Slashdot Mirror
The DARPA-Funded Power Strip That Will Hack Your Network
An anonymous reader writes "The Power Pwn may look like a power strip, but it's actually a DARPA-funded hacking tool for launching remotely-activated Wi-Fi, Bluetooth, and Ethernet attacks. If you see one around the office, make a point to ask if it's supposed to be there. Pwnie Express, which developed the $1,295 tool, says it's 'a fully-integrated enterprise-class penetration testing platform.' That's great, but the company also notes its 'ingenious form-factor' (again, look at the above picture) and 'highly-integrated/modular hardware design,' which to me makes it look like the perfect gizmo for nefarious purposes."
Omg Pwnies!
it's actually a DARPA-funded hacking tool for launching remotely-activated Wi-Fi, Bluetooth, and Ethernet attacks.
Might be somewhat impressive, but it can't get first post!
Does it come preloaded with assault riffles and explosives?
Make it as a dildo, and I'll be really worried at the work.
(They're screwing us big time int last months...)
Lisias@Earth.SolarSystem.OrionArm.MilkyWay.Local.Virgo.Universe.org
...for the appearance of this device.
Part of a penetration test should be, and I don't think I need to remind those who are active in the cybersecurity industry of this(!), creating hacking devices that look as if they're part of the furniture - like they're supposed to be there.
Discuss.
Operation Guillotine is in effect.
And how much more of my tax dollars went to developing it? I mean, I could buy a bigassed power strip like this and slap a RasPi and a 3g modem into it, and wire up the "surge protector" ports for USB and ethernet and do the same thing...for like $200...
You couldn't possibly mistake it for a real power strip, like these.
This thing should be relatively easy to find even in "stealth mode." Grab an RF meter and go to town.
Hopefully this strip is not made in China
I'm crossing my fingers
Muchas Gracias, Señor Edward Snowden !
I predict these will start showing up in corporate parking lots. "Ooh! Look, someone dropped a power strip! I've been telling my boss I need more outlets in my cubicle since he won't let me charge my phone by plugging it into the computer anymore... this will do nicely! And is that a USB stick on the ground? Oh, almost got me there. I know better than to plug that in."
So future hacking devices should look like a wastebasket?
A mere $40 for a GSM audio bug disguised as a power strip: http://dx.com/p/quadband-world-gsm-spy-bug-audio-transmitter-disguised-as-working-ac-power-bar-22097
It has been around for a while, so this pwn thing just sort of builds on it.
They also have one disguised as a working USB mouse: http://dx.com/wireless-triband-gsm-spy-phone-surveillance-device-as-working-usb-mouse-850-900-1800mhz-39164
and various more of the same. This shit is evil.
Hasn't the pwnie express wall wart version been around for well over a year now? I guess the news is that it now comes in a power strip too?
The opposition (who ever they may be) has figured out that we were using this device. Word has gotten out. We no longer need it. You may now do with it as you wish...
Only in the USA, because large parts of the world use other outlets and voltages....
I was promised a flying car. Where is my flying car?
Dude, I just picked one of these up at Wal Mart.
Seems like this could be great for ad-hoc wifi. Hide enough tiny routers in power strips (or even light fixtures, etc) and you can spread your signal without anyone noticing.
There's no -1 for "I don't get it."
It should be a dismissable offence it bring this thing any where near where you work. You probably couldn't even trust it if it were still boxed.
I don't know how attentive the average person is, but if I picked-up a power strip and it weighed twice as much as others, I'd be very suspiscious that something was off with it (maybe something fell in?)
It would strike me as much more effective to use a device that already has a lot more heft to it, so the weight difference wouldn't be noticed.
I know the Soviets discovered several CIA bugs because things like their copiers were just a few ounces heavier than a stock model.
Slashdot gets worse every day... Pipedot: News for nerds, without the corporate slant
strikes again. Our tax dollars at work.
Subtle... unless it looks like a part of a power strip? A bit larger than average, fine. USB ports — getting common. USB modem sticking out of it — somewhat suspicious...
Being in Britain and all, if a power strip like this shows up at work, the form factor should stand out nicely from all the rugged British stuff. It would be just about as inconspicuous as someone trying to spy on you wearing a full Ninja outfit. If you can actually see either, of course.
Get one of these: http://www.asus.com/Networks/Wireless_Routers/WL330N3G/. Hack OpenWrt to fit you needs, and flash the router with that. It's small and discrete enough to go unnoticed when set up and left somewhere, like behind a curtain, plugged into a forgotten Ethernet port in a wall somewhere. Power it with one of these: http://www.philips.co.in/c/cell-phone-accessories/universal-dlm2262_97/prd/.
Schroedinger's Brexit: The UK is both in and out of the EU at the same time!
