Slashdot Mirror
Attack Of The Dreamcasts
kevin_conaway writes "A pair of coders are now suggesting that it is possible, with a modified dreamcast system running Linux to sneek into an office building and stick it on a network drop and leave. The dreamcast will then probe for ways to connect to the outside world. They say they have created similar software for iPAQs and a special bootable cdroms for print servers and similar boxes. Just a reminder that are networks need to be as secure on the inside as they should be on the outside. Get the story here."
from sneaking in and connecting a laptop to the network? I mean, wouldn't a Dreamcast plugged into the company network be a bit more suspicious than a computer?
#include <sig.h>
They should replace "dreamcast" with "any machine with an IP stack". Physical security on a network is important in any case, whether it be small like a dreamcast or big like an e10k ;)
Its surprising that the dreamcast got discontinued so fast...=/
I SURVIVED THE GREAT SLASHDOT BLACKOUT OF 2002!
... that inside physical security is just as important as network/software level security - if not more so.
Don't blame me, I voted for Kodos
Is when someone hacks an iPod to do this. You could hide it in a wall and have an IEEE-1394 to 10base-T adapter with a cat-5 cable right into a patch panel in the wiring closet labeled D-103...
This seems to have slipped past the editors. Just a reminder that are networks need to be as secure on the inside as they should be on the outside.
Here is the place to get Linux for your Dreamcast.
see some one "sneek" into my office building.. or did you mean "sneAk"?
The war with islam is a war on the beast
The war on terror is a war for peace
Someone strolls into the office, notices a dreambox in the corner... and they say "Hmmm, that is normal, I'll just ignore that"... hehe
More likely that they would say "Cool, lets see what game is in it!"
"CPU's Don't make mistakes....They just miss a few cycles sometimes..."
But couldn't any computer capable of running Linux and sending/receiving network traffic be able to do this as well? I'd be suspicious of a Dreamcast box sitting in a cube connected to the network. I'm guessing that the only real reason they're focusing on Dreamcasts and not normal PC's are that they're very cheap to obtain and reconfigure.
Higbee and Davis perform penetration tests, and developed their game box cum attack tool
</quote>
Did I read that right?
"our" not "are"
"I have no special gift, I am only passionately curious." - Albert Einstein
"but said that ultimately, there may be little an organization can do to prevent an attacker with physical access from setting up a covert channel home. " But if you can get physical access, why not just use one of the computers so thoughtfully preinstalled by the network administrator? Heck, they were probably even left logged in overnight by the lusers. This doesn't seem all that revolutionary..."If I can get into your building, I can do bad stuff". No? Really? Wow...noone's had that idea since...ummm...the invention of the house.
this would not be a problem, but you won't get this bit of analysis from /., which is so biased towards Linux that it's not even funny. This is being characterized as a "cool hack" because it involves Linux. How much do you want to bet that if it involved putting Windows on a Dreamcast and sneaking it into corporate networks, the /. crew would be in full MS-Bashing Mode? "Gee, look at how dangerous Windows is!"
This is sick, but it's pretty much what I've come to expect. You reap what you sow.
If I walked into an office and I saw someone left their dreamcast there, YOINK! Free Video game system for me.
God spoke to me
I'm pretty sure that someone would notice a dreamcast system sitting on their server rack. However, if you hide it behind a wall, it could sit there for years!
Wyatt
Karma: Marginal (mostly due to the border around the website)
What is the specific relevance of the "Dreamcast" application? I think we all get that consoles are "computers", and with an operating system like Linux there is little to differentiate them from a PC, so why would someone be more likely to drop a rather out-of-place looking dreamcast in a corporation for inside attacks? It just seems really silly to proclaim that there's some additional risk because "theoretically" a dreamcast can be used.
Having said that, many large corporations now enable/disable network drops in a very controlled fashion, and many do MAC filtering on each switch port, the former limits "free" ports sitting for the waiting, and latter ensures that if someone put a hub on one of the active ports that they couldn't communicate on it without a small amount of work (i.e. listening for MAC addresses and then dealing with the conflicts if it tried to duplicate the other devices MAC address). I'm sure there are a lot of companies still getting by with 10Mbps hubs, but I'd like to think that they're the exception rather than the rule now a days? Of course, many companies still have an absurd notion that security is had by simply putting up a firewall, and then all is great, ignoring the massive risk that comes from trojans that get inside the gates. I actually got in an argument with an associate in the business recently when I stipulated that their system needs to presume that there is no firewall, and the system is completely accessible to the outside world. His reply was "Well, we don't worry much about hackers anyways, because there's no way to stop the good ones so why bother?". I was flabbergasted.
what do they mean "security inside?" the whole point of a network / firewall setup is that people can't get to you from the outside INTO your inside.
a posting on my local lug group mailing list suggested that firewalls are bad because it relaxed internal network security. that is like saying that you should remove the side rails on the highway, because that way people will be more aware of the dangers.
security on internal machines is always going to be inferior to that of the company firewall. what you should do is try to prevent people from sneaking in in the first place.if they are already in, there really is no limit to what they can do, because they have essentially hacked the network. (albeit physically)
QED
BSD is for people who love UNIX. Linux is for those who hate Microsoft.
Higbee and Davis perform penetration tests, and developed their game box cum attack tool after finding themselves more than once with physical access to a client's facilities They can't print that!
A recent story about 802.11 described the weakness as "Someone walks into your office with a laptop and asks for a network drop." The point of the anology was that the scenario is absurd, but leaving unsecured WAP access points is equally absurd.
Silly me, I hadn't realized the uber-absurd case -- someone walks into your office with a game console and asks for a network drop.
Enigmatically enough, I first read this tagline as "Attack of the Democrats"
Almost all companies I have visited have had the opposite 'problem'. To get an Internet connection up n' running, you need to phone a sysadmin to patch the ethernet socket to the switch (most often, the spares aren't connected at all) and then give them a MAC address so the dhcp will give the box a legitimate IP address in the correct space. (Also, Dreamcast?? Suspicious, no?!)
- FF
while true;do echo -e -n "\033[s\n\033[u\134_\033[B";done
--Chag
so much of today's lax security is due to legacy design, not inherent difficulty. this is worth remembering.
A machine with wireless networking capabilities would be even more interesting, particularly for networks not attached to the 'net. 802.11 would probably not be best due to its limited range and higher security consciousness around it. Better would be say a pair of old ricochet modems that have range of up to a mile.
To only have connectivity on actively used network drops, and keep all switches in secure closets? To plug in an unknown machine in our office you would have to unplug a known one, and someone's gonna at least notice their computer stopped working. Wouldn't take long after that to discover the switch had taken place. That could easily be circumvented with a machine acting like a silent proxy, but still makes it a tad more difficult. Don't other companies practice similar procedures?
...if someone came into my house and dropped off a dreamcast! :-)
-Derek
Although the article doesn't mention this, I'm guessing that since they have a custom linux installation, that the modded dreamcast won't be able to run its normal dreamcast functions. What would make this seem even more inncuous would be to allow it play games too.
Other people keep asking why a DreamCast, why not a laptop... I'm assuming they're using DreamCasts because they are cheap, and they don't mind throwing them away to accomplish their task.
While it's a slang term for something sexual, it's also latin for "with". It's being misused in this context.
