An air freshener with network connectivity? Better disguises immediately come to mind.
The power brick approach is an improvement but still makes the following assumptions:
* location of network ports is at floor level hidden under desks
* power and network cable colours match
* an employee won't disconnect a seemingly useless box when they need to charge their phone
* port security is not in use
A replacement "trojan horse" computer or printer that has been modified externally is a stealthier approach. Such devices have a reason for being connected to a power source and the network and do not raise suspicion (especially if the replacements are soiled and have worn asset stickers attached). Local IT staff will ensure the devices have network connectivity and will likely assume (in the case of a computer) that suspicious network traffic is the result of a virus.
Failing that full blown approach, even a "signal booster" could be a better disguise. An average person will think of their analogue TV and radio signal boosters. Further disguise can be added by soiling the devices, attaching asset stickers and stickers for a matching fake brand name and fake website where suspicious users can have their fears alleviated. The website has the added benefit of alerting the attacker that their device has been potentially compromised.
You're assuming that the local IT staff regularly monitor network traffic and are generally competent. Sadly, that isn't always the case. The attacker may also only need a few hours to get the data he is after, a fairly small window. As well, they'd have to be monitoring internal traffic, not just outgoing, as with one of these plugged in an attacker would be on the internal network. Most likely this type of attack would have to be detected by noticing that someone was accessing files, or trying to anyway, they had no business accessing rather than network traffic per se.
I like the idea of a signal booster. That is actually a great idea for disguising these things. I've seen these things before and figured it would be best to just run the Ethernet behind a printer or something and hope that people don't notice it was still continuing on past the device, but your idea is even better. Everyone complains on some level about their Internet, just install the 'signal booster' to give them a stronger connection. ;-)
Comments
An air freshener with network connectivity? Better disguises immediately come to mind.
The power brick approach is an improvement but still makes the following assumptions:
* location of network ports is at floor level hidden under desks
* power and network cable colours match
* an employee won't disconnect a seemingly useless box when they need to charge their phone
* port security is not in use
A replacement "trojan horse" computer or printer that has been modified externally is a stealthier approach. Such devices have a reason for being connected to a power source and the network and do not raise suspicion (especially if the replacements are soiled and have worn asset stickers attached). Local IT staff will ensure the devices have network connectivity and will likely assume (in the case of a computer) that suspicious network traffic is the result of a virus.
Failing that full blown approach, even a "signal booster" could be a better disguise. An average person will think of their analogue TV and radio signal boosters. Further disguise can be added by soiling the devices, attaching asset stickers and stickers for a matching fake brand name and fake website where suspicious users can have their fears alleviated. The website has the added benefit of alerting the attacker that their device has been potentially compromised.
You're assuming that the local IT staff regularly monitor network traffic and are generally competent. Sadly, that isn't always the case. The attacker may also only need a few hours to get the data he is after, a fairly small window. As well, they'd have to be monitoring internal traffic, not just outgoing, as with one of these plugged in an attacker would be on the internal network. Most likely this type of attack would have to be detected by noticing that someone was accessing files, or trying to anyway, they had no business accessing rather than network traffic per se.
I like the idea of a signal booster. That is actually a great idea for disguising these things. I've seen these things before and figured it would be best to just run the Ethernet behind a printer or something and hope that people don't notice it was still continuing on past the device, but your idea is even better. Everyone complains on some level about their Internet, just install the 'signal booster' to give them a stronger connection. ;-)
This is an interesting idea. The recent HP LaserJet firmware vulnerability immediately comes to mind.