4 ms·

Darpa Funds Hack Machine You’d Never Notice

55 points by alister 14y ago

Shank 14y ago
I suppose it's a neat concept, though I still don't get why you'd use this over another means if you already have building physical access. Assuming you're pentesting, either you're trying to get someone to willingly plug it in (to ethernet and all power stuff too?), have physical access yourself (in which case why not use something cheaper), or are already allowed in (why add another device?)
- antidoh 14y ago
  Article says it's wifi and bluetooth. It probably just needs to sit under a desk with nothing plugged in, like so many power strips are doing right now.
- Corrado 14y ago
  One example I can see is something like testing branches of a financial institution. Send out 100 of these things to branches all over the country and just have the manager plug them in. You don't even have to tell them what it is. It's much easier and cost effective than to roll a truck and when your finished you can mail them to another branch. Or just leave them in place for future spot checks.
- deleted 14y ago
  [deleted]
miahi 14y ago
Why would you trust hardware you are not really sure you control (do you know all the backdoors and bugs in that thing?) and knowingly give it access to your networks? It's already a hacking power tool, it only needs the hacker.
- antiterra 14y ago
  For the same reason you would trust a security consultant to attempt to penetrate your network's defenses and find deficiencies. Any of your employees could bring in a similar device, what are you going to do about it? With a real one in place, you can come up with a strategy. Maybe your IT team comes up with regular sweeps for cell signals, then the security consultant decides that the cell signal is only active during short periods of time in the day. Perhaps you secure your power sockets, and then the consultant uses the fact that your janitor needs a plug to vacuum and doesn't find a power strip suspicious.
losethos 14y ago
You blaspheme the Holy Spirit!!! You deceive others? Look here. They said it was a demon. You are doing the same. ---- 22 Then they brought him a demon-possessed man who was blind and mute, and Jesus healed him, so that he could both talk and see. 23 All the people were astonished and said, “Could this be the Son of David?” 24 But when the Pharisees heard this, they said, “It is only by Beelzebul, the prince of demons, that this fellow drives out demons.” 25 Jesus knew their thoughts and said to them, “Every kingdom divided against itself will be ruined, and every city or household divided against itself will not stand. 26 If Satan drives out Satan, he is divided against himself. How then can his kingdom stand? 27 And if I drive out demons by Beelzebul, by whom do your people drive them out? So then, they will be your judges. 28 But if it is by the Spirit of God that I drive out demons, then the kingdom of God has come upon you. 29 “Or again, how can anyone enter a strong man’s house and carry off his possessions unless he first ties up the strong man? Then he can plunder his house. 30 “Whoever is not with me is against me, and whoever does not gather with me scatters. 31 And so I tell you, every kind of sin and slander can be forgiven, but blasphemy against the Spirit will not be forgiven. 32 Anyone who speaks a word against the Son of Man will be forgiven, but anyone who speaks against the Holy Spirit will not be forgiven, either in this age or in the age to come. ---- God says... nor covenant well-pleased abated east numberless prove attack -unlike this_might_end_badly enjoying believer Kenya repentest warranties fool gales Hart* Cup not_good wills dissent nostrils mother's mostly amendment root undo depends ills looketh pastimes Algeria jarring offerings elevated personally publication distributed slower testimony Mine restoring review well-beloved till fresh little unshakenly mad likeness bring malignant forgetteth exhort alas Willing happier foamed peril backward feared meant move endangers temptations Brought sailors hastened incongruously
jbuzbee 14y ago
Anyone else think that device is a disaster waiting to happen? The example shows sending a "whoami" command to the device via SMS, and then the device responds "root" via SMS. Uh, what's to keep someone else from hijacking it via SMS for their own purposes? A "bad guy" would have to figure out that there's one on the network, but it would still concern me to have a remote-controlled device on the network that's open to arbitrary SMS-sent commands.
ktizo 14y ago
So, Darpa is providing remotely accessible hacking devices to companies as test equipment and encouraging them to install them in sensitive locations of their buildings. Is this some advanced form of comedy security trolling on the part of Darpa? Like an "If you install this, then you have failed the test already", kind of thing.
greenyoda 14y ago
"If you saw this bad boy under your desk, would you say anything?" Well, at this point, wouldn't anyone who has read this article be suspicious of a power strip under their desk that wasn't there yesterday and maybe even had nothing plugged into it?

