ars technica wrote:When Jayson E. Street broke into the branch office of a national bank in May of last year, the branch manager could not have been more helpful. Dressed like a technician, Street walked in and said he was there to measure "power fluctuations on the power circuit." To do this, he'd need to plug a small white device that looked like a power adapter onto the wall.
The power fluctuation story was total BS, of course. Street had been hired by the bank to test out security at 10 of its West Coast branch offices. He was conducting what's called a penetration test. This is where security experts pretend to be bad guys in order to spot problems.
In this test, bank employees were only too willing to help out. They let Street go anywhere he wanted—near the teller windows, in the vault—and plug in his little white device, called a Pwn Plug.
"At one branch, the bank manager got out of the way so I could put it behind her desk," Street says. The bank, which Street isn't allowed to name, called the test off after he'd broken into the first four branches. "After the fourth one they said, 'Stop now please. We give up.'"
Built by a startup company called Pwnie Express, the Pwn Plug is pretty much the last thing you ever want to find on your network—unless you've hired somebody to put it there. It's a tiny computer that comes preloaded with an arsenal of hacking tools. It can be quickly plugged into any computer network and then used to access it remotely from afar. And it comes with "stealthy decal stickers"—including a little green flowerbud with the word "fresh" underneath it, that makes the device look like an air freshener—so that people won't get suspicious...
social engineering is part and parcel of successful h4cking. look at what "got" HBGary.
2013 BMW 328i M Sport with 8sp in Estoril Blue II
2012 Chrysler 300C SRT8 - Always bet on black
2012 Jeep Wrangler Unlimited Rubicon Call of Duty: Modern Warfare 3 Edition, otherwise known as the MW3 (and badass)
people are building decent (not good, but decent) security these days, almost all good attacks target the weakest part of the system - the user. Phishing attacks get users to click links (getting around firewalls, browser security), malware infected mobile apps get users to accept tainted software (circumventing OS security), something like this gets users to help with physical access.
And the Pwn Plug runs its own software (Linux kernel), so there wouldn't be an ethernet plug. Just put a little app on it that phones home to a central server saying "I got out!" and the pen test is a success.
Jason "El Zorro" Fox '17 Subaru Forester 2.0XT
DCAWD - old coots in fast scoots.
ElZorro wrote:And the Pwn Plug runs its own software (Linux kernel), so there wouldn't be an ethernet plug. Just put a little app on it that phones home to a central server saying "I got out!" and the pen test is a success.
How would it phone home without an ethernet link?
All my cars have drum brakes and are sub 200 hp, what am I doing with my life?
2013 Mazda 2
1994 Chevy S10 pickup
1985 Chevy Caprice (no fuel system)
Looks like a wireless antenna hanging off the side....
Sabre (Julian) 92.5% Stock 04 STI
Good choice putting $4,000 rims on your 1990 Honda Civic. That's like Betty White going out and getting her tits done.
The basic model costs $480, but if you're willing to pay an extra $250 for the Elite version, you can connect it over the mobile wireless network. "The whole point is plug and pwn," says Dave Porcello, Pwnie Express's CEO. "Walk into a facility, plug it in, wait for the text message. Before you even get to the parking lot you should know it's working."
Patience is the ability to idle your motor when you feel like stripping your gears
Sabre (Julian) 92.5% Stock 04 STI
Good choice putting $4,000 rims on your 1990 Honda Civic. That's like Betty White going out and getting her tits done.
