modified consoles as disposable nodes

[Eugen Leitl]

Looks useful for P2P infrastructure.

http://online.securityfocus.com/news/558

When Dreamcasts Attack

White hat hackers use game consoles, handheld PCs to crack networks from 
the inside out.

By Kevin Poulsen, Jul 31 2002 5:26PM
LAS VEGAS--Cyberpunks will be toting cheap game consoles on their utility 
belts this fall if they follow the lead of a pair of white hat hackers who 
demonstrated Wednesday how to turn the defunct Sega Dreamcast into a 
disposable attack box designed to be dropped like a bug on corporate 
networks during covert black bag jobs.

The "phone home" technique presented by Aaron Higbee of Foundstone and 
Chris Davis from RedSiren Technologies at the Black Hat Briefings here 
takes advantage of the fact that firewalls effective in blocking entry 
into a private network, are generally permissive in allowing connections 
the other way around.

Higbee and Davis perform penetration tests, and developed their game box 
cum attack tool after finding themselves more than once with physical 
access to a client's facilities -- posing as an employee in once case, 
crawling through a drop ceiling in another -- but without a way to 
leverage that access into remote control of the company's network.

"It's not that hard to get into an organization for one or two minutes," 
said Higbee.

They chose the Dreamcast for its small size, availability of an Ethernet 
adapter, and affordability -- the console was discontinued last year, and 
now sells used for under $100 on eBay. Loaded with custom Linux-based 
software and covertly plugged into a spare network port under a desk or 
above a ceiling, the harmless-looking toy becomes the enemy within, 
probing the company firewall for a way out to Internet.

The box cycles through the ports used for common services like SSH, Web 
surfing, and e-mail, which tend to be permitted by firewall 
configurations. Failing that, it tries getting "ping" packets out to the 
Internet, and finally looks for proxy servers bridging the network to the 
outside world.

Whatever it finds, it uses to establish a tunnel through the firewall to 
the intruder's home machine. "Most organizations focus on the perimeter," 
said Davis. "Once you get through the outside, there's a soft chewy 
center."

The pair suggested some techniques for mitigating the risk of dropped-in 
hardware -- restricting the LAN to pre-assigned MAC addresses, for one -- 
but said that ultimately, there may be little an organization can do to 
prevent an attacker with physical access from setting up a covert channel 
home.

The pair plan to release their Dreamcast software on their website next 
month, along with similar code they developed for the handheld Compaq 
iPAQ, and a bootable CD ROM designed to be slipped into print servers and 
other kiosk PCs.

While useful, they note that the other platforms lack at least one of the 
Dreamcast's virtues. "It's innocuous. It looks like a toy," said Davis. 
"If you bring it into a company, they're going to go, 'Wow, look at the 
toy!'"