6 ms·

> So no legal after play and just a slap on the wrist The problem with this is you have no idea what harm the guy actually may have caused; nor what other RPis

by gwd 5y ago

> So no legal after play and just a slap on the wrist The problem with this is you have no idea what harm the guy actually may have caused; nor what other RPis he may have set up around the company or around town. Next time he may be more careful with his username, set up the disk to be encrypted w/ a network key, &c, making future exploits more difficult to track down.

discardable_dan 5y ago
This, truly, is the thing to worry about: if it happened here, it likely happened at other companies. Turning a blind eye is a blank check to do it again.
- etothepii 5y ago
  The issue here is that this isn't just "one bad apple" that if we can remove everything will be ok. Which is what motivates the idea that punishing this bad actor will make everything better. There is a systematic issue at the heart of the way we do network security. You can by a lighting / usb cable that can do all of these things and more for $120 if he'd used that he'd never have gotten caught. We treat network security like physical security at our peril.
  - Ensorceled 5y ago
    > The issue here is that this isn't just "one bad apple" that if we can remove everything will be ok. Which is what motivates the idea that punishing this bad actor will make everything better. I think they are talking about this particular, singular, bad apple and the other companies that bad apple is also attacking right now and stopping that harm as opposed to "sending a message" to other bad apples.
    - etothepii 5y ago
      That feels like a choice for the victim. If after the business owner sat down with the perpetrator they decided it is just some script kiddie playing at being a spy then that's up to them. The wider issue remains that some script kiddie with $120 could have done this and got away with it for ever.
      - ianai 5y ago
        Do you have a suggestion for a change to treating network security?
        more_corn 5y ago
        1) 802.1x certificate based network security (The MDM configures each approved network device with a certificate so rogue devices can't get on the network) 2) Periodic security review (look at attached network devices and determine an owner and purpose for each one). 3) Configure SIEM to alert on long-lived outbound connections.
        ianai 5y ago
        Can that (1) be done with windows/Mac clients?
        ianai 5y ago
        Answering myself: yes, is industry standard, definitely a little odd to not have it configured on a corporate network past a handful of employees.
        jaywalk 5y ago
        There's a decent amount of infrastructure involved in getting 802.1x authentication up and running in an efficient manner. While it does provide very good security, it's not widely used because of that.
        ianai 5y ago
        Any idea on a good, at-home or small network alternative?
        nitrogen 5y ago
        Having a list of allowed MAC addresses, enforced per-port by a managed switch (or at least by the DHCP server and router), is a first step, though naturally it's easy to spoof a MAC address.
  - eternityforest 5y ago
    Without changing things so radically that we might not even be able to continue having a "Do everything in software with one click" society, social deterrence is going to to be important. Unless people are manually verifying GPG keys in person all the time, you're gonna need to trust someone. Even with a two man rule you need some degree of trust. Trust is easier when people know they might go to jail if they break it.
- asteroidp 5y ago
  File that under "not this companies problem"
  - TedDoesntTalk 5y ago
    It is possible the perpetrator acquired some embarrassing evidence about the company owner and was blackmailed. We’ll never know.
    - asteroidp 5y ago
      In the extremely unlikely chance he did, so what? He can face legal issues then Most private and embarrassing stuff rarely ever matters anyways. This isn't a movie
fnord123 5y ago
There is a case to be made for using the legal system as a deterrent. But there is also the case to made to not do that as in the case of Aaron Swartz.
- bitexploder 5y ago
  This is a lot more localized and malicious. I do think people deserve second chances, but the context of all this rubs me the wrong way. Maybe the building owner was right to not make it a legal matter, but this feels like more than a harmless experiment. The malicious persons operational security is obviously terrible. As someone who has done security research for over 15 years, I take the ethics of this sort of thing seriously. I fully expect repercussions of the legal sort if I did something like this without permission. The key detail being that this was done secretively in a private office.
  - e40 5y ago
    Given the relative sophistication of it, it feels more like practice. In that case, not even a slap on the wrist very well could be seen as encouragement.
- eternityforest 5y ago
  Seems like the decision becomes a matter of whether you agree with the motive then. But in this case.... the motive seems to be unknown.
suifbwish 5y ago
An encrypted disk would be kind of useless in such a device as it would require the user to login every time the device reboots, unless they intend for it to never be rebooted. I’m not sure what you mean by network key in this case.
- sneak 5y ago
  No, you can have the initrd boot to a dropbear sshd that allows the operator to ssh in on reboots and provide the key.
  - suifbwish 5y ago
    Wouldn’t that part of the disk then need to be unencrypted?
    - sneak 5y ago
      Yes, it does. It's pretty small, though, on the order of 100MB.
  - andrewnicolalde 5y ago
    There are also options like the Zymkey[1] which is essentially an add-on TPM which can auto-decrypt the disk if it detects that the Raspberry Pi and SD card it is connected to have not changed. Not sure how difficult that would really be to defeat given enough effort though. [1] https://www.zymbit.com/zymkey/ https://www.zymbit.com/zymkey/
  - fho 5y ago
    If you count on the device running "forever", or at least until you pick it up again, you could also just store the key on the device and delete/destroy it (the key) on boot.
    - asteroidp 5y ago
      Why in god's name would you pick it up later? Installing it in the first place was a huge risk. Removing it is just doubling down
fortran77 5y ago
Are all parents who run "gifted children" blogs scammers of some sort? It sure seems like it.
charles_f 5y ago
He did get fired though, not as if he just got his raspberry back and went about whistling happily

by gwd 5y ago

discardable_dan 5y ago

This, truly, is the thing to worry about: if it happened here, it likely happened at other companies. Turning a blind eye is a blank check to do it again.