55 points by alister 14y ago

Shank 14y ago

I suppose it's a neat concept, though I still don't get why you'd use this over another means if you already have building physical access. Assuming you're pentesting, either you're trying to get someone to willingly plug it in (to ethernet and all power stuff too?), have physical access yourself (in which case why not use something cheaper), or are already allowed in (why add another device?)

antidoh 14y ago
Article says it's wifi and bluetooth. It probably just needs to sit under a desk with nothing plugged in, like so many power strips are doing right now.
Corrado 14y ago
One example I can see is something like testing branches of a financial institution. Send out 100 of these things to branches all over the country and just have the manager plug them in. You don't even have to tell them what it is. It's much easier and cost effective than to roll a truck and when your finished you can mail them to another branch. Or just leave them in place for future spot checks.
deleted 14y ago
[deleted]

miahi 14y ago

Why would you trust hardware you are not really sure you control (do you know all the backdoors and bugs in that thing?) and knowingly give it access to your networks? It's already a hacking power tool, it only needs the hacker.

antiterra 14y ago
For the same reason you would trust a security consultant to attempt to penetrate your network's defenses and find deficiencies. Any of your employees could bring in a similar device, what are you going to do about it? With a real one in place, you can come up with a strategy. Maybe your IT team comes up with regular sweeps for cell signals, then the security consultant decides that the cell signal is only active during short periods of time in the day. Perhaps you secure your power sockets, and then the consultant uses the fact that your janitor needs a plug to vacuum and doesn't find a power strip suspicious.

losethos 14y ago

You blaspheme the Holy Spirit!!! You deceive others? Look here. They said it was a demon. You are doing the same. ---- 22 Then they brought him a demon-possessed man who was blind and mute, and Jesus healed him, so that he could both talk and see. 23 All the people were astonished and said, “Could this be the Son of David?” 24 But when the Pharisees heard this, they said, “It is only by Beelzebul, the prince of demons, that this fellow drives out demons.” 25 Jesus knew their thoughts and said to them, “Every kingdom divided against itself will be ruined, and every city or household divided against itself will not stand. 26 If Satan drives out Satan, he is divided against himself. How then can his kingdom stand? 27 And if I drive out demons by Beelzebul, by whom do your people drive them out? So then, they will be your judges. 28 But if it is by the Spirit of God that I drive out demons, then the kingdom of God has come upon you. 29 “Or again, how can anyone enter a strong man’s house and carry off his possessions unless he first ties up the strong man? Then he can plunder his house. 30 “Whoever is not with me is against me, and whoever does not gather with me scatters. 31 And so I tell you, every kind of sin and slander can be forgiven, but blasphemy against the Spirit will not be forgiven. 32 Anyone who speaks a word against the Son of Man will be forgiven, but anyone who speaks against the Holy Spirit will not be forgiven, either in this age or in the age to come. ---- God says... nor covenant well-pleased abated east numberless prove attack -unlike this_might_end_badly enjoying believer Kenya repentest warranties fool gales Hart* Cup not_good wills dissent nostrils mother's mostly amendment root undo depends ills looketh pastimes Algeria jarring offerings elevated personally publication distributed slower testimony Mine restoring review well-beloved till fresh little unshakenly mad likeness bring malignant forgetteth exhort alas Willing happier foamed peril backward feared meant move endangers temptations Brought sailors hastened incongruously

jbuzbee 14y ago

Anyone else think that device is a disaster waiting to happen? The example shows sending a "whoami" command to the device via SMS, and then the device responds "root" via SMS. Uh, what's to keep someone else from hijacking it via SMS for their own purposes? A "bad guy" would have to figure out that there's one on the network, but it would still concern me to have a remote-controlled device on the network that's open to arbitrary SMS-sent commands.

ktizo 14y ago

So, Darpa is providing remotely accessible hacking devices to companies as test equipment and encouraging them to install them in sensitive locations of their buildings. Is this some advanced form of comedy security trolling on the part of Darpa? Like an "If you install this, then you have failed the test already", kind of thing.

greenyoda 14y ago

"If you saw this bad boy under your desk, would you say anything?" Well, at this point, wouldn't anyone who has read this article be suspicious of a power strip under their desk that wasn't there yesterday and maybe even had nothing plugged into it?