The invisible woman and the axis camera

1

This post follows the original “philosophy”377 of this blog. Sometimes, when I think about a technique or a skill I consider interesting, I also imagine a real-life scenario where this technique can be applied (and seems I’m not the only one378…).

So, why not combining technical explanations with realistic stories, avoiding the usual, and sometimes boring, article style?

An excellent example of this is the Stealing the Network379 series. Especially the first book How to Own the Box380, composed by several stand-alone episodes, mix in a perfect way commands, exploits and traffic dumps with captivating stories: an entertaining reading for both experienced non-expert audiences.

Of course I don’t consider myself as good as the authors of the series, especially when it comes to write a story in a language that is not mine. What follows is just a modest experiment, done largely for the pleasure of writing. Feel free to report any errors, grammatical or not.

If you are only interested in technical subjects, the story includes a security camera hijack via real-time image alteration, some interesting tricks with ARP packets (of which one is probably unedited), and a bit of physical penetration test.

I hope you’ll like it…

Anti-aircraft Artillery

After all, entering the internal network wasn’t difficult…

When we initially identified a WEP wireless network, we wanted to seize that low-hanging fruit and avoid direct contacts with the customer as long as possible. But the enthusiasm was short-lived.

“Aren’t you planning to crack that network, are you?” said GrayFog in a tone of disapproval, “According to the Mac address, the access point is a SonicWALL. Maybe they have maintained an obsolete encryption for backward compatibility issues, or maybe not. “
GrayFog is our remote support, the fact he’s a paranoid type by nature makes him particularly suitable for this role.
“Do you think it’s an honeypot?”  I replied. “I think nothing, my lord. But you know, Curiosity Killed The Cat…”

When he starts to quote I feel an irresistible urge to beat him, but, as we discovered later, his advice was correct. The wireless network was kept under control, and any attack would have been detected immediately381, if not actively blocked (apparently there’s a reason for the price of SonicWALL products…)

Despite this drawback, we could have tried to decrypt the traffic in a passive manner, but since network traffic was very low, it would have taken a long time. However I had an ace up my sleeve.

“Since you are in citation mode, who said ‘In battle one engages with the orthodox and gains victory through the unorthodox’?”  Just a rhetorical question… “Are you kidding? Sun Tzu, The art of war.”
“Returning to more concrete things, do you have a plan Luna?” For the first time Daniel was talking, my partner in physical operations.
“Yes, I do. But we must get our hands dirty, something low-tech.”