I am not merely a "consumer" or a "taxpayer". I am a Citizen of the State of Texas
With that in mind, when was the last time you walked into your company in non-work clothes, you knew where you were going, and walked confidently there and no one stopped and questioned you? I wear a name tag and go there every day, but in my shorts and tshirt with no name tag, I'm never stopped. I think thats the way it is in many places.
Sure you could plug a laptop in, but who wants to drop $300-400 for a cheap laptop that will probably get confiscated. For the same price you could by 4-5 Dreamcasts. You could scatter them around to a few drops as backup. In addition, the footprint of the box is small, and you don't need a standard PC case. Who wants to buy a BookPC or a Cappucino (sp) only to lose it.
Other way to look at this would be for a handy ligitimate network tool. It would be nice to plug a machine into a network, have it snoop around, and then come back the next day and get a report on bottlenecks, machine usage, etc.
--
"That's Homer Simpson sir. One of your drones from sector 7G"
Been to Pirate Training School?
Replacing 'our' with 'are' is a very common pirate thing to do. Of course, even that was slightly misspelled since 'arr' is the most correct usage, matey...
-.-
If you ignore the other uses of a tool, does that make the tool less useful, or you less useful?
This reminds me of my university where people connect their laptops to the network when they aren't supposed to do so. It isn't to tricky either, you just need to find a desktop someone isn't using, find out it's IP, unplug it, set your machine to it's IP address and connect it up. Now I imagine this would present quite similiar security problems to a rogue Dreamcast or iPaq connected to the network.
Perhaps the only way to overcome this problems is give IP addresses to trusted MAC addresses only. In the context of a university this could mean the student could apply for an IP address, but could you trust the student? That's the real question
aus.music.scrapbook
I don't know who makes the NIC cards in the Dreamcast, but if it was a non-standard NIC (like 3Com or Linksys etc...)wouldn't anyone doing any sniffing at all notice a wierd MAC address (meaning the first few bytes which indicate the manufacturer) on their network?
... [Insert decent Sig]
"I bet I'll get blamed for this." --Mayor Quimby
"availability of an Ethernet adaptor"?
You almost have to kill someone to get a network adaptor for the Dreamcast. I'm not even sure they're being manufactured anymore (I wouldn't think so), but there are a few on eBay; the cheapest one is $60.
Besides, as other posters have mentioned, a Dreamcast doesn't exactly look inconspicuous to me, especially if some person I don't recognise is carrying one around in my building.
WMBC freeform/independent online radio.
I remember building what looked like a serial port gender changer with a wire hanging out of it, but was really an AM transmitter. Plug it into a serial port, and it acted as a radio modem sending out everything that went over the serial port.
...
This was back in the days of 1200/2400 baud modems. Plans for the device were in 2600 magazine. It had a range of about 500 meters, and broadcast on about 560 KHz. You needed a companion device on the other end. You could record the audio signals then decode them on your PC later.
On a side note. Even better would be a handheld with TWO expansion ports -- one ethernet to sniff and one 802.11b to sneak it out. Just park across the street with a laptop and another 802.11b card. Instant backdoor to the network.
Learning HOW to think is more important than learning WHAT to think.
This is, by far, the most useful use for a Dreamcast I've heard of.
--trb
Why not just stick a wireless access point on the network. Put it on the floor near a window or something, and you should be in business... This would even work on the most secure networks.
I want my rights back. I was actually using them when our government stole them after 9/11.
for those of you w/real reasons to be concerned- would be that if these guys have thought of this - who else already has something much better in a nice small, concealable package.
And then think about how many businesses don't even come close to providing physical security to all the ports that connect to their network. Sure the computer room is locked- but how many cleaning people are in the offices at night? Usually if you worry about them at all- it would be that they steal, not leave something behind.
I had to do some work once at a call center for a client of ours. A large credit card company.
I pulled up to their building but it was this big glass box and I wasn't sure where the entrance was. I just walked around until I found a door. It was open and their were people standing around smoking. So I walked in. I was in the back by the break room.
I wandered around in there for 10 minutes or so until I found the front desk. When I walked into the lobby from inside the building and asked for the guy I was supposed to meet she was pretty freaked out. They brought up security people and asked how I got in, etc.
I hope my credit card company isn't that easy to get into. But I'd be surprised if its much more secure. I wouldn't be surprised it it is less secure.
Something to think about.
.
It's hard to believe that's how Micronians are made. Why don't we see it right now by having you both kiss one another?
... so I just popped in NFL2K2 and showed the hacker who was boss!!
Good quote, too many chars. Seriously, the slashdot 120 char limit sucks!
With the source code you can a variety of things, like getting the OS to run on platforms not originally intended to run that type of OS. Is it even marginally possible to get Windows to boot on anything other than a x86 or Itanium based system these days? (Note: I am only talking about modern releases of Windows, not NT4.0 and its Alpha support. This is not counting XP Embedded or WinCE/PocketPC releases, which again are limited to one maybe two processor types.)
-.-
If you ignore the other uses of a tool, does that make the tool less useful, or you less useful?
All those girl ninjas running around stealthily tucking Dreamcasts under their arms - They weren't trying to steal them. They were trying to deploy them!
Now I understand the tagline... It's thinking...
"Mod, mod, mod...and another troll bites the dust."
Is it being misused? While the dictionary definition is "together with" (which would make the posting correct as it is a game machine together with an attack tool piece of software), the popular usage is sortof a "transformed into".
i.e.
Simple nerd cum spider shooting superhero
Lowly PC cum corporate server
blah blah.
Slashdot collects headlines from other news sites, attempts to filter out the uninteresting, and posts the goodies here for all to see.
There you go, Mr. DuMass.
I agree that a dreamcast is a stupid idea. It's bulky and relatively expensive, plus it needs to be modded. I did something similar to this to prove to a company I do work for that their network is easy to hack from the inside. I used my Palm m505 with ethernet adapter, running linux with a packet sniffer hat constantly logged traffic over 1 specific cat 5 cable. The great thing aout it was I was able to hide it within a vent. So no one stole my palm to give to their kids.
Everyone is entitled to their own opinion. It's just that yours is stupid.
It sounds like a small jet engine running and can overheat easily with the dinky little fan. How you hide that?!
A Sun IPX (or any lunchbox style) system with an AUI port and a modified transceiver is much better. I use one of these as a secure syslog; in particular because you can modify the transceiver so that while it is capable of receiving data, it is incapable of sending at a hardware level. There is no way, short of physical access, to detect the machine. It's great for packet sniffing and logging -- syslog using UDP is connectionless, and works well with read-only network connections. This is also better than modifying the ethernet cable, because these modified cables do not actually work properly (the transceiver with tx pins removed will keep a valid *empty* tx signal, whereas a modified cable usually just pumps the rx'd signal back to tx, confusing the equipment into maintaining a link).
And if you can sneak in once, why not twice? Or better, equip the computer with a cell modem or amateur radio equipment (How many "wartalkers" look for that, eh?) , and dial in. No need for probes which may set off IDS systems, or outgoing packets (like ARP or DNS requests) that alert crackers to a computer's presence.
I think you cut pins 3 and 10 (on the connector to the computer on the transceiver) but that's not certain.
http://www.research.att.com/~smb/papers/distfw.htm l
I'd like to see you hide an E10k in the ceiling.
The article states that this is a "disposable solution. Their intent is a drop and go process. This is less appealing with a thousand dollar laptop or other devices with aforementioned IP stack. More dreamcast mod info here
If we don't fight for ourselves no one will.
