13 ms·

Author of the article here. Since I first published this blog post I was getting messages from people asking how it ended. Sadly it's pretty anticlimactic as t

Author of the article here. Since I first published this blog post I was getting messages from people asking how it ended. Sadly it's pretty anticlimactic as the owner of the place had a meeting with the guy who put the Pi there (without me as he didn't want the Pi-dropper to feel ambushed) and in the end decided not to escalate it to legal and just basically told him to pack his things and get out. So no legal after play and just a slap on the wrist

helsinkiandrew 5y ago
Would have been interesting to see what they were doing - nRF52832-MDK doesn't have wifi - perhaps the person was scanning/logging bluetooth devices.
deleted 5y ago
[deleted]
qngcdvy 5y ago
Did you ever find out what it did there exactly? Like, what it collected and what the "gifted person" wanted to do with that data? edit: Thanks for the write-up btw. Was a nice read, although a bit short (which is the story's fault I guess)
- deleted 5y ago
  [deleted]
- xattt 5y ago
  Is “gifted person” code for something? Are they from some sort of enrichment program?
  - xwdv 5y ago
    “Gifted” individuals are selected at early ages to run through rigorous education programs that greatly push them ahead of their peers. It is a pipeline to create intellectual elites and captains of industry. Gifted kids are widely accepted as the most intelligent kids of a school and held up as the finest examples of the school’s educational abilities.
    - bitexploder 5y ago
      Do kids in gifted programs go on to become intellectual elites and “captains of industry” at higher rates than their peers?
      - didericis 5y ago
        Good question. The programs themselves are generally good, as far as I’ve experienced, but the culture around them is often quite toxic. Many kids are treated like race horses. I’m not sure how effective they are on net. Most highly successful people seem like autodidacts that end up finding the resources they need one way or another. Would guess the best way to create more of those people is just to keep a lot of doors open and hope someone like that walks through.
        DarylZero 5y ago
        Culture overrun by rich overachievers gaming the selection system?
        didericis 5y ago
        That’s a fairly blunt description, but I think it’s roughly accurate. I think there are plenty of middle income and low income overachievers in there as well. Recent immigrants can be incredibly demanding and hard on kids who might not be naturally inclined to pursue that kind of thing without external pressure, as can competitive suburbanites. But by trying to mitigate the risk of toxicity you can go too far in the other direction and end up not pushing smart kids to reach their full potential, which is also bad. Striking the right balance is hard.
      - pnutjam 5y ago
        haha... no, but their parents feel special. NY public schools used their gifted program as a way to keep white kids in majority non-white schools.
      - itbeho 5y ago
        This one didn't:)
  - quassy 5y ago
    It's in the article: The author found information about the presumed attacker on a site where parents write about their gifted (= highly talented) children.
    - xattt 5y ago
      Thanks! I couldn’t handle the tension and jumped to the end of the article to see how it unfolded.
gwd 5y ago
> So no legal after play and just a slap on the wrist The problem with this is you have no idea what harm the guy actually may have caused; nor what other RPis he may have set up around the company or around town. Next time he may be more careful with his username, set up the disk to be encrypted w/ a network key, &c, making future exploits more difficult to track down.
- discardable_dan 5y ago
  This, truly, is the thing to worry about: if it happened here, it likely happened at other companies. Turning a blind eye is a blank check to do it again.
  - etothepii 5y ago
    The issue here is that this isn't just "one bad apple" that if we can remove everything will be ok. Which is what motivates the idea that punishing this bad actor will make everything better. There is a systematic issue at the heart of the way we do network security. You can by a lighting / usb cable that can do all of these things and more for $120 if he'd used that he'd never have gotten caught. We treat network security like physical security at our peril.
    - Ensorceled 5y ago
      > The issue here is that this isn't just "one bad apple" that if we can remove everything will be ok. Which is what motivates the idea that punishing this bad actor will make everything better. I think they are talking about this particular, singular, bad apple and the other companies that bad apple is also attacking right now and stopping that harm as opposed to "sending a message" to other bad apples.
      - etothepii 5y ago
