Slashdot Mirror
Attack Of The Dreamcasts
kevin_conaway writes "A pair of coders are now suggesting that it is possible, with a modified dreamcast system running Linux to sneek into an office building and stick it on a network drop and leave. The dreamcast will then probe for ways to connect to the outside world. They say they have created similar software for iPAQs and a special bootable cdroms for print servers and similar boxes. Just a reminder that are networks need to be as secure on the inside as they should be on the outside. Get the story here."
from sneaking in and connecting a laptop to the network? I mean, wouldn't a Dreamcast plugged into the company network be a bit more suspicious than a computer?
#include <sig.h>
They should replace "dreamcast" with "any machine with an IP stack". Physical security on a network is important in any case, whether it be small like a dreamcast or big like an e10k ;)
But couldn't any computer capable of running Linux and sending/receiving network traffic be able to do this as well? I'd be suspicious of a Dreamcast box sitting in a cube connected to the network. I'm guessing that the only real reason they're focusing on Dreamcasts and not normal PC's are that they're very cheap to obtain and reconfigure.
"but said that ultimately, there may be little an organization can do to prevent an attacker with physical access from setting up a covert channel home. " But if you can get physical access, why not just use one of the computers so thoughtfully preinstalled by the network administrator? Heck, they were probably even left logged in overnight by the lusers. This doesn't seem all that revolutionary..."If I can get into your building, I can do bad stuff". No? Really? Wow...noone's had that idea since...ummm...the invention of the house.
Almost all companies I have visited have had the opposite 'problem'. To get an Internet connection up n' running, you need to phone a sysadmin to patch the ethernet socket to the switch (most often, the spares aren't connected at all) and then give them a MAC address so the dhcp will give the box a legitimate IP address in the correct space. (Also, Dreamcast?? Suspicious, no?!)
- FF
while true;do echo -e -n "\033[s\n\033[u\134_\033[B";done
so much of today's lax security is due to legacy design, not inherent difficulty. this is worth remembering.
To only have connectivity on actively used network drops, and keep all switches in secure closets? To plug in an unknown machine in our office you would have to unplug a known one, and someone's gonna at least notice their computer stopped working. Wouldn't take long after that to discover the switch had taken place. That could easily be circumvented with a machine acting like a silent proxy, but still makes it a tad more difficult. Don't other companies practice similar procedures?
With that in mind, when was the last time you walked into your company in non-work clothes, you knew where you were going, and walked confidently there and no one stopped and questioned you? I wear a name tag and go there every day, but in my shorts and tshirt with no name tag, I'm never stopped. I think thats the way it is in many places.
Sure you could plug a laptop in, but who wants to drop $300-400 for a cheap laptop that will probably get confiscated. For the same price you could by 4-5 Dreamcasts. You could scatter them around to a few drops as backup. In addition, the footprint of the box is small, and you don't need a standard PC case. Who wants to buy a BookPC or a Cappucino (sp) only to lose it.
Other way to look at this would be for a handy ligitimate network tool. It would be nice to plug a machine into a network, have it snoop around, and then come back the next day and get a report on bottlenecks, machine usage, etc.
--
"That's Homer Simpson sir. One of your drones from sector 7G"
Why not just stick a wireless access point on the network. Put it on the floor near a window or something, and you should be in business... This would even work on the most secure networks.
I want my rights back. I was actually using them when our government stole them after 9/11.
The point is it is toy-like. People may think a laptop can hack their systems, but a dreamcast? "That is a little game thing my son plays with."
:>
I laughed out loud when I read this.
"Never, never suspect the dreams within the dreams of dreaming children." ~The Amazon Quartet
You can bet that I would at least grab the BBA out of it and sell it on ebay.... Those things are like GOLD.
This type of threat is something that people have been aware of for some time. DHCP doesn't care who is acquiring a lease unless you assign them on a MAC address basis. This itself is somewhat self defeating because its administratively prohibitive.
This was a challenge with the advent of 802.11 technolgoies until 802.1X Port based authentication came along. Users now have to authenticate just to obtain access at layer 2. This can be done via various forms of Extensible Authentication Protocols (EAP) such as EAP-MD5, EAP-TLS (Micorosft Certificate Based), Protected EAP, or LEAP (Cisco). 802.1X is an IEEE Standard, where EAP is an IETF derived standard.
Future network switches will require 802.1X authentication for wired connections just like our 802.11 wireless customers. No authentication, no access to the network! Servers or non-802.1X capable clients would require the individual switch ports to be configured with MAC Address filters to maintain security. A client successfully authentications via Layer 2 802.1X, then they acquire a Layer 3 IP address via DHCP.
I expect this to be confronting us very soon.
SoyBomb
http://www.the-space.net
"Draco dormiens nunquam titillandus."
How regularly? The few admins I know are ran frazzled by lack of help dealing with normal, simple user complaints.
Of course, he'd notice a dreamcast sitting somewhere in the open, but under a desk, plugged into a network mini-hub? Hell, in the unlocked server closet, which also shares room with housekeeping stuff.
It's easy to say "any admin worth their salt" would do such-and-such, but sometimes that just isn't the case, not because they don't want to, but rather because they don't have the time.
When you get in at 6 in the morning and leave at 9 at night every night, are you really in the mood for staying an hour later and looking at the logs? Should he? Probably, but admins are human, and the man I'm thinking of isn't getting paid hourly.
Of course, he is my boss, and I just feel bad because I probably didn't work as hard as I should've. Maybe I should stop putting him down as a reference in my job search. Heh.
Dan
You cannot open promiscuous sockets from Java, thus making a TINI a poor choice for a portable packet sniffer. It looks like you could open connections outward from a TINI, circumventing many security systems. I have no clue whether or not ARP based sniffing requires a promiscuous ethernet adapter or not.
Since these guys are already doing bootable CDs, they could do one for a generic PC. Have it put up a VGA Blue Screen of Death mock-up as early as possible and then target machines that look out-of-the-way and/or unused, especially older looking machines.
Lots of places that I've been have these sorts of boxes sitting around because they become unused gradually. I've seen machines like this display BSoD for weeks on end before anyone bothered to either reboot them or turn them off.
With this approach, the total leave-behind hardware investment is $0.25 for the CD-R.