We used it to run a dump of all the packets on the network and get pretty much all the passwords used by anyone. We printed out a copy and sent it to the bozo they had in charge of IT, and he called in a mess of expensive consultants to reload everything on the network.
Of course, they didn't fix the basic problem or find our little friend. For all I know it's still running up above the 'ol drop ceiling -- we were to chicken to try and retrieve it. Of course, this was a private school, so the real joke was on us (the clue -- consultants were being paid for by our own stupid selves).
Every year during my review, I just pray the words "slashdot.org" aren't mentioned.
the irony that it is called a Dreamcast in this context?
I tried a while back to buy an ethernet adaptor. I was not successful. If anyone knows where to get an ethernet adaptor for Dreamcast, please post the info.
The point is it is toy-like. People may think a laptop can hack their systems, but a dreamcast? "That is a little game thing my son plays with."
:>
I laughed out loud when I read this.
"Never, never suspect the dreams within the dreams of dreaming children." ~The Amazon Quartet
...hacking a company with the Playstation 2 - it can scan 75 million ports a second, 20 million with effects.
When Dreamcasts Attack White hat hackers use game consoles, handheld PCs to crack networks from the inside out. By Kevin Poulsen, Jul 31 2002 5:26PM LAS VEGAS--Cyberpunks will be toting cheap game consoles on their utility belts this fall if they follow the lead of a pair of white hat hackers who demonstrated Wednesday how to turn the defunct Sega Dreamcast into a disposable attack box designed to be dropped like a bug on corporate networks during covert black bag jobs. The "phone home" technique presented by Aaron Higbee of Foundstone and Chris Davis from RedSiren Technologies at the Black Hat Briefings here takes advantage of the fact that firewalls effective in blocking entry into a private network, are generally permissive in allowing connections the other way around. Higbee and Davis perform penetration tests, and developed their game box cum attack tool after finding themselves more than once with physical access to a client's facilities -- posing as an employee in once case, crawling through a drop ceiling in another -- but without a way to leverage that access into remote control of the company's network. "It's not that hard to get into an organization for one or two minutes," said Higbee. They chose the Dreamcast for its small size, availability of an Ethernet adapter, and affordability -- the console was discontinued last year, and now sells used for under $100 on eBay. Loaded with custom Linux-based software and covertly plugged into a spare network port under a desk or above a ceiling, the harmless-looking toy becomes the enemy within, probing the company firewall for a way out to Internet. The box cycles through the ports used for common services like SSH, Web surfing, and e-mail, which tend to be permitted by firewall configurations. Failing that, it tries getting "ping" packets out to the Internet, and finally looks for proxy servers bridging the network to the outside world. Whatever it finds, it uses to establish a tunnel through the firewall to the intruder's home machine. "Most organizations focus on the perimeter," said Davis. "Once you get through the outside, there's a soft chewy center." The pair suggested some techniques for mitigating the risk of dropped-in hardware -- restricting the LAN to pre-assigned MAC addresses, for one -- but said that ultimately, there may be little an organization can do to prevent an attacker with physical access from setting up a covert channel home. The pair plan to release their Dreamcast software on their website next month, along with similar code they developed for the handheld Compaq iPAQ, and a bootable CD ROM designed to be slipped into print servers and other kiosk PCs. While useful, they note that the other platforms lack at least one of the Dreamcast's virtues. "It's innocuous. It looks like a toy," said Davis. "If you bring it into a company, they're going to go, 'Wow, look at the toy!'" What? You mean it isn't Slashdotted yet? How'm I supposta Karma-whore, now?!
Stuff that matters: circuitbreakers, vacuum-cleaners coffee makers, calculators generators, matching salt+pepper shakers
Inside security is a waste of time past the doors. If I can come in and drop a dreamcast into your company, then I can just as easily, dismantle your system and take out the hard drive. Or start smashing every PC in the server room. If someone is in your doors they can do anything they want.
Exactly. This could be serious FUD or just in general bad publicity for Linux as you could just as easily leave a Win2k box or iMac or something else that big corporations love in there to do the exact same thing. But no, they make the assertion that it is Linux and Linux can be very dangerous. If "slips" like this keep happening people really will be afraid of Linux and then it's all over for us.
From the article: Cyberpunks will be toting cheap game consoles on their utility belts this fall
Yeah, the Dreamcast is dirt cheap. The "broadband adapter" needed to hook it up to an ethernet network? Quite pricey.
I would think much in the same way, a Dreamcast running linux can be used to seriously injure a person, but sneaking up on them and hitting them over the head with it, repeatedly. Of course that's not newsworthy, unless it's a Dreamcast running linux.
sic transit gloria mundi
One of the biggest problems here is that so many companies are permissive with dhcp. If security is a real concern, you shouldn't be handing out IP addresses to unknown MACs like christmas candy. Having to figure out a safe/available IP address ahead of time at least makes this more difficult.
Says the RIAA: When you EQ, you're stealing bass!
As soon as I read this story, I jumped up and combed our office for sinister-looking dreamcasts creeping about the floor plugged into network ports.
Luckily, we were safe--THIS time. Those security-sapping plastic mosquitos could hide anywhere though, so maintain constant vigilance!
- - - - - - - -
Don't worry, being eaten by a crocodile is just like going to sleep in a giant blender.
Simple nerd cum spider shooting superhero
Well, if we apply GDB to this phrase, we "debug" it, getting rid of the "spider":
and magically, the sexual connotation is restored.
Higbee and Davis perform penetration tests, and developed their game box cum attack tool after finding themselves more than once with physical access to a client's facilities
... he said "cum"
Wait until someone sneaks a modified Dreamcast into the Slashdot server rack. Linux ... check. Penetration software ... check. Spell checker ... check. Jon Katz firewall ... check. Auto-goatsex ... check. And so on ...
Dreamcast 50-76 bucks, Broadband adapter = 120-175 bucks. Could you not do this with a 486 laptop ?
"Be glad you sailed for a better day, But dont forget there will be hell to pay" - Dave King/Flogging Molly
It's nothing new, just a practical demonstration of what every system admin involved with their network's security ought to already have in mind. The big guys (most of them, anyway) already deal with this. As a sometimes contractor to Deere and Co. (of the green tractor fame), I know that you can't get outside from their network on any port without going through (and authorizing with) a proxy. The same or similar is true at Caterpillar and a few others I've seen that you might know recognize. So, it's nothing new, but a good demonstration and reminder.
The literal translation of cum (rhymes with room no dumb) from Latin is just "with". For example, Summa Cum Laude literally means with the greatest of praise.
Near where I live there is this giant uber arcard called Playdium. Instead of using coins or tokens in the machines to get credits you swipe a little plastig card with a barcode on it through a reader. This reader in turn is hooked up to a solid-state machine running MSDOS which then contacts a MS SQL server to see if their is enough credit on the card and if there is it sends an authorization to the machine.
:)
One day we decided that we wanted to get free video games. After scoping the place out we discovered that all the 10baseT ports that the video games plugged into were in fact patched into a 3com 3300 switch and were active. The network designers I guess figured it would be easier to activate all the ports instead of making some video game tech figure out how to patch stuff in.