etothepii 5y ago
The issue here is that this isn't just "one bad apple" that if we can remove everything will be ok. Which is what motivates the idea that punishing this bad actor will make everything better. There is a systematic issue at the heart of the way we do network security. You can by a lighting / usb cable that can do all of these things and more for $120 if he'd used that he'd never have gotten caught. We treat network security like physical security at our peril.
- Ensorceled 5y ago
  > The issue here is that this isn't just "one bad apple" that if we can remove everything will be ok. Which is what motivates the idea that punishing this bad actor will make everything better. I think they are talking about this particular, singular, bad apple and the other companies that bad apple is also attacking right now and stopping that harm as opposed to "sending a message" to other bad apples.
  - etothepii 5y ago
    That feels like a choice for the victim. If after the business owner sat down with the perpetrator they decided it is just some script kiddie playing at being a spy then that's up to them. The wider issue remains that some script kiddie with $120 could have done this and got away with it for ever.
    - ianai 5y ago
      Do you have a suggestion for a change to treating network security?
      - more_corn 5y ago
        1) 802.1x certificate based network security (The MDM configures each approved network device with a certificate so rogue devices can't get on the network) 2) Periodic security review (look at attached network devices and determine an owner and purpose for each one). 3) Configure SIEM to alert on long-lived outbound connections.
        ianai 5y ago
        Can that (1) be done with windows/Mac clients?
        ianai 5y ago
        Answering myself: yes, is industry standard, definitely a little odd to not have it configured on a corporate network past a handful of employees.
        jaywalk 5y ago
        There's a decent amount of infrastructure involved in getting 802.1x authentication up and running in an efficient manner. While it does provide very good security, it's not widely used because of that.
        ianai 5y ago
        Any idea on a good, at-home or small network alternative?
        nitrogen 5y ago
        Having a list of allowed MAC addresses, enforced per-port by a managed switch (or at least by the DHCP server and router), is a first step, though naturally it's easy to spoof a MAC address.
- eternityforest 5y ago
  Without changing things so radically that we might not even be able to continue having a "Do everything in software with one click" society, social deterrence is going to to be important. Unless people are manually verifying GPG keys in person all the time, you're gonna need to trust someone. Even with a two man rule you need some degree of trust. Trust is easier when people know they might go to jail if they break it.
asteroidp 5y ago
File that under "not this companies problem"
- TedDoesntTalk 5y ago
  It is possible the perpetrator acquired some embarrassing evidence about the company owner and was blackmailed. We’ll never know.
  - asteroidp 5y ago
    In the extremely unlikely chance he did, so what? He can face legal issues then Most private and embarrassing stuff rarely ever matters anyways. This isn't a movie

fnord123 5y ago

There is a case to be made for using the legal system as a deterrent. But there is also the case to made to not do that as in the case of Aaron Swartz.

bitexploder 5y ago
This is a lot more localized and malicious. I do think people deserve second chances, but the context of all this rubs me the wrong way. Maybe the building owner was right to not make it a legal matter, but this feels like more than a harmless experiment. The malicious persons operational security is obviously terrible. As someone who has done security research for over 15 years, I take the ethics of this sort of thing seriously. I fully expect repercussions of the legal sort if I did something like this without permission. The key detail being that this was done secretively in a private office.
- e40 5y ago
  Given the relative sophistication of it, it feels more like practice. In that case, not even a slap on the wrist very well could be seen as encouragement.
eternityforest 5y ago
Seems like the decision becomes a matter of whether you agree with the motive then. But in this case.... the motive seems to be unknown.

suifbwish 5y ago

An encrypted disk would be kind of useless in such a device as it would require the user to login every time the device reboots, unless they intend for it to never be rebooted. I’m not sure what you mean by network key in this case.

sneak 5y ago
No, you can have the initrd boot to a dropbear sshd that allows the operator to ssh in on reboots and provide the key.
- suifbwish 5y ago
  Wouldn’t that part of the disk then need to be unencrypted?
  - sneak 5y ago
    Yes, it does. It's pretty small, though, on the order of 100MB.
- andrewnicolalde 5y ago
  There are also options like the Zymkey[1] which is essentially an add-on TPM which can auto-decrypt the disk if it detects that the Raspberry Pi and SD card it is connected to have not changed. Not sure how difficult that would really be to defeat given enough effort though. [1] https://www.zymbit.com/zymkey/ https://www.zymbit.com/zymkey/
- fho 5y ago
  If you count on the device running "forever", or at least until you pick it up again, you could also just store the key on the device and delete/destroy it (the key) on boot.
  - asteroidp 5y ago
    Why in god's name would you pick it up later? Installing it in the first place was a huge risk. Removing it is just doubling down

fortran77 5y ago

Are all parents who run "gifted children" blogs scammers of some sort? It sure seems like it.

charles_f 5y ago

He did get fired though, not as if he just got his raspberry back and went about whistling happily