        That feels like a choice for the victim. If after the business owner sat down with the perpetrator they decided it is just some script kiddie playing at being a spy then that's up to them. The wider issue remains that some script kiddie with $120 could have done this and got away with it for ever.
makach 5y ago
omg, that guy got of the hook easy. he should play the lottery considering how lucky this was.
Chris2048 5y ago
> told him to pack his things and get out I though the suspects were an ex-employee, and some guy that didn't work there (the part-owner), so was an actual current employee implicated in the end?
- pdpi 5y ago
  My understanding is: ex-employee bought/acquired the device from the "gifted guy"/part-owner, and deployed it in the network cabinet by using the key he still had.
- smcl 5y ago
  An ex-employee who still had a key to the office so they could move some stuff they had there. Presumably that courtesy was immediately terminated and the key was returned.
  - Chris2048 5y ago
    oooh, I didn't realise they still had the key at that point. OK, I wouldn't have even said that - I'd have asked for the key back and boxed the remaining stuff myself. TBH, I'm surprised to what extend the employee would of had a bunch of stuff there - did they have furniture there or something?!
    - smcl 5y ago
      Yeah it sounds like the person was on good terms with the company and was trusted enough, must have stung for whoever made the decision to trust the ex-employee to be sorta betrayed like that. The blog author is somewhere in the comments here, I don't know if they're willing to share much more info but let's see what they say.
      - Chris2048 5y ago
        So the article mentions: > It was registered (or first deployed or set up?) on May 13th 2018 and the post itself is dated 2019-01-16 Since it says: > he could still have a key for a few months I assumed that by then the employee had given back the key, but I guess I was making a few assumptions about when this happened, and when the device had been installed - they don't actually say what date the RADIUS logs revealed they had accessed the network.
perfopt 5y ago
As I was reading this I was hoping for modern day Cuckoo's Egg. But it was not to be. Great write up. Thanks for sharing.
- danesparza 5y ago
  For anybody wondering, the Cuckoo's Egg (written in 1989 by Cliff Stoll) is a wonderful read about tracking an early hacker. I highly recommend it.
  - Joe_Boogz 5y ago
    Thanks for the recommendation
kumarvvr 5y ago
Seem pertinent to atleast get an affidavit from the ex-employee detailing what he as done, agree to hold on to the hardware as evidence, put liability on the employee for any time-bombs that might have been stored, ask him explicitly to give in writing all the activities he performed, etc. Just to have a thread to pull on, in the future, when something might go wrong.
- geek_at 5y ago
  We did get a hand written statement from him and the original evidence (hardware) is still untouched and locked away. In his statement he wrote that the pi logged to the SD card but there was no data on the SD card (well not on the data partition) and I'm pretty sure that was a lie and it just logged to Balena. But even though we could never decipher what the nodejs program actually did (because it was so heavily obfuscated) our internal working theory is that he was tracking the movement data of the boss to avoid him whenever possible.
  - Abimelex 5y ago
    how hard can you obfuscate nodejs? I'm pretty sure if you drop the code in some infosec channels they will happily take the challenge and tell you what it does ;)
    - TedDoesntTalk 5y ago
      An easier solution might be to look at the packets the nodejs program is sending over the network (if you can configure a MITM)
      - vorticalbox 5y ago
        Its package.json and / or node_modules might also give some clues
  - ChuckNorris89 5y ago
    >he was tracking the movement data of the boss to avoid him whenever possible. Wow, imagine hating your boss so much you go to so much creative and illegal lengths (that can backfire against you) to track him, instead of using same skills legally to finding a better job. I just don't get, something doesn't feel right about this being the true reason. To me it looks more like he wanted a covert backdoor in the company network for IP-theft, black-mail or other such data exfiltration purposes. If only he knew that in a year he could avoid his boss all the time thanks to covid-WFH.
causality0 5y ago
Shoot, with the info you got I'd have least called his parents and tattled on him. If you can't put him in jail at least embarrass the shit out of him.
rheophile 5y ago
post the nodejs in a git repo so we can see what he was doing.
deleted 5y ago
[deleted]
cerved 5y ago
> cat config.json | jq cries in UUoC

helsinkiandrew 5y ago

Would have been interesting to see what they were doing - nRF52832-MDK doesn't have wifi - perhaps the person was scanning/logging bluetooth devices.