We brought in a laptop with a long cat5 cable and looked for a place to plug it in where we wouldn't be noticed. Jurassic Park 3 has this little thing you sit in a close the blinds so the ambient light would stay out. It would do nicely.
We watching what we could with different packet sniffers (we were also very paranoid of getting busted) and were able to bring up the Switches web management system. We discovered that the video games use DHCP to get an address in the 10.10.x.x subnet and the video games also seem to contact a master server for configuration information. ie. How much does this game cost. By this time we had been sitting in Jurassic Park 3 for 2 hours and were getting REALLY paranoid. So we decided to try something malicious. We arp-spoofed/flooded everything we could see. An interesting thing happened. When the game control units can no longer talk to their master server, they go into 'free' mode. I guess this is in case there is a network failure. They'd rather lose a bit of money than piss of 100s of people. While our little program ran, every game in the place became free. So I thought to myself, why not just unplug the Cat5 cable for a game to make it free. That doesn't seem to work. I think this is because it needs to detect a link before it will go to free mode. Anyhoo, I guess the moral of this story is to have some kind of port security on your network ports in your business. or something
"The dreamcast will then probe for ways to connect to the outside world."
Sega Dreamcast..."It's Thinking"
Sometimes I doubt your commitment to Sparkle Motion.
One problem with this, there are a finite number of broadband adapters and just leaving a DC with one in an office is blowing a good chunk of ebay money. I've played with my DC (even made the serial cable to progam in it and got the gcc-sh) and would love to get my hands on an adapater so I can't see anyone doing this in reality.
Linux: When reboots are for upgrades.
to just burn a CDR that boots Linux and does all the same stuff on a PC with any of the top X ethernet cards? Set it up to stubbornly ignore all keyboard input and never display anything on the screen. Write "coaster" on it with a black magic marker, drop it in some currently unused PC and hit power/reset and haul ass. Do it at 4:50 PM on a Friday and you'll probably have to 9:00 AM on monday to own some other box on a more permanent basis.
Hell, you might be able to modify a tomsrtbt to do this and wipe (or dd if=/dev/zero of=/dev/fd0; dd if=/dev/urandom of=/dev/fd0) the diskette once the ramdisk is loaded.
IOW, this whole thing strikes me as more of a "stunt" than a "hack."
-Peter
Not in this application, you can't use Win2k or iMac boxes. 1st of all, we are assuming you want $100 disposable machines. OK, I would like to know how you are going to customize a Win2k or iMac load to boot a Dreamcast system...Of course Linux will be used because you can port it to pretty much whatever you want. Not necessairly bad press, mr paranoid :)
The primary concern of a REAL system administrator has always been physical access. The greatest security threat is employees who want to circumvent or gain access to services you monitor or install. God forbit someone actually get in the building to tamper. Why put anything in a Dreamcast? Just carry around a Dreamcast/Xbox/whatever...That IS a GREAT gimmick to get into a building. Computer ppl tend to be eccentric (ty captain obvious!). My problem is that if you are going to risk getting into the building AND LEAVING HARDWARE because so many ppl are clueless, couldnt you just grab hardware when the techs are at lunch and escape (with the large number of plausible excuses for carrying around hardware during a crisis) in the ensuing chaos?
Often wrong but never in doubt.
I am Jack9.
Everyone knows me.
Most manufacturers, Linksys especially, include a utility to test it, and to reload all the bits of the MAC. I changed some of mine to random digits, never had a problem with that. Does anybody care?
It seems to me like this would be an excellent way of giving IP to idiots. Which is the business MS is in. When I first start up/install WinXP, how come they don't do the same thing for me? Everytime my dad gets a new computer for his office, he calls me and tells me to come in and configure it for him. Why aren't all devices self configuring like this?
There are no trails. There are no trees out here.
I wonder if you could stick on of these things in the video feed room in a Vegas casino? No one would notice it, right?
-everyone's watching MohoHAHA
...open the lid.
Schnapple
Just install windows products on their servers.
That will give you access to anything on their intranet, and cause them mayhem.
You can bet that I would at least grab the BBA out of it and sell it on ebay.... Those things are like GOLD.
it is called an email virus... you can get them on ebay for MUCH less than $100, and you don't have to buy a 'black bag' or 'crawl through a drop ceiling'
MARIJUANA, SHROOMS, X: ONLINE?! - E
I think you missed the point.
Slashdot lags behind other news sites who also collect and summarize interesting news.
There you go, Mr. Chokesondick.
A pair of coders are now suggesting that it is possible, with a modified ... system ... to sneek into an office building and stick it on a network drop .. then probe for ways to connect to the outside world.
You're kidding! Wow, how long did it take them to figure this out?
In other news... banks have now been found to be extremely insecure. All you have to do is break in, shoot all the guards, dynamite your way through the vault... and you have unlimited access to all their money!!
Unix is user friendly, it's just selective about who its friends are.
Why would you need the OS source code to do this?
I'm thinking this would be even easier to do under Windows - just write a little Trojan, copy it onto a floppy, and install it on any unsecured Windows box. No extra hardware needed!
As others have pointed out, it's not the fact that you can get a Dreamcast to do all this stuff that's the problem, it's the fact that you can physically get to the network.
If you mod the box into something black with LEDs, it might not look so out of place. Especially if you tape a while piece of paper with "67...2 Router:Smurphy" to the top (well not look out of place to the peons, anyway). Everyone will be afraid to touch it.
A dreamcast in an office building sticks out like a nun in a strip joint. Maybe if you hid the dreamcast in a suitcase or hid it under a bunch of papers in a filing cabinet, but not by itself.
Isn't it accepted that it rhymes with either room or dumb? I have no doubt that there are professors who try to push the former to disassociate it with it's triple X relative.
However, there is no literal translation of cum because of differences in the languages (i.e. I don't believe that you could say that it maps to a single English word), but rather the usage defines the definition. i.e. In combinations it means "together with", sort of a "acting as".
A pair of coders has suggested that you could sneak into a corporation, boot a machine into single-user, and totally screw it up.
They also suggested that you could dig a hole, fill it full of gold, then you'd be RICH!!!
It's the 'sneaking in' part that has me laughing. What company isn't self-aware enough to NOT notice a Dreamcast with an ethernet connection? ("Whose is this? Anyone know?")
It is much easier and cheaper if you leave a self installing CD on the receptionists desk labeled "private" which contains your trojan. (and a bunch of lame poems or such). Or, if the opportunity presents itself, you can just pop it in to any available CD drive and walk away.
AUTORUN.INF is underappreciated, and rarely disabled.
Remember, fingerprints can't be left on the hub and edge of a disk, so handle with care!
Anonymouse Cow Herd
Imagine a Beowolf Cluster of THESE!!!
Some friends and I were just discussing something similar to this at lunch.
There is a major college right near by that has a campus-wide wireless network that's completely open to anyone with a WiFi card. We were thinking about equipping a small PC with an 802.11b card and hiding it somewhere on campus to use as a server.
During the discussion I remembered this story on techweb last year about a network server that went missing for a few years after it was walled in.
So the ultimate idea is to find someplace with a WiFi network that's doing some remodeling and hide the box behind some drywall. With no wires to trace, the odds of someone finding it are very slim.
Are you saying coconuts migrate?
Hey, they could use TINIs.
