The Little White Box That Can Hack Your Network

http://www.wired.com/wiredenterprise/2012/03/pwnie/

by jonah • 14 years ago

129 48 14 years ago

fabricode• 14 years ago

Perhaps we need to move to policy of allowing only known mac addrs on internal networks. But maybe even this would be insufficient since one could sniff packets in order to steal someone else's valid mac address. That too would be insufficient since you can get the mac address off of the menu for most VOIP phones, and off the backsides of of other networked items, ...

Perhaps there is no defense against this kind of attack.

daeken• 14 years ago

You're right, MAC-based defenses don't work for this type of attack; even if you came up with some scheme where a switch port won't get turned on until you announce yourself from a trusted MAC, you can always MITM a phone/computer on the network and get it that way.

The real solution here is proper network segregation and requiring encrypted traffic across the board, with sane key distribution schemes. But that's difficult and expensive.

jetsnoc• 14 years ago

For every local LAN attack there are mitigation techniques. Cisco Switches have great features like DHCP Snooping and Dynamic ARP Inspection (DAI) to eliminate rogue DHCP servers and ARP spoofing.

Further yet, with "switch-port security" you can lock down mac addresses per port. With port security and proper device segregation if you spoofed a phones mac address and plugged in to that port the switch would still put you in to only the voice vlan not the data lan. It's not perfect but there are a lot of things you can do to secure a local LAN.

Unfortunately, most businesses must not even do the bare minimum if all they have to do is plug in a single PwnPlug without any attack vectors implemented like mac spoofing.

Swannie• 14 years ago

Yep. My University implemented switch-port security before I arrived in 2001. Managed switches, central MAC register, you were placed on the VLAN your MAC said you belonged to.

If your MAC appeared twice, you'd be locked out of the network and need to go and do some explaining (!). If your MAC moved around too much, ditto. If you had more than one ARP entry for your port, ditto.

rythie• 14 years ago

Really you need 802.1x to do per port authentication. Though really you should still use encryption for all protocols and have strong passwords internally too.

notatoad• 14 years ago

It seems more and more like the concept of an 'internal network' needs to die. Open everything up to the Internet at large, and harden it all accordingly. It makes sense from a user experience perspective (why shouldn't I be able to access my work from home or on the road), and with the increasing number of easily concealable connected devices it makes sense from a security perspective too.

dillona• 14 years ago

If you have sensitive data that you'd rather other people not see, the Internet is the last place you put it.

Even if the box has been "hardened"

tylermenezes• 14 years ago

That is an extremely naïve perspective. Imagine you run IT for 10,000 PCs across the US. For one, maybe 10% of these would need to be upgraded to get to an OS with modern security. Then there's the servers for internal applications which can't be upgraded without breaking things. And then you'll need to deal with all the support, explaining to employees why, yes, although they have tasks which need to run overnight, no, they can't disable automatic update, because it would put the corporation at risk. Not to mention the amount of work it takes to keep computers up to date even when the user isn't a problem.

And even with all of that, one day one of the computers gets a backdoor installed, and the attacker is able to copy everything off your network drive, because you didn't have any sort of IDS or firewall to prevent it.

Smarter people than you have thought about this. There's a reason the idea of an internal network exists at all; NAT certainly wasn't something people were considering right from the start.

7952• 14 years ago

Is it acceptable to run a VPN over the internet?

Nitramp• 14 years ago

How does an intranet/VPN help with avoiding malware on end user computers? I don't see the connection, isn't that entirely orthogonal? The OP wasn't arguing that you shouldn't control end user's devices, just that having an intranet of some sorts is not helpful.

If you run a large network, you'll have to deal with malware on users devices, and you'll have to deal with people gaining access to your network in other ways, such as this white box.

Having an "internal" network that isn't actually internal only gives you a false sense of security. Having access to an internal network should never give anyone higher access levels, but the whole idea of a "corporate intranet" pushes you in that direction.

marklindhout• 14 years ago

>Smarter people than you have thought about this.

That is very rude.

ChuckMcM• 14 years ago

I disagree that it is naive. At the recently finished RSA conference it was a common theme in many of the discussions. Basically operations is going to 'lose the war' of trying to control every device that is inside your network because there are phones, and tablets, and personal computers etc. which all want to be 'connected' at some level. So creating an infrastructure that is tolerant of that may ultimately become the norm.

Apparently in some sensitive facilities there are networks keyed off by MAC address, and then 802.1x key, so you need to have both the right MAC and the right key for that MAC to get an address and to send and receive packets. Connecting to the network switch with a 'non-authorized' MAC puts you on a different VPN than the if you connect with an authorized machine.

One of the attendees at the show told me they assumed that their network was 'unsafe' all the time and planned accordingly.

Now its probably naive to think we would go there in a year or two but it does seem to be a road we're being inexorably forced down.

pheon• 14 years ago

It seems more and more like the concept of 'local law enforcement' needs to die. Open everything up to everyone at large, and harden all men, women and children to the realities of violence.

