Forgot your password?
typodupeerror
Security Networking Power Hardware IT

The DARPA-Funded Power Strip That Will Hack Your Network 176

Posted by timothy
from the ok-but-how-is-it-powered? dept.
An anonymous reader writes "The Power Pwn may look like a power strip, but it's actually a DARPA-funded hacking tool for launching remotely-activated Wi-Fi, Bluetooth, and Ethernet attacks. If you see one around the office, make a point to ask if it's supposed to be there. Pwnie Express, which developed the $1,295 tool, says it's 'a fully-integrated enterprise-class penetration testing platform.' That's great, but the company also notes its 'ingenious form-factor' (again, look at the above picture) and 'highly-integrated/modular hardware design,' which to me makes it look like the perfect gizmo for nefarious purposes."
This discussion has been archived. No new comments can be posted.

The DARPA-Funded Power Strip That Will Hack Your Network

Comments Filter:
  • O RLY (Score:5, Funny)

    by Anonymous Coward on Sunday July 22, 2012 @12:46AM (#40727949)

    Omg Pwnies!

  • it's actually a DARPA-funded hacking tool for launching remotely-activated Wi-Fi, Bluetooth, and Ethernet attacks.
    Might be somewhat impressive, but it can't get first post!

  • by Tastecicles (1153671) on Sunday July 22, 2012 @01:01AM (#40727997)

    ...for the appearance of this device.

    Part of a penetration test should be, and I don't think I need to remind those who are active in the cybersecurity industry of this(!), creating hacking devices that look as if they're part of the furniture - like they're supposed to be there.

    Discuss.

  • by guttentag (313541) on Sunday July 22, 2012 @01:25AM (#40728095) Journal
    I predict these will start showing up in corporate parking lots [slashdot.org]. "Ooh! Look, someone dropped a power strip! I've been telling my boss I need more outlets in my cubicle since he won't let me charge my phone by plugging it into the computer anymore... this will do nicely! And is that a USB stick on the ground? Oh, almost got me there. I know better than to plug that in."
    • Showing up in corporate parking lots?

      You should be considering how and where you are going to convincingly deliver 1,000 of these devices to the top 50 banks as if they were part of the normal office supply delivery.

      I recommend branch offices rather than corporate HQ. Stuff like power strips are always in short supply, and at branch offices they'd happily accept (and without any questions) an accidental delivery of 3 from the office supply company via FedEx. And at branch offices I've done work in, there'

    • F no! For $1,295, I'm wrapping this sucker up in several layers of aluminium foil [wired.com] and I'm taking it home to sell on ebay. The same goes if I find any nefarious-looking device stuck on my car.

  • Translation (Score:5, Interesting)

    by bashibazouk (582054) on Sunday July 22, 2012 @02:10AM (#40728275) Journal

    The opposition (who ever they may be) has figured out that we were using this device. Word has gotten out. We no longer need it. You may now do with it as you wish...

    • by blueg3 (192743)

      No, it's just recently come out. It's one of the mini-projects funded via the DARPA Cyber Fast Track, currently run by Mudge. Their list of funded projects is publicly available on their website (and updated reasonably frequently) and they encourage sharing the results of projects.

  • Seems like this could be great for ad-hoc wifi. Hide enough tiny routers in power strips (or even light fixtures, etc) and you can spread your signal without anyone noticing.

  • by evilviper (135110) on Sunday July 22, 2012 @03:13AM (#40728467) Journal

    I don't know how attentive the average person is, but if I picked-up a power strip and it weighed twice as much as others, I'd be very suspiscious that something was off with it (maybe something fell in?)

    It would strike me as much more effective to use a device that already has a lot more heft to it, so the weight difference wouldn't be noticed.

    I know the Soviets discovered several CIA bugs because things like their copiers were just a few ounces heavier than a stock model.

    • I don't know how attentive the average person is, but if I picked-up a power strip and it weighed twice as much as others, I'd be very suspiscious that something was off with it (maybe something fell in?)