deleted 5y ago

[deleted]

qngcdvy 5y ago

Did you ever find out what it did there exactly? Like, what it collected and what the "gifted person" wanted to do with that data? edit: Thanks for the write-up btw. Was a nice read, although a bit short (which is the story's fault I guess)

deleted 5y ago
[deleted]
xattt 5y ago
Is “gifted person” code for something? Are they from some sort of enrichment program?
- xwdv 5y ago
  “Gifted” individuals are selected at early ages to run through rigorous education programs that greatly push them ahead of their peers. It is a pipeline to create intellectual elites and captains of industry. Gifted kids are widely accepted as the most intelligent kids of a school and held up as the finest examples of the school’s educational abilities.
  - bitexploder 5y ago
    Do kids in gifted programs go on to become intellectual elites and “captains of industry” at higher rates than their peers?
    - didericis 5y ago
      Good question. The programs themselves are generally good, as far as I’ve experienced, but the culture around them is often quite toxic. Many kids are treated like race horses. I’m not sure how effective they are on net. Most highly successful people seem like autodidacts that end up finding the resources they need one way or another. Would guess the best way to create more of those people is just to keep a lot of doors open and hope someone like that walks through.
      - DarylZero 5y ago
        Culture overrun by rich overachievers gaming the selection system?
        didericis 5y ago
        That’s a fairly blunt description, but I think it’s roughly accurate. I think there are plenty of middle income and low income overachievers in there as well. Recent immigrants can be incredibly demanding and hard on kids who might not be naturally inclined to pursue that kind of thing without external pressure, as can competitive suburbanites. But by trying to mitigate the risk of toxicity you can go too far in the other direction and end up not pushing smart kids to reach their full potential, which is also bad. Striking the right balance is hard.
    - pnutjam 5y ago
      haha... no, but their parents feel special. NY public schools used their gifted program as a way to keep white kids in majority non-white schools.
    - itbeho 5y ago
      This one didn't:)
- quassy 5y ago
  It's in the article: The author found information about the presumed attacker on a site where parents write about their gifted (= highly talented) children.
  - xattt 5y ago
    Thanks! I couldn’t handle the tension and jumped to the end of the article to see how it unfolded.

gwd 5y ago

> So no legal after play and just a slap on the wrist The problem with this is you have no idea what harm the guy actually may have caused; nor what other RPis he may have set up around the company or around town. Next time he may be more careful with his username, set up the disk to be encrypted w/ a network key, &c, making future exploits more difficult to track down.

discardable_dan 5y ago
This, truly, is the thing to worry about: if it happened here, it likely happened at other companies. Turning a blind eye is a blank check to do it again.
- etothepii 5y ago
  The issue here is that this isn't just "one bad apple" that if we can remove everything will be ok. Which is what motivates the idea that punishing this bad actor will make everything better. There is a systematic issue at the heart of the way we do network security. You can by a lighting / usb cable that can do all of these things and more for $120 if he'd used that he'd never have gotten caught. We treat network security like physical security at our peril.
  - Ensorceled 5y ago
    > The issue here is that this isn't just "one bad apple" that if we can remove everything will be ok. Which is what motivates the idea that punishing this bad actor will make everything better. I think they are talking about this particular, singular, bad apple and the other companies that bad apple is also attacking right now and stopping that harm as opposed to "sending a message" to other bad apples.
    - etothepii 5y ago
      That feels like a choice for the victim. If after the business owner sat down with the perpetrator they decided it is just some script kiddie playing at being a spy then that's up to them. The wider issue remains that some script kiddie with $120 could have done this and got away with it for ever.

makach 5y ago

omg, that guy got of the hook easy. he should play the lottery considering how lucky this was.