Take a look at the Dallas Semiconductor TINI. It's a Java runtime environment on a 72-pin SIMM, complete with ethernet, serial, I2C, parallel IO, battery up to 1 meg of NVRAM, filesystem emulated in RAM, etc, etc. You can write web or ftp services for it in a few lines of Java, thanks to the supplied classes. You develop your Java code on your PC, compile it to Java bytecode, and then FTP it up to the little TINI device. My description is not doing this hardware justice, so I'll leave some links below.
Anyways, my point is this type of device is probably easier to program than a Linux Dreamcast. It may or may not be cheaper (sub-$100). And it's a lot easier to hide, if that's the goal. I've programmed a handful of hobby projects with this board, and it's really quite amazing for the price. (Compared to trying to implement an TCP/IP stack on a PIC microcontroller, say.)
TINI hardware
TINI
TINI board resource center
more resources
DalSemi discussions
1) press the eject button on the dreamcast
2) Connect to closest TV
3) Insert game of chose and a controller
4) play
So you'd be hacking your own company and keeping the dreamcast on your own desk? Remind me to never team up with you for any illegal schemes.
mark
If you want to make an apple pie from scratch, you must first create the universe. -- Carl Sagan
Finally a reason to pull my dreamcast from out of my closet! This sounds way cooler than any game I ever had for the thing.
The only problem I have is with the part about how if you brought it into a business they would think its just a game system. I would be immediately suspicious of anyone toting around a Dreamcast in this day and age. Maybe if they made this hack for a PS2, or better yet, for the XBox. Or the gamecube, Super Hack Brothers Melee...
It occurrs to me that a ThinkNIC would be an equally good platform for this.
It's cheap, departmental grey, looks like a piece of network componentry, uses GPL'd software (easy to change for your evil ways), and boots from a CD.
AC in and ethernet out...
"Draco dormiens nunquam titillandus."
level 2 pirate school teaches you to make modifications to your arrs, into darrs...
level 3 shows the pirater to change from darrs, to garrs....
garr, its pirating time, matey....
We're like rats, in some experiment! -- George Costanza
If your IT dept doens't have a policy of pretending the firewall isn't there when it comes to making network security decisions, you could have a problem in the future. It's a good policy to act as if a secure network isn't secure.
Little things like not activating ethernet jacks in empty cubes and insiting that IT know about all hubs in use in insecure locations (such as your desktop) can go a long way.
I would think you could do the same thing with a tini board. They are not that expensive, the top of the line tini is $69, and come with a tcp/ip stack and are much smaller than the dreamcast, the board itself is no larger than a simm memory card.
Tini home page
It wouldn't be the fastest thing in the world but with such a small size you could put it inside of something that should be there, like a network hub, print server, etc.
Software for it is written in Java and converted to run on the Tini, but I believe there is also a way to use machine code too.
Chris (krafter@zilla.net)
This type of threat is something that people have been aware of for some time. DHCP doesn't care who is acquiring a lease unless you assign them on a MAC address basis. This itself is somewhat self defeating because its administratively prohibitive.
This was a challenge with the advent of 802.11 technolgoies until 802.1X Port based authentication came along. Users now have to authenticate just to obtain access at layer 2. This can be done via various forms of Extensible Authentication Protocols (EAP) such as EAP-MD5, EAP-TLS (Micorosft Certificate Based), Protected EAP, or LEAP (Cisco). 802.1X is an IEEE Standard, where EAP is an IETF derived standard.
Future network switches will require 802.1X authentication for wired connections just like our 802.11 wireless customers. No authentication, no access to the network! Servers or non-802.1X capable clients would require the individual switch ports to be configured with MAC Address filters to maintain security. A client successfully authentications via Layer 2 802.1X, then they acquire a Layer 3 IP address via DHCP.
I expect this to be confronting us very soon.
SoyBomb
http://www.the-space.net
It strikes me that people have generally ignored a very valuable tool of hacking: social engineering. Kevin Mitnick proved its prowess, and we've all heard of him, no? A DC is technically feasible, but falls short on the social engineering front.
n dex.html
So, I propose that instead of using a relatively conspicuous DC, or even a laptop, you buy a TINI computer:
http://www.ibutton.com/TINI/hardware/i
And then modify it into an old Cisco plastic shell. Write something like, "Cisco Network Load Balancer" or something (in a believable fashion), slap it in as close to the server room as you can.
The issue here is not "can I crack people's networks from the inside?" but, rather, "can I _keep_ cracking the network for more than a couple weeks?" You think to look at a laptop or DC for a network spy, but who bothers to look at some random piece of Cisco hardware in a corner? I'd say the risk of discovery becomes far lower - and with TINI, you could theoretically put together a "button" that would wipe the contents of the device if it was moved.
Just an idea.
-Erwos
Plausible conjecture should not be misrepresented as proof positive.
There is really very few ways to prevent such an attack. (I've been thinking about this for some time). Even if you had MAC-Address filtering, a drop machine could be configured to learn MAC addresses, and take over the MAC and IP when that MAC is no longer present on the network (is shutdown).
The best way I could think of locating suspicious activity, is to setup a machine in the same range as the important servers... And investigate any connections to it (as no one should be connecting to it). This only stops the more active attacks though.
To sniff data off the wire, you only need to be getting an electrical signal. You don't need a MAC or IP address. To prevent this kind of sniffing, you would really have to go around and verify that the each active port (on the hub/switch) corresponds to a machine that should be up and running.
However, in a microsegmented network, where each network interface coresponds to a port on a switch, listening to the traffic on one port will not yeild much. So the sniffer would have to flood the switch with MAC addresses, or forged ARP replies. That kind of thing could be picked up if you monitor your switches.
So the point? Use switches directly to the computers anywhere remotly important... And protect your uplinks (links from switch to switch, switch to router, router to router) so that no-one can tap into them.
Of course, all this requires an incredibly great deal of manpower, and administrative vigilance. The real solution is to use IPv6 (or IPv4 with IPSec) since it encrypts all traffic.
Slashdot gets worse every day... Pipedot: News for nerds, without the corporate slant
If you hid the wire and just had it sitting there or under a desk most people wouldn't think twice about it. Heck even with the wire mose people wouldn't think twice.
Why not just drop in a WAP, and then connect in from your laptop outside the building. Some Wireless access points can even run linux
...but around *mine*, a Dreamcast would be noticed REAL quick! :-)
---
Information wants...you to shut your pie hole.
The idea grew out of the linux dreamcast distro and is currently being ported to several other platforms (pc, iPaq, etc.)
--bababooey
Good spelling and grammar should be a mandatory requirement for all posts to any website. I can't believe Hemos didn't catch that. No, wait, yes I can.
Mine is a door stop.
In mathematics, one does not understand things, one merely gets used to them.
--VonNeumann
I would kill to have the Broadband Adapter so I, myself, could continue my Dreamcast development. I no longer find it fun to wait for about an hour for the serial slave to upload code AND emulate a CD-ROM drive. And when I do not have time, I'm forced to go to the store and spend money on CD-Rs that would probably be turned into coasters throughout the development cycle.
Sure, the Dreamcasts are perhaps disposable, but the Broadband Adapters available certainly ARE NOT. There are people who have far better uses for them than to see them trickle away. Buy a uCsimm kit. They are much too small to even be noticed, and fit nicely above a ceiling tile. If one so desires, it could probably also be placed in a child's toy.
-
And the Angel said unto me, "These are the cries of the carrots! The cries of the carrots!"