      Well, I said this elsewhere, but when I saw the picture I thought it could pass for a UPS -- and who is going to question a heavy UPS? You can get even nastier with a UPS, since it normal for it to be connected to a USB port or to a LAN (if my power strip were connected to a LAN, I would be a bit curious).

      • by Manfre (631065)

        if my power strip were connected to a LAN, I would be a bit curious

        Many power strips include surge suppression ports for RJ-11 and RJ-45.

        • by mjwalshe (1680392)
          But power strips with urge suppression ports for RJ-11 and RJ-45 are only for consumer use you would not see this in a structured cabling in the office setting.
    • by couchslug (175151)

      "I don't know how attentive the average person is, but if I picked-up a power strip and it weighed twice as much as others, I'd be very suspiscious that something was off with it (maybe something fell in?)"

      They'd think it was higher quality because it weighed more.

  • Subtle... unless it looks like a part of a power strip? A bit larger than average, fine. USB ports — getting common. USB modem sticking out of it — somewhat suspicious...
  • by PolygamousRanchKid (1290638) on Sunday July 22, 2012 @04:44AM (#40728729)

    Get one of these: http://www.asus.com/Networks/Wireless_Routers/WL330N3G/ [asus.com]. Hack OpenWrt to fit you needs, and flash the router with that. It's small and discrete enough to go unnoticed when set up and left somewhere, like behind a curtain, plugged into a forgotten Ethernet port in a wall somewhere. Power it with one of these: http://www.philips.co.in/c/cell-phone-accessories/universal-dlm2262_97/prd/ [philips.co.in].

  • by goodmanj (234846) on Sunday July 22, 2012 @06:49AM (#40729045)

    If, like me, you found it unlikely that DARPA would fund something like this and let you talk about it (or at least, suspected this might be a case of hacker braggadocio), check this out:

    http://www.cft.usma.edu/currentProjects.htm [usma.edu]

    The Power Strip Auditor
    Pwnie Express
    February 2012

    • by mjwalshe (1680392)
      er Guys you know there's this useful thing called secrecy - maybe Maybe William could get the Security Service and SIS to give the CIA a few helpful hints.
  • Only in the US government.

  • Let's say I do see one of these things in the office and I take your advice that I should call somebody to find out if that thing is supposed to be there. This raises the important question of whom I should call. If it's not supposed to be there, that means that somebody, possibly one of my co-workers planted it. PROBABLY one of my co-workers planted it. Now my trust in all my coworkers is in question.

    Not that it's not already in question. Maybe I should call Homeland Security. And maybe Homeland Sec

    • by russotto (537200)

      This raises the important question of whom I should call. If it's not supposed to be there, that means that somebody, possibly one of my co-workers planted it. PROBABLY one of my co-workers planted it. Now my trust in all my coworkers is in question.

      If I find one of these things in my office, I'd call information security; if need be they can talk to physical security to figure out how it got there. If one of my co-workers planted it (and it wasn't a legitimate test, in which case I suppose blue team won),

    • by PPH (736903)

      I'd just swap it with the plug strip I have in my home shop. The one I use to plug in my 120V MIG welder. If the NSA wants to listen to 'BZZZZZZZ BZZZZZZZ' all day, they are welcome to it.

  • The best part of this is the company is located in Barre VT (and its not pronounced Bar!)

  • Maybe I better take a closer look at those "smart" power strips the utility company sent me "for free". On second thought, nahhhhh.....I don't care that much. After all, I run some LAN subnets over NETGEAR® Powerline [netgear.com] equipment; anybody who wants to nib can do it at their convenience right over the grid.

    Now that's thoughtful of me; they wouldn't even have to burn the gas getting that van with the WiFi capture/decode equipment in it out here.
  • Look at the receptacle style.

    US outlet. this is built for domestic use... in country-- not foreign service.

  • "$1,295 tool...the perfect gizmo for nefarious purposes." Major editing there, but my point stands: too expensive to toss around.

Did you know that for the price of a 280-Z you can buy two Z-80's? -- P.J. Plauger

Working...