Chris2048 5y ago

> told him to pack his things and get out I though the suspects were an ex-employee, and some guy that didn't work there (the part-owner), so was an actual current employee implicated in the end?

pdpi 5y ago
My understanding is: ex-employee bought/acquired the device from the "gifted guy"/part-owner, and deployed it in the network cabinet by using the key he still had.
smcl 5y ago
An ex-employee who still had a key to the office so they could move some stuff they had there. Presumably that courtesy was immediately terminated and the key was returned.
- Chris2048 5y ago
  oooh, I didn't realise they still had the key at that point. OK, I wouldn't have even said that - I'd have asked for the key back and boxed the remaining stuff myself. TBH, I'm surprised to what extend the employee would of had a bunch of stuff there - did they have furniture there or something?!
  - smcl 5y ago
    Yeah it sounds like the person was on good terms with the company and was trusted enough, must have stung for whoever made the decision to trust the ex-employee to be sorta betrayed like that. The blog author is somewhere in the comments here, I don't know if they're willing to share much more info but let's see what they say.
    - Chris2048 5y ago
      So the article mentions: > It was registered (or first deployed or set up?) on May 13th 2018 and the post itself is dated 2019-01-16 Since it says: > he could still have a key for a few months I assumed that by then the employee had given back the key, but I guess I was making a few assumptions about when this happened, and when the device had been installed - they don't actually say what date the RADIUS logs revealed they had accessed the network.

perfopt 5y ago

As I was reading this I was hoping for modern day Cuckoo's Egg. But it was not to be. Great write up. Thanks for sharing.

danesparza 5y ago
For anybody wondering, the Cuckoo's Egg (written in 1989 by Cliff Stoll) is a wonderful read about tracking an early hacker. I highly recommend it.
- Joe_Boogz 5y ago
  Thanks for the recommendation

kumarvvr 5y ago

Seem pertinent to atleast get an affidavit from the ex-employee detailing what he as done, agree to hold on to the hardware as evidence, put liability on the employee for any time-bombs that might have been stored, ask him explicitly to give in writing all the activities he performed, etc. Just to have a thread to pull on, in the future, when something might go wrong.

geek_at 5y ago
We did get a hand written statement from him and the original evidence (hardware) is still untouched and locked away. In his statement he wrote that the pi logged to the SD card but there was no data on the SD card (well not on the data partition) and I'm pretty sure that was a lie and it just logged to Balena. But even though we could never decipher what the nodejs program actually did (because it was so heavily obfuscated) our internal working theory is that he was tracking the movement data of the boss to avoid him whenever possible.
- Abimelex 5y ago
  how hard can you obfuscate nodejs? I'm pretty sure if you drop the code in some infosec channels they will happily take the challenge and tell you what it does ;)
  - TedDoesntTalk 5y ago
    An easier solution might be to look at the packets the nodejs program is sending over the network (if you can configure a MITM)
    - vorticalbox 5y ago
      Its package.json and / or node_modules might also give some clues
- ChuckNorris89 5y ago
  >he was tracking the movement data of the boss to avoid him whenever possible. Wow, imagine hating your boss so much you go to so much creative and illegal lengths (that can backfire against you) to track him, instead of using same skills legally to finding a better job. I just don't get, something doesn't feel right about this being the true reason. To me it looks more like he wanted a covert backdoor in the company network for IP-theft, black-mail or other such data exfiltration purposes. If only he knew that in a year he could avoid his boss all the time thanks to covid-WFH.

causality0 5y ago

Shoot, with the info you got I'd have least called his parents and tattled on him. If you can't put him in jail at least embarrass the shit out of him.

rheophile 5y ago

post the nodejs in a git repo so we can see what he was doing.

deleted 5y ago

[deleted]

cerved 5y ago

> cat config.json | jq cries in UUoC