PDF- http://cryptome.org/2012/07/cbp072312.pdf
TFA says "Preloaded with Debian 6, Metasploit, SET, Fast-Track, w3af, Kismet, Aircrack, SSLstrip, nmap, Hydra, dsniff, Scapy, Ettercap, Bluetooth/VoIP/IPv6 tools, & more". Which leads us to a question, since they're distributing it: are they in compliance with relevant licenses (e.g. GPL) if they have they modified any of the FOSS packages ?
Those who can make you believe absurdities can make you commit atrocities. - Voltaire
If, like me, you found it unlikely that DARPA would fund something like this and let you talk about it (or at least, suspected this might be a case of hacker braggadocio), check this out:
http://www.cft.usma.edu/currentProjects.htm
Showing up in corporate parking lots?
You should be considering how and where you are going to convincingly deliver 1,000 of these devices to the top 50 banks as if they were part of the normal office supply delivery.
I recommend branch offices rather than corporate HQ. Stuff like power strips are always in short supply, and at branch offices they'd happily accept (and without any questions) an accidental delivery of 3 from the office supply company via FedEx. And at branch offices I've done work in, there's always a little more do-it-yourself IT spirit, and I can see people happily plugging the Ethernet "surge suppressor" inline with their PC.
My question is -- how many are there like this out there already? Does anyone have the pockets deep enough to send out 10,000 like this to a focused group of targets? It starts to make even a successful activation rate of 0.05% look interesting.
Only in the US government.
now we need to go OSS in diesel cars
Let's say I do see one of these things in the office and I take your advice that I should call somebody to find out if that thing is supposed to be there. This raises the important question of whom I should call. If it's not supposed to be there, that means that somebody, possibly one of my co-workers planted it. PROBABLY one of my co-workers planted it. Now my trust in all my coworkers is in question.
Not that it's not already in question. Maybe I should call Homeland Security. And maybe Homeland Security planted it without the knowledge of my management...
The best part of this is the company is located in Barre VT (and its not pronounced Bar!)
Perhaps. But now that it is on slashdot, alternate fascia will be available soon. Consider this the open beta =)
Maybe I better take a closer look at those "smart" power strips the utility company sent me "for free". On second thought, nahhhhh.....I don't care that much. After all, I run some LAN subnets over NETGEAR® Powerline equipment; anybody who wants to nib can do it at their convenience right over the grid.
Now that's thoughtful of me; they wouldn't even have to burn the gas getting that van with the WiFi capture/decode equipment in it out here.
Orwell: "In a Time of Universal Deceit, telling the Truth is a Revolutionary Act"
I want one. And no one will question the price tag. After all, it's a DoD contract. :-)
er Guys you know there's this useful thing called secrecy - maybe Maybe William could get the Security Service and SIS to give the CIA a few helpful hints.
Secrecy is very important when your tools and resources are limited. In comparison to any other country in the world, the CIA and NSA might as well have limitless resources and tools at their disposal.
Amuses me that somebody was talking about hacking through the powerlines - as in using electrical lines as the medium not using something like this - bah far behind the times - still trying F&I I see or is that U&D?
Either way something undeniable starts in what 101 days or so?
http://unex.com.tw/wifi-surge-protection
every day http://en.wikipedia.org/wiki/Special:Random
Look at the receptacle style.
US outlet. this is built for domestic use... in country-- not foreign service.
every day http://en.wikipedia.org/wiki/Special:Random
Does it actually protect against power surges?
"$1,295 tool...the perfect gizmo for nefarious purposes." Major editing there, but my point stands: too expensive to toss around.
This is a hacked account, for which the owner can not be held responsible.
1000 feet for Bluetooth, but only in one direction, like the President's office.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
What makes this US made to the satisfaction of the government is that the software that makes this thing what it is, is made in the US, replacing all the original code.
That's the long-winded way of saying "We are dumb and don't think China is smart enough to put a backdoor."
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
$1295 = 1295 * 8 bits = 10,360 bits.
Octal is left as an exercise to the reader.
Historical note: In US, a bit is 1/8 of a dollar, or 12 1/2 cents.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
You know, the one that plants terrorism plans on your executive's computers and then faxes an "anonymous" letter to the FBI.
I lost the address of the 3rd-party vendor, but I think it was something-something road, cave # something, something-stan.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Cool, sounds like something every Hackerspace should offer a few times a year.
Do they charge extra for weekend visits?
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Do-it-yourself insurance is available, but costly.
You can get perpetual $1M liability coverage for an up-front fee of a mere million dollars.
Seriously, this exists. It's called "being self-insured" and it's what you are if you don't buy insurance from someone else.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
THIS explains all the BRANDYOUMENTIONED computers we were getting at the BIGBOXELECTRONICSTORE computer repair desk I worked at some years ago.
Anyone know the reason they went with DC for the entire distance, rather than use AC for the line and a short DC section or other equipment to connect otherwise-incompatible power grids?
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.