Every IT administrator’s nightmare: an unknown device found on the internal network, after having been there for months doing… probably something very bad. That’s what happened to Christian Haschek, who received an alert about a mysterious Raspberry Pi connected inside one of the racks. Christian decided to document part of the forensic analysis and his detective work to find the owner of the device, who, by the way, made several mistakes…
It all started with a colleague’s question and a photo: “What is this?” At first glance, it was an old Raspberry Pi model B with some extra hardware. Christian’s instructions were to determine where the LAN cable was connected, unplug it, store it safely, take photos of every part and create an image of the SD card. At that point, the available information suggested the device wasn’t malicious – maybe an employee had tested something and forgotten to remove the Pi. But that impression changed as Christian dug deeper.
The Mysterious Raspberry Pi
The first step was to figure out who had physical access to that section of the network: the administrator, the facilities manager, Christian, and his colleague. Nobody knew anything about the Raspberry Pi, so Christian expanded his questioning to other coworkers, who were just as surprised. But rumors of people hired to plant hidden devices in corporate networks never really die. He then identified the USB dongle with help from Reddit: the nRF52832-MDK, a hybrid of WiFi, Bluetooth, and RFID.
The initial analysis of the SD card image revealed a Resin installation (now Balena), a web-based IoT management service. Resin/Balena requires a subscription, meaning the attacker planned to retrieve it. The config.json contained a username, VPN settings, the app name (“logger” – a bad sign), and the registration or activation date: May 13, 2018.
Googling the username led to a person in the same area where the Pi was found, but the company had no record of them. Instead, Christian found an old portal from 2001 where parents of gifted children wrote short stories about them, signing with their names and physical addresses (the naivety of 2001...). This could have been a dead end, but he decided to follow it. The Resin data directory contained nothing except a heavily obfuscated node.js application. In the LICENSE.md file, something interesting appeared: the name of a company, and a small sample of text declaring the software proprietary and confidential. Googling that company, Christian discovered that the person linked to the username was one of its co-founders.
There were too many traces for someone supposedly trying to stay anonymous, but Christian had another idea: study the third partition of the SD image, following the path /root-overlay/etc/NetworkManager/system-connections/. The file named resin-wifi-01 delivered the jackpot: the WiFi network credentials the attacker had used to configure the device. With the SSID in hand, Christian visited wigle.net (a global map of WiFi networks), performed a search, and the last piece clicked into place: the physical address associated with the SSID was the same one used to sign in on the gifted-children page.
The next steps were to check the Pi’s original network connection through DNS logs, and compare that with RADIUS records to identify employees who were there at the time. Several RADIUS errors pointed to a deactivated account that tried to connect to the WiFi. Whose account was it? A former employee who, inexplicably, had convinced the administration to keep a copy of the keys for several months until they could finish moving their things out.
Christian ends the story here, saying the rest depends on the lawyers. I imagine that former employee has some questions to answer, but so does the administration for committing an act of negligence in information security. Physical keys and unlimited access to network infrastructure? You have to be very ignorant – or complicit.
Official site: Click here
https://old.neoteo.com/centro-multimedia-con-raspberry-pi/
