Oh, fun! When a good Chinese manufacturer duplicates the form factor, someone can ship clones of these laden with malware for spear-phishing attacks on corporat

Oh, fun! When a good Chinese manufacturer duplicates the form factor, someone can ship clones of these laden with malware for spear-phishing attacks on corporate, industrial, and classified networks. > I connect the Snowcone to the power supply and to my network, and power up! After a few seconds of initialization, the device shows its IP address and invites me to connect: With a convincing e-Ink display, and an unusually long delay, you've probably got a good 10 minutes on this local network to 0-day your way into routers and client machines. > Next, I download AWS OpsHub for Snow Family, install it, and then configure it to access the device. I select Snowcone and click Next: By this point you make the device self-brick and print out an error about how it needs to be sent back to Amazon for repairs, due to being banged up during shipping. Extra scuffs or dents in the case will sell this. While the replacement is ordered, use your now client-resident malware to exfiltrate data as you like, since you know there's data worth them copying offline. Or trojan up every data format you see so that after the data is moved out via a working Snowball you can eventually find an internet-connected device to exfiltrate with.