I've seen a lot of comments about "sneaking in" and that the DreamCast would stick out. The fact is it's far to easy to get access to a company's network. I don't remember where I saw it but a couple years ago I remember reading a great article about this very subject.
The article reported that the easiest way to break into a company's network was from the inside (obviously). But the way to do it was to dress/act like a technician. They were rarely challenged and were able to place devices on the network in inconspicuous locations. How many people check the wiring in the ceilings? How often do you or the Sys Admin's do that?
I've personally seen this a number of times at various companies I've worked at. Someone wondering around with a ladder and looking like a technician and everyone ignored him. Luckily he was a technician but he could have just as easily been an evil network sucking infiltrator. The fact is if you look like you belong, most people won't question your existence.
So to sum up; put on a technician's outfit (complete with little logo thingy on the overalls), tell the receptionist your there to fix something, place DreamCast in ceiling or under counter or someplace discreet, receive packet dumps. Easy, huh?
Steven
Carpe Tunnel
"There is no spoon." - Neo
"Spoooon!" - The Tick
Almost trivial with Windows 2000 and Global Policy Templates.
Very doable with the IPSec and LDAP upgrades in Solaris 9.
Key management is still a Royal PITA on other platforms.
"Flyin' in just a sweet place,
Never been known to fail..."
I see two major drawbacks to the use of a "Dreamcast" in this role-
I do not deploy Linux. Ever.
... just search for your address book in Outlook and send all the p0rn you forgot to delete on your laptop to your boss and all your coworkers.
Live web cams
you know you're all terrorists for even discussing how to do this, right?
The only thing that would be more incriminating would be to bow to Mecca in front of an FBI agent.
Don't waste your Dreamcast! If you have physical access to the building, desks, etc, then why not just jam in a bootable floppy and reboot an unattended machine to:
1) port and service scan
2) send out results via http/ftp/ping/email/etc
3) wipe the floppy clean
4) write an innoculous text or word document on the floppy
4) reboot the workstation again
This leaves nearly zero physical evidence that there was an intrusion. Just an abandoned floppy and a rebooted machine.
Sure, you _might_ get past building security with a video game console in your bag. But I guarantee you'll get in with a floppy. And would you rather be caught plugging a floppy into a workstation or a video game console into the network?
And you'll still have your Dreamcast at home, running DCMAME!
He is clearly making fun of modding devices for obscure purposes. sigless
"Overhead, without any fuss, the stars were going out."
"Lawyers are for sucks."
- Doug McKenzie
This was pretty much just to see if we could, which as I think about it seems like the reasoning behind most of what I did in high school. Well, at least the things I did in high school that didn't involve girls.
Admit it. Most of what you did with girls was just to see if you could, too.
Nope, no sig
"are networks neet to be secure"
GRAMMAR PEOPLE! Sheesh.
sneek ? You mean sneak.
Editors should EDIT.
Slipping a dreamcast into your briefcase is less suspicious than hauling around an Imac.
"Don't mind me, I'm just carrying around this Imac!"
would be to take any one of the many fine open-source custom dreamcast games and tools and patch it to use this intrusion tool; when someone loads up the vcd player, or the snes emulator, or tries to play quake online (i forget if it includes network support but any other game requiring broadband will do), they'll actually be helping it do its job. Of course, this assumes they plug in the broadband adapter.
Side note: i'm thinking of porting a linux distribution to dreamcast, and Gentoo looks to be the easiest (installer can be easily modified to compile its bootstrapper for sh4 architecture). Anyone think a specific distro could go to dreamcast easily? Is anyone else working on this?
The grammatical mistakes make this article painful to read. Perhaps the submitter tried so very hard to be the first to post this and didn't bother reading what he wrote? Maybe so. In such a case, isn't it lucky we have Editors to clean it up! Phew!
Oh.
onto which one could load a reasonable number of probing tools to do this sort of thing?
I'm guessing something from the uClinux project, although that would probably stand out like a sore thumb compared to an old laptop.
iMac is a computer. Dreamcast is a computer. Win2k is an operating system. Linux is an operating system. Mac OS X is an operating system. Hope I've cleared that up for you.
I've often thought of doing this myself where I get paid to work, not so much to sniff passwords but to have a little back door should I decide to leave. It'd be trivial to stash a laptop or other device in a little-used ceiling space and run a drop directly to a patch panel.
More challenging would be setting up a way to get the machine to periodically reconfigure itself to get out of the office network and establish a tunnel to the outside that could be used to get back inside.
The way that occurs to me is to have it load a public web page periodically and parse out the destination IP and then have the "automaton" search for ways out of the network to a destination host set to listen for tunnel attempts from the automaton.
I'd imagine you'd have to come up with really clever ways to get out of heavily firewalled/proxied business networks, some really don't allow any random end nodes to get unfiltered/proxied packets out of the network. Best way would be to tap into a fax line and have the machine periodically dial out, leaving a more clever human to fix any dedicated network tunnel.
I'm not sure what I'd *do* with a host if I had one, though.
If you're going to go this far (taking a DC into {company} with the intention of getting access to their network). Why not go to the next step:
Strip the guts out of the DC, hollow out a large reference book (one appropriate for the business), make discreet entries into the 'book' for the cables (a book with cables running into it would be suspicious, figure out a nice way to do this), then put the DC guts in the book.
"... the advance of civilization is nothing but an exercise in the limiting of privacy" - Janov Pelorat
who else already has something much better in a nice small, concealable package
:)
Don't know about you, but this sure does sound funny to me.
http://dtum.livejournal.com
A dreamcast wouldn't be so suspicious in the corporate Sega headquarters now would it?(*evil snicker*)
"If you bring it into a company, they're going to go, 'Wow, look at the toy!'" ...And then what?? stick their thumbs back in their
noses? This seems to be exactly why a dreamcast would be the worst thing for this. Somebody would go on ebay buy some controls and the next day the company stock would go down because they'd be having competitions in the lounge after they got it to play games or they'd get pissed that it was too hacked to play games and they'd chuck it.
It would seem the best thing would be a box disguised to look like a hub or a switch, nobody is going to yank that out, and if someone patches their system into it, the fake hub could be designed to crack into that system as well.
ôó
Well, there's the extra humiliation factor... Imagine a bunch of IT boys from different corps going out for a beer:
BOFH1: Yeah, I got 0wn3d today by a massive distributed DOS attack from thousands of zombie machines across the 'net.
BOFH2: Ha! That's nothing. I got r00t3D when someone compromised the latest openSSH source. That woz pretty elite.
BOFH3: (mumble mumble)
BOFH2: What was that?
BOFH3: [sobbing] An iPAQ! I got H4x0r3D by a fucking iPAQ, okay? Are you happy now?
BOFH1: What a l00zer.
BOFH2: Good grief.
You are incorrect about the "water cooling" of the Dreamcast. My Dreamcast (purchased May 2001) has a small and noisy fan in the right-front corner. It's air-cooled. I'd like to see pics of any water-cooled DCs :o)
There's a big aluminum plate sandwiched between the GD reader/PSU and the mainboard which acts as a heatsink for the PowerVR2 and SH4 living beneath.
I do agree that the GD reader mech is noisy all by itself, but most of the ambient noise comes from that small fan.
--
Me spell chucker work grate. Need grandma chicken.
