Qgelm

The curious case of the Raspberry Pi in the network closet

<html> Last week I got a message from a co-worker with an image attached. <figure><img src=„https://pictshare.net/hdkhikv83m.png“ class=„img-responsive“/><figcaption>Message from my co-worker</figcaption></figure>I asked him to unplug it, store it in a safe location, take photos of all parts and to make an image from the SD card (since I mostly work remote). I have worked on many Raspberry Pi projects and I felt confident I could find out what it does. At this point nobody thought it was going to be malicious, more like one of our staffers was playing around with something. There were 3 parts: <ul><li>A Raspberry Pi b first generation</li> <li>a mysterious USB dongle</li> <li>a 16GB sd card (a fast one)</li> </ul><figure><img src=„https://pictshare.net/gfss00puet.jpg“ class=„img-responsive“/><figcaption>USB dongle and SD card</figcaption></figure> The number of people who can access this small cabinet is very limited. Only 4 people have a key for this room: <ol><li>The manager</li> <li>The groundskeeper</li> <li>My co-worker</li> <li>Me</li> </ol>None of them knew anything about this so I asked my IT colleagues and they were as baffled as I was. I heard of people getting paid to put things like this in places they shouldn't and for this reason I was very interested in finding out what it actually does. To help me solve this mistery <a href=„https://www.reddit.com/r/sysadmin/comments/9xveq5/rogue_raspberrypi_found_in_network_closet_need/“>I asked reddit</a> and surely enough they identified the dongle as a microprocessor, almost as powerful as the Rasberry Pi itself: the <a href=„https://wiki.makerdiary.com/nrf52832-mdk/“>nRF52832-MDK</a>. A very powerful wifi, bluetooth and RFID reader. <figure><img src=„https://pictshare.net/lrc3fnqrl7.jpg“ class=„img-responsive“/><figcaption>The nRF52832-MDK usb dongle</figcaption></figure>This was - no doubt - to give the old Raspberry Pi a wifi and bluetooth connection. Great so now this thing has wifi too.. The SD card has a few partitions. Most ext4 (linux) and one fat16 (boot) <figure><img src=„https://pictshare.net/htpg3y9xhu.png“ class=„img-responsive“/><figcaption>GParted view of the image</figcaption></figure>Great, time to mount it. My debian box told me the first big clue: It's a resin installation <figure><img src=„https://www.pictshare.net/wt9hqp.png“ class=„img-responsive“/><figcaption>Resin partitions on the SD Card</figcaption></figure><h2>WTF is Resin?</h2> <a href=„https://www.balena.io/“>Resin (now renamed to Balena)</a> is a paid <a href=„https://www.balena.io/what-is-balena“>IOT web service</a> where you can generate images for IOT devices, deploy those devices and get updates and data from and to resin. Resin also installs a VPN on the device so the collected data is transferred securely. Obviously this device was meant to be picked up again since it leaves a trail as the service is a paid one. <h2>Closer look at the partitions</h2> First partition is called „resin-boot“ <figure><img src=„https://www.pictshare.net/n7rq00.png“ class=„img-responsive“/></figure>See something that catches your eye? We got a

config.json

. Quick jackpot? <figure><img src=„https://www.pictshare.net/y9tq3d93ru.png“ class=„img-responsive“/><figcaption>config.json on the resin-boot partition</figcaption></figure>What we can extract from this file: <ol><li>The application deployed to this resin device is called „logger“. Not a good sign</li> <li>We got a username. This seems to be the username for the resin account associated with this device</li> <li>Confirmation that the device used a VPN via Port 443</li> <li>A registration date. It was registered (or first deployed or set up?) on May 13th 2018</li> </ol><h3>About that username..</h3> When I googled the username found in the config.json file I found a person in the same town where this Pi was found. The company then checked their records for this person but found nothing. Oddly enough I found a website from 2001 where parents of „gifted children“ write articles about them and for some reason sign those articles with their home address and phone numbers. So I have a name and the address of this whole family. <figure><img src=„https://pictshare.net/800/9drvd1.jpg“ class=„img-responsive“/><figcaption>Not the actual site but a similar one</figcaption></figure>This could be a wrong lead as usernames tend to be used by multiple people but let's just keep that name in mind. <h3>resin-data</h3> The data directory didn't have any data stored (as in: collected data) but there was a nodejs app which was heavily obfuscated and to this day I can't tell exactly what it was doing. It seems to talk via a serial connection to the dongle but I can't extract what data is actually collected. I can only assume that it collected movement profiles of bluetooth and wifi devices in the area (around the Managers office) and maybe raw wifi packets. But I found something much more interesting: a

LICENSE.md

file <figure><img src=„https://www.pictshare.net/7ora0e.png“ class=„img-responsive“/><figcaption>Screenshot of the LICENSE.md file</figcaption></figure>Odd.. Why would this nodejs app include a confidential piece of software? I googled the company from the copyright header and guess what? It is beyond me why a co-founder of a company would distribute these devices around town but well.. <hr/><h2>Getting the attackers home address</h2> Another very interesting thing I found was a file on the third partition (

resin-state

) in the path

/root-overlay/etc/NetworkManager/system-connections/

. The file is called resin-wifi-01 and guess what it contains? <figure><img src=„https://www.pictshare.net/8vdh9k.png“ class=„img-responsive“/></figure>It contains the wifi credentials to the wifi that was used to set the device up (or to test it). Definitely not the wifi of the company. And what do we do, when we want to find out a location associated with a wifi name? We go to wigle.net, enter the SSID (=wifi name) and it tells us where on the world it is found. <figure><img src=„https://www.pictshare.net/6ztf78.png“ class=„img-responsive“/><figcaption>not the actual name and not the actual location</figcaption></figure>And guess what? The address we found of that gifted persons parents? That's exactly where our Pi was set up according to Wigle.net <h2>How and when did the Pi even get there?</h2> I checked the DNS logs and found the exact date and time when the Pi was first seen in the network. I checked the RADIUS logs to see which employee was at the premises at that time and I saw multiple error messages that a deactivated account tried to connect to wifi. That deactivated account belongs to an ex employee who (for some reason) made a deal with management that he could still have a key for a few months until he moved all his stuff out of the building (don't ask..). <h2>What now</h2> Legal has taken over, I did my part and the rest is over my pay grade. For me it was a very interesting challenge and I'd like to thank every person on reddit who helped me with one piece of the puzzle. </html>

Qgelm

Seiten-Werkzeuge

Webseiten-Werkzeuge

Benutzer-Werkzeuge

The curious case of the Raspberry Pi in the network closet