We should disbanded corporate, local, state, federal and country law enforcement. there should be no countries, borders or walls anywhere and you should also leave your house/apartment/car door unlocked because we have all been hard ended by carrying loaded assult weapons and heavy armor 100% of the time, including your 5yo school kid.

oh.. will get karma from hell for this.

jjguy• 14 years ago

There are two new paradigms gaining momentum in enterprise environments:

  - Assumption of breach 
  - Bring your own device

Assumption of breach is driven by the industry's over-emphasis on protection, versus detection and response. The harsh reality is an attacker will always be successful gaining access. The detection and response capabilities are historically anemic due to repeated under-investment. That's why you see so many intrusions reported and the attackers have been in place for months or years.

One of the natural results of assuming breach is to shift focus from protecting _devices_ to protecting _data_. An attacker can always land on the secretary's machine, but you can put additional layers of protection around the organization's critical data.

Bring your own device (BYOD) is a natural extension of assuming breach and shifting focus from data to devices, and aligns nicely with the user desires to use their iPads and smartphones. The result in these environments is the IT shop becomes more ISP and less Dell technical support.

Many industries are adopting the assumption of breach and inevitability of compromise. RSA Exec Chairman at the RSA Conf a couple weeks ago: "We need to acknowledge once and for all that our networks will be penetrated." BYOD is harder - popular for universities and hospitals with significant user mobility, less so for governments and financials with higher protection thresholds and more static environments.

In another five years, these ideas will be common practice for many industries. If you HN'ers have some crafty plans in the enterprise space, take note.

hendzen• 14 years ago

I'd wager that many if not most corporate internal networks are vulnerable to ARP poisoning. A little computer hooked up to the network via ethernet is all one would need to launch such an attack, and https is vulnerable since many users have been conditioned to click through any kind of invalid certificate warning. Consider downloading Cain&Abel and experimenting on your own home network just to see how powerful these tools are. Fortunately, methods of detecting ARP poisoning exist, but undoubtedly many IT departments invest heavily in firewalls without worrying about attacks originating from inside.

tptacek2• 14 years ago

I don't know why anyone would bother with ARP poisoning. Internal pentests are invariably bloodbaths; you spend 3 hours getting shells on 2-3 systems, and then another hour getting shells on 200-300 more as a result of all the stuff you find on those 3. On internal networks, the admin password is always "admin", the database password "oracle".

dhess2• 14 years ago

For those of us who go to the trouble of attempting to lock down our internal networks by changing the default passwords; setting up guest wireless networks; and running SSH and Kerberized NFS/AFP; what do you recommend as a reasonable set of measures to defend against internal attacks? What does Matasano do? I'm particularly interested in strategies for layer 2.

tptacek2• 14 years ago

For whatever it's worth, this idea is at least 15 years old; it was a L0pht project that Mudge demo'd at Pumpcon in '97. If I'm remembering it right, it was a Palm device with Ethernet rigged to it and a modem.

atomical2• 14 years ago

Am I missing something here? Why is the whitehat installing something that can do malicious things instead of a mock?

JoachimSchipper• 14 years ago

Because people don't (want to) believe that they could have been pwned until they actually are pwned.

keithpeter3• 14 years ago

“Right now they’re actually flying people out to the stores to spot check and do penetration basis, but now with something like this you don’t have to travel.”

They send them out in jiffy bags to the regional branches, manager plugs one in, they can stay at head office and check the (branch) network. Saves money, provides hard data.

atomical2• 14 years ago

1) Send a small devise that's actually a box of rocks to bank that plugs into wall 2) Call bank, ask if they installed the box. 3) Save tons of money hiring people with overpriced gadgets. 4) Profit

CPlatypus• 14 years ago

I'd really like to see a wireless version of this. Plug it in, let it take as long as it likes to crack a weak WEP key, then send you an email. On the down side, you might not be able to access as much via a wireless network. On the up side, the "air freshener" disguise is much more believable without the network cable. You could have a wifi+cel version, but a dual-wifi version would probably broaden the range of hardware/software you could use and would also be a bit more useful.

hnwh• 14 years ago

read the product website

raesene22• 14 years ago

FWIW, I hardly ever see WEP any more on wireless tests. WPA-PSK is still reasonably common even in corporates (mainly for guest networks), but realistically most companies I see are running 802.1X and PEAP against either Active Directory or a Cisco RADIUS Server.

SpikeDad• 14 years ago

WiFi Pineapple Mark IV? - http://hakshop.myshopify.com/collections/frontpage/products/...

perone• 14 years ago

This is a nice project for a Raspberry Pi.

someone13• 14 years ago

Another, similar project is the Minipwner (http://www.minipwner.com/). It's effectively a TLINK router, flashed with OpenWRT and connected to a cellphone batttery pack, with a very small USB drive for storage and swap. It's also much cheaper - it cost me about $50, including shipping. Highly recommended if you want to play with this sort of thing.

joshu• 14 years ago

I have one. Not trying to build a hacking box but the instructions are useful nonetheless.

trotsky• 14 years ago

Does anyone know how much it costs to run an ad like this at wired?

jonah• 14 years ago

I'd venture to guess similar to the cost of running one here. ;)

(Disclosure: I have no association with either Wired or Pwnie Express.)

akeck• 14 years ago

Quis custodiet ipsos custodes?

The Little White Box That Can Hack Your Network

Related Stories