Check out the SPINACH project at Stanford: http://mosquitonet.stanford.edu/publications/spina ch.html
It's designed to precisely address this issue by limiting network access from hosts whose Hardware Ethernet addresses are unknown to the local subnet only (not past the router) until it is authenticated (by some password or other scheme). Thus, if you put a Dreamcast on a SPINACH network, it could only reach hosts on the immediate subnet, unless you spoofed the MAC address or something...
There's 10 types of people in this world, those who understand binary and those who don't.
dang voice recognition software I'm shore.
1-800-97-Legal. Its the number for Jacoby & Meyers because your going to need them after your arrested for "leaving a little back door".
For anyone else thinking about doing this, don't be stupid and please use a little common sense. If you do something like this and get caught you will not only pay a huge fine like $10-25k minimum, but could easily end up in jail.
If you wanna get rich, you know that payback is a bitch
This demonstrates one of the biggest problems with firewalls in practice. It allows a network administrator, and all the users on the network, to have a false sense of security about how vulnerable their network is to the outside world. As the article stated, once you get through the rough outer coating (the firewall), you pretty much have the run of the place.
The firewall should be used for two primary reasons. First, because you don't trust the internet. This makes perfect sense to almost everyone. The second reason, is because you don't trust your users. After all, if you trusted all your users to keep the machines secure, the firewall probably wouldn't be necessary. Therefore, its in your best interest to not allow carte blanche access to the internet from the inside, just as you don't allow open access from the outside.
Of course, at the same time it needs to be secure, it also needs to be convienent. If someone has to jump through hoops to find a webpage or read an email, the entire purpose of having those services available is lost. At some point you need to trust your users, even if they can't be trusted. So minimise the damage a single user can do.
If a user gets a virus, how far can that virus reach? Can it infect the entire network, or will it be isolated to the local machine, or to a specific account. What happens if a password sniffer is installed somewhere on the network. Will it be able to obtain any useful information? Are the machines tripwired to detect any modification of key utilities? Are there live network connections that are unused? Do you use static or DHCP addresses? Some of these features might make life easier for the sysadmin, but they also make it easier for a trespasser.
Of course, many of these problems are addressed only with hindsight. If someone wants to get onto your network badly enough, they will probably find a way. The important thing is that if and when it happens, you can detect it immediately, minimize the damage they can possibly cause, and immediately fix the problem that allowed them in in the first place
-Restil
Play with my webcams and lights here
Sure a dreamcast is cheap if you can find it..But do you honestly think you can find a dreamcast Broadband adapter cheap? ($100-200 on Ebay).
If you already have this u are ok... But if you are going to try it GOOD LUCK.
get real
-=P=-
I see a Dreamcast or an iPaq just sitting around at the office I'm taking that baby home!
Woot! Fa fa fa hackers try again!
Not only this, but two recommended practices (and EVEYONE does this, right? ;-) would stop it from doing anything:
1 - don't light up unused ports
2 - use switches instead of hubs and there'll be nothing to sniff...
Mark
But if you've got a budget for the job, use a palmtop. A Windows CE machine would fit into a tight space, and you'd never notice it.
Oh yeah, and if it HAS to be Linux, some palmtops will run it, too.
Well, they have things smaller that can do much of the same.
Check out the uCsimm. Onboard ethernet, serial, etc. All you need is a 3.3v power supply and you are good to go!
Only limitation is 8MB of RAM and a Dragonball proc, but...
Just configure the network switches to accept only certain MAC addresses on certain ports and that should end the problem of people putting "rogue devices" on your network.
However, for companies who do not do this already it will be a substantial investment in time to set up something like this.
Any other thoughts?
"A plan fiendishly clever in its intricacies"- Homer Simpson
It's been said that:
With a clipboard, a dress shirt and the right attitude you can get anywhere.
From everything I've seen, I believe it.
Security just isn't taken seriously by most people.
Life is too short to proofread.
Except to say that we should secure the physical access points to our networks. Of course if you allow strangers to plug into your network they are going to be able to find a way to talk to the outside world.
Most TCP/IP networks nowadays runs DHCP so just plugging in will usually get you a valid IP and from there you can pretty much guess the gateway or sniff it out. The important thing is not to allow unauthorized people to plug-in in the first place.
Most compromises are not high tech. Most compromises are a result of either a disgruntled employee or an employee that foolishly gives out password information.
Maybe the hacker calls a company's I.S. shop and says that he's from Cisco. The router is having problems and he needs the logon password to fix it. Or maybe a hacker just walks in to a large building with a laptop, RJ45 cord and big balls. He plugs in and starts sniffing.
We have a Group of people in Washington State Government that goes around and tests security. One guy told me that once he walked into a Department building, plugged in and was sniffing usernames and passwords. Someone asked him who he was so he gave them some bogus story and they asked if he wanted coffee! So he sat there eating their donuts, drinking their coffee and breaching their security!!
The race isn't always to the swift... but that's the way to bet!
Yeah, but I haven't done that yet beacuse I'm still waiting for someone to get linux running on the xbox. It's much bigger and heavier.
In the meantime I'll keep bludgeoning people with my C64. It's got a pretty good reach and I hear it can be turn into a webserver.
Life is too short to proofread.
I believe that these guys will be presenting at DefCon
... compared to losing a laptop or a wireless access point, it's a cheaper solution.
As to comments regarding putting a laptop on an internal network, think about it. How much cheaper is a DreamCast than a laptop? If it's discovered, you might be out $50
Nifty hack, I'm looking forward to seeing their presentation this weekend.
It isn't true. See Intrusion Detection FAQ
--
Ilya Martynov (http://martynov.org/)
I can remember designing a 68000 based computer with ethernet chipset from scratch at University; as I had complete control over the chipset; I could make this thing look like any PC that was already attached to their network, MAC address and all. With the full flexibility of the hardware at your control, defeating most in-house security measures is a no brainer. As for current candidates for this kind of attack, I would say that you would go a long way to beat using intrinsycs, Cerfcubeyou must be able to hide that in a wall cavity.
Ok If I was a hacker and wanted to get into xWZ Inc.
The dreamcast would be a bit of a streth. But it does demonstrate a very good point. If a dreamcast, seemingly inocent device, can get past the firewall then so can just about anything.
Although, the argument of dropping a WAP next to a window is much more persussive.
Only real solution is setting up DHCP to only give ip addresses to the MAC Addr. that are defined. Or employee some other technique to filter out unknown MAC addresses.
Of course we all know that MAC addresses can easily be spoofed.
If I was xWZ hacker, I would try to slip a backdoor on someone's PC, who might have walked away from there desk. Then I would sit and wait for my unsuspecting friend to establish a connection.
Of course I am not a hacker. But, I do know far to many IT managers never listen to us low life IT techs. They seem to think if they throw enough time and money at FW-1 that everything will be secure..
The DC is very small, very easy to hide. You can put it in anything. For example. Find a cheap UPS. They are out there. I've seen some of the new ones for 24.95. Stick ANYTHING inside those things. They are HUGE once you take out the batteries and wire it direct to just be a surge protector. More to the point, you can hide almost any device inside one of those things. its HUGE. And noone would really suspect it.
Since these guys are already doing bootable CDs, they could do one for a generic PC. Have it put up a VGA Blue Screen of Death mock-up as early as possible and then target machines that look out-of-the-way and/or unused, especially older looking machines.
