4 ms·

That seems like a lot of hassle and a pretty big federal crime for only being able to attack Wi-Fi networks. Why not just park your car outside and use a laptop

That seems like a lot of hassle and a pretty big federal crime for only being able to attack Wi-Fi networks. Why not just park your car outside and use a laptop?

ISL 7y ago
If you can't enter a country or a facility, the mail usually can.
mikece 7y ago
How long can you sit outside a company running Kali Linux and a high gain antenna array before you attract attention? If you ship someone on the DevOps team a WiFi-connected plush toy that listens for webhooks from your CI/CD platform to make happy/sad noises when the build passes/fails -- AND THEY PLUG IT IN AND LEAVE IT ON -- then the ability to have passive access to the network for a long period of time will be less noticed. The example of the WiFi connected stuffed animal listening for webhooks isn't a made-up example -- I read a blog post about that years ago. Some team had a "build bunny" whose ears perked up and made happy noises when the build passed and the ears drooped and made a sad trombone noise when builds failed. The thing is already RF-active... would anyone break out a spectrum analyzer to notice if the thing was also transmitting/receiving on LTE and not just WiFi?
- miah_ 7y ago
  There was also, The Thing which was a gift from Young Pioneer organization of the Soviet Union to Ambassador Harriman in 1945. It was discovered to be a passive listening device seven years later. https://en.wikipedia.org/wiki/The_Thing_(listening_device) https://en.wikipedia.org/wiki/The_Thing_(listening_device)
- overcast 7y ago
  I suspect way longer than you think. Ten of thousands of small businesses don't pay attention to that stuff.
- heavenlyblue 7y ago
  But this device won't work for more than a few days anyway.
  - lb1lf 7y ago
    Just piggyback it onto something the recipient would want to plug in. Problem solved.
- moftz 7y ago
  A typical SUV or minivan with tinted windows that only parks there during business hours probably wouldn't attract much attention if the business was large enough that no one knew everyone that worked there. Integrate the yagi antenna into some part of the car like a bike rack or hide it inside a plastic roof carrier. Show up around the time that people are starting to come in so you can get a good spot for the antenna and leave when everyone else does.
lallysingh 7y ago
You don't even have to be in the same country as your target. You can ship with a fake source and be pretty much invisible. Using repurposed used hardware, this can also be crazy cheap. Fun idea: buy junk vendor swag (stuffed animal, glass globe, etc) off of ebay in bulk, then mail it to people you know have recently left the company (say, from scanning LinkedIn). They'll probably keep the package around for a while before disposing of it. Or even better, someone else claims it as 'free swag,' and keeps it in the office. Maybe it'll stay in there a long time: https://en.wikipedia.org/wiki/The_Thing_(listening_device) https://en.wikipedia.org/wiki/The_Thing_(listening_device) Extra points: make it something powered (like a clock) and make them plug it in. Battery charge for initial scan, and if you get lucky, they'll recharge the battery by plugging in the device.
LinuxBender 7y ago
Or drop off a solar powered Pineapple [1] on the roof with a drone and maybe an extra battery. Assuming you are in the same geographic area, that is. [1] - https://shop.hak5.org/products/wifi-pineapple https://shop.hak5.org/products/wifi-pineapple

That seems like a lot of hassle and a pretty big federal crime for only being able to attack Wi-Fi networks. Why not just park your car outside and use a laptop?

ISL 7y ago

If you can't enter a country or a facility, the mail usually can.

mikece 7y ago

How long can you sit outside a company running Kali Linux and a high gain antenna array before you attract attention? If you ship someone on the DevOps team a WiFi-connected plush toy that listens for webhooks from your CI/CD platform to make happy/sad noises when the build passes/fails -- AND THEY PLUG IT IN AND LEAVE IT ON -- then the ability to have passive access to the network for a long period of time will be less noticed. The example of the WiFi connected stuffed animal listening for webhooks isn't a made-up example -- I read a blog post about that years ago. Some team had a "build bunny" whose ears perked up and made happy noises when the build passed and the ears drooped and made a sad trombone noise when builds failed. The thing is already RF-active... would anyone break out a spectrum analyzer to notice if the thing was also transmitting/receiving on LTE and not just WiFi?

miah_ 7y ago
There was also, The Thing which was a gift from Young Pioneer organization of the Soviet Union to Ambassador Harriman in 1945. It was discovered to be a passive listening device seven years later. https://en.wikipedia.org/wiki/The_Thing_(listening_device) https://en.wikipedia.org/wiki/The_Thing_(listening_device)
overcast 7y ago
I suspect way longer than you think. Ten of thousands of small businesses don't pay attention to that stuff.
heavenlyblue 7y ago
But this device won't work for more than a few days anyway.
- lb1lf 7y ago
  Just piggyback it onto something the recipient would want to plug in. Problem solved.
moftz 7y ago
A typical SUV or minivan with tinted windows that only parks there during business hours probably wouldn't attract much attention if the business was large enough that no one knew everyone that worked there. Integrate the yagi antenna into some part of the car like a bike rack or hide it inside a plastic roof carrier. Show up around the time that people are starting to come in so you can get a good spot for the antenna and leave when everyone else does.

lallysingh 7y ago

You don't even have to be in the same country as your target. You can ship with a fake source and be pretty much invisible. Using repurposed used hardware, this can also be crazy cheap. Fun idea: buy junk vendor swag (stuffed animal, glass globe, etc) off of ebay in bulk, then mail it to people you know have recently left the company (say, from scanning LinkedIn). They'll probably keep the package around for a while before disposing of it. Or even better, someone else claims it as 'free swag,' and keeps it in the office. Maybe it'll stay in there a long time: https://en.wikipedia.org/wiki/The_Thing_(listening_device) https://en.wikipedia.org/wiki/The_Thing_(listening_device) Extra points: make it something powered (like a clock) and make them plug it in. Battery charge for initial scan, and if you get lucky, they'll recharge the battery by plugging in the device.

LinuxBender 7y ago

Or drop off a solar powered Pineapple [1] on the roof with a drone and maybe an extra battery. Assuming you are in the same geographic area, that is. [1] - https://shop.hak5.org/products/wifi-pineapple https://shop.hak5.org/products/wifi-pineapple