACsec would address this issue, but they require more expensive hardware and not yet widely supported.
  - sp332 16y ago
    Reminds me of the Network Monkey http://www.hak5.org/store/network-monkey http://www.hak5.org/store/network-monkey

by icey 16y ago

bradleyland 16y ago

Not if you know what you're doing. A good practice is to shutdown any switch interfaces that aren't in use. Once you've done that, you can implement a rudimentary access policy using MAC based ACLs. While a MAC based ACL won't prevent an attacker from gaining access to your network like a real authentication system (802.1X), it will help you notice the disruption. If you shut all ports that aren't in use, and you implement MAC ACLs, someone will notice the disruption. You'd have to unplug a network device in order to get an active port, and if you plugged in a hub, you'd have to spoof a MAC address, which would disrupt traffic to/from the device belonging to the MAC you just stole. Even rudimentary measures can help secure a network to some degree.

drdaeman 16y ago
If the PlugBot would have two Ethernet ports, working as a completely transparent bridge, shutting down ports and enabling 802.1X won't help much. Bot will just patiently wait for target to authenticate, then proceed with IP and MAC spoofing for its operations (filtering on the bridge). 802.1X-2010 and MACsec would address this issue, but they require more expensive hardware and not yet widely supported.
- sp332 16y ago
  Reminds me of the Network Monkey http://www.hak5.org/store/network-monkey http://www.hak5.org/store/network-monkey