Lots of places that I've been have these sorts of boxes sitting around because they become unused gradually. I've seen machines like this display BSoD for weeks on end before anyone bothered to either reboot them or turn them off.
With this approach, the total leave-behind hardware investment is $0.25 for the CD-R.
I ust picked up a Rio MP3 Reciever. It has a built-in ethernet jack and a nice dial and buttons so you can scroll through your latest exploits to perform on compromised networks.
I dunno about you, but I tend to walk around work with my eyes taking in the full scope of walls. An ethernet cable snaking up and into the ceiling, anywhere, will catch my attention.
Then again, maybe I'm just a little bit paranoid since at my employer's last building we had cables running up and down walls all over the damn place - not much choice when people are packed in like sardines and there aren't enough close-by ports to meet people's needs.
Now that we're 4 months into a new building, with enough ports to go around (and the financial wherewithal to have more drops installed when we've needed them), I have to keep an eye on the little monsters who are used to the idea of stringing cables -- that way they don't have to plan beyond today.
Moof!
If they used a Dreamcast to crack Sony's corporate office network?
Or at least to introduce new "leg lifting" behavior models to their Aibo software...
Just because you can mod me down, doesn't mean you're right. Shoes for industry!
DNS is one of the things that almost all firewalls either let through or proxy. You can tunnel anything you want over DNS messages. If they are logging stuff correctly it would look pretty suspicious but they might not notice it.
These days? Yes...
Sure, on-site network security is a problem too.
But sniffing with a Dreamcast? Ethernet adapters for the dreamcast so rare as to sell second-hand for double their original list price or more... That would total to $250+ including an ebay-purchased DC, for a system with extremely limited local storage that wouldn't do anything more than an old 486 or early pentium system I could buy at a garage sale for $30 could. And well-hidden network and power connections mean that you'd pretty much have to put it in a ceiling or wiring closet anyway; I can't see how the somewhat smaller size would matter much.
Well, I know I'm in the minority here, but as an employee of Lawrence Livermore National Laboratory, whose security rules come from the U.S. Department of Energy I can say that all of our janitors have a background check.
>Sure you could plug a laptop in, but who wants to drop $300-400 for a cheap laptop that will probably get confiscated. For the same price you could by 4-5 Dreamcasts.
If you can get me 4 dreamcast ethernet adapters for US$300 (even without dreamcasts to go with them), I'll buy them off of you right now. Dreamcast BBA's are selling on ebay for $100-$150. You can barely buy two dreamcasts with ethernet adapters for $300, let alone four.
Why would you be spending $300+ anyway? An obsolete yard sale notebook should do the trick, and I can't see one setting you back more than $150.
Many locations use static configurations loaded from a remote server. If the company really likes security, each system would have a burnt CD for booting + a remote share for home directory data. Or a mainframe style setup with thin clients.
A small, low power, low noise, inexpensive box that can be placed somewhere in a building that will find its own way is very much a sophisticated solution, much more so that a trojan attack.
--
Internet Explorer (n): Another bug -- that is, a feature that can't be turned off -- in Windows.
My supervisor tried to plug in his brother's PC into the net, it shut down his access port. Then he plugged it into my hub, shut down mine too. Had to call one of the LAN guys to reset all ports in my office. I'm not sure if they filter by allowed companies and all NICs have to be Intels or whatever, or they have a complete table of allowed MAC addresses, but either way this wouldn't work on my network.
"Just a reminder that are networks need to be as secure on the inside as they should be on the outside."
"ARE networks?"?!?! Jeebus. Just because someone submitted it that way doesn't mean you need to post it like that. Fix the shit, for God's sake! Make it look like you have at least a 6th-grade education!
Linux is so bad it's free and most people don't use it. But you have the source code, so it's your fault.
This is just a reminder that we can never be secured in any part of our lives by technology. The only path back to a secure society is the path that leads back to teaching people that noone is responsible for their actions but themselves and that intentionally irresponsible actions will be punished according to the effect of the action even when the effect goes way beyond the original intentions.
Could you please post a link or give some info? I could use several 486 Laptops.
Only in slashdot are posts of solidarity modded at -1 Redundant, while posts of antagonism are modded as -1 Flamebait.
The University of North Carolina has finally found a network server that, although missing for four years, hasn't missed a packet in all that time. Try as they might, university administrators couldn't find the server. Working with Novell Inc. (stock: NOVL), IT workers tracked it down by meticulously following cable until they literally ran into a wall. The server had been mistakenly sealed behind drywall by maintenance workers.
Mayhem (www.linuxathome.net)
When you get down to it, most crackers would be ashamed to have to WALK someplace. Surely you could just mail some Outlook crack and have access that way? Once you own one machine, you can own them all, and I suspect most corporate machines are indeed owned this way. Think M$ will ever get a clue? I don't.
Then again, by the XP license M$ has a root kit all their own. IEEEE! My desktop is not MY desktop! Nor is it my company's desktop. It belongs to M$.
Friends don't help friends install M$ junk.
Paint the DC flat black, print up a fancy label like "CyberIntelliScan 2000X". Use chalk and scribble "DEMO UNIT".
For the finishing touch, tape a handwritten note saying:
"Network Optimization Scan- please don not touch- Joe", using the name of the director of the IT department.
With luck, any hapless admin who sees it will think it's just another fart-in-the-wind product the PHB is testing out for his brother's company, and not pay any attention to it.
-- If god wanted me to have a sig, he'd have given me a sense of humor.
The place is called Comprenew. They are located just North of Grand Rapids, Michigan. On their website, they don't have the really low-end (cheap) stuff. If you go to the PCTC link on their site, it will give you an idea, however. The place itself is just a warehouse full of equipment that companies wanted to get rid of. There's some very unique stuff there. It's fun just to look around and see some of the obscure items they have. The cheap laptops aren't listed on the website because they only get one of each item usually, but if you talk to the people there, they might be willing to ship you one; N.B. everything there is strictly as is, although if you go there you can try anything out.
-- Never hit a man with glasses. Hit him with a baseball bat.
Cripes. Doesn't every sysadmin monitor their network for new ethernet devices? I mean, all it takes is: /usr/bin/nmap -sP 192.168.0.0/24; /usr/sbin/arp
#
Save it to a file, and check frequently for changes.
I'm a bit stunned that something like this isn't ubiquitous.
Brings a whole new meaning to "not supported", ;-)
Alex
Are you sure this would really be chaper?
The reason its important that its a dreamcast, and not a laptop or whatever. Is simply that it is a dreamcast, and childs toy, not made so it could do anything like this.
Its kinda like someone 'modding' a pc case into a moter bike. The thing what would be amazing about it would not be that you can use it too ride, but instead that he is riding a pc case.
Just proves that you need to maintain vigilance on your network. I maintain a network for a Transit Authority and use several tools that actually look for new devices on the network, duplicate IP and MAC addresses and so forth. If it trully probes for a way out to "phone home" so to speak, I got him. Now passive listening -- different story.
> Are you sure this would really be chaper?
:)
Well, given the posts about ethernet adapters for the dreamcast costing $150, probably. Regardless, the cost will be pretty similar.
EPIA 5000 board, with processor (runs fanless) $99
64MB RAM $11
16MB CF card (for boot media) $15
145W Power Supply $25
Total: $150
You can use a cardboard box and duct tape for the case.
The EPIA system also has the advantages of being standard hardware.