Smuggled Raspberry Pis attempt to steal passwords

Andrew Tsonchev, Director of Cyber Analysis | Monday November 27, 2017

Darktrace recently detected two rogue devices on the network of a major healthcare provider. They were brought onto the network by a trusted employee, who – for reasons still unknown – was attempting to harvest user credentials and profile the network’s defenses.

Darktrace’s AI algorithms had built a detailed understanding of the organization’s normal network activity and digital infrastructure. When the two new devices entered the network and sent ‘Redirect Datagram for the host’ messages to the subnet router, Darktrace identified the anomaly and raised an alert in real time. This represented the first of three anomalies:

  1. Two unknown Raspberry Pis are introduced to the network
    Based on the MAC addresses, the newly introduced devices were determined to be two Raspberry Pis. Once on the network, they began acting like gateways, which use remote hosts to send data packets on alternative routes.

    It was initially believed that the insider was using the devices to engage in ARP spoofing. However, the subnet router did not respond to the messages.
  2. The devices attempt to redirect users to a fake security survey
    The second anomaly occurred when the devices began beaconing to a rare external endpoint, which resolved to Amazon cloud services. This activity is typically seen in attempted communications with a command-and-control center, but there was no returning inbound traffic.

    Instead, the rare destination turned out to be a website, which was identical to an internal website being used to host a security survey. Before accessing the survey, employees needed to enter their user credentials.

    In addition to harvesting user credentials, the survey was asking a series of questions that would have been extremely useful for an attacker. The survey included questions designed to learn the status of their anti-virus and firewalls, and whether users were using the same passwords across multiple services.
  3. The insider tries to hide the devices via DHCP allocation requests
    The final anomaly came when one of the devices made a DHCP allocation request for an IP address on a separate subnet. It had the same hostname of the infringing device, but a new MAC address.

    Essentially, the insider was attempting to hide the devices by manually changing their IP addresses through DHCP release and allocation requests.

Each of these anomalies represented a subtle deviation from the organization’s normal ‘pattern of life’. By correlating these weak indicators of threat, Darktrace was able to discover a larger pattern that revealed the whole story: a malicious insider had smuggled Raspberry Pis onto the network to lure users to a fake website, steal their credentials, and test the network’s defenses, all while remaining hidden from network defenses.

By raising alerts in real time, Darktrace helped ensure that no users fell victim to the attack. Soon after, the Pis disappeared from the network. While the culprit was never caught, the organization has yet to experience a similar threat, indicating that the insider either left the organization, or remains in hiding.

Since the incident, the healthcare provider has undergone a restructuring of its network, and they’ve adopted a host of new IoT devices. Darktrace’s algorithms are continuously learning and re-learning normal, so if the malicious insider were to re-emerge, Darktrace would immediately detect their presence on the network.

Blog Archive

Thursday January 10, 2019
Monday December 3, 2018
Thursday November 22, 2018
Thursday October 25, 2018
Thursday October 4, 2018
Monday August 20, 2018
Monday July 16, 2018
Friday June 22, 2018
Wednesday May 9, 2018
Monday April 16, 2018
Wednesday March 7, 2018
Tuesday February 13, 2018
Friday February 2, 2018
Monday January 22, 2018
Friday December 8, 2017
Monday November 27, 2017
Monday October 30, 2017
Wednesday October 25, 2017
Thursday October 12, 2017
Monday October 2, 2017
Monday September 18, 2017
Monday July 31, 2017
Thursday June 29, 2017
Wednesday June 21, 2017
Wednesday May 17, 2017
Monday May 8, 2017
Wednesday April 5, 2017
Monday March 6, 2017
Monday February 13, 2017
Monday January 30, 2017
Monday January 9, 2017
Friday December 16, 2016
Monday December 5, 2016
Friday November 18, 2016
Friday November 4, 2016
Monday October 24, 2016

About the authors

Justin Fier

Justin Fier is the Director for Cyber Intelligence & Analytics at Darktrace, based in Washington D.C. Justin is one of the US’s leading cyber intelligence experts, and his insights have been widely reported in leading media outlets, including Wall Street Journal, CNN, the Washington Post, and VICELAND. With over 10 years of experience in cyber defense, Justin has supported various elements in the US intelligence community, holding mission-critical security roles with Lockheed Martin, Northrop Grumman Mission Systems and Abraxas. Justin is also a highly-skilled technical specialist, and works with Darktrace’s strategic global customers on threat analysis, defensive cyber operations, protecting IoT, and machine learning.

Dave Palmer

Dave Palmer is the Director of Technology at Darktrace, overseeing the mathematics and engineering teams and project strategies. With over ten years of experience at the forefront of government intelligence operations, Palmer has worked across UK intelligence agencies GCHQ & MI5, where he delivered mission-critical infrastructure services, including the replacement and security of entire global networks, the development of operational internet capabilities and the management of critical disaster recovery incidents. He holds a first-class degree in Computer Science and Software Engineering from the University of Birmingham.

Andrew Tsonchev

Andrew advises Darktrace’s strategic Fortune 500 customers on advanced threat detection, machine learning and autonomous response. He has a technical background in threat analysis and research, and holds a first-class degree in physics from Oxford University and a first-class degree in philosophy from King’s College London. He was most recently featured on BBC World, BBC Morning and Al Jazeera to comment on the news regarding the GRU.

Max Heinemeyer

Max is a cyber security expert with over eight years’ experience in the field specializing in network monitoring and offensive security. At Darktrace, Max works with strategic customers to help them investigate and respond to threats as well as overseeing the cyber security analyst team in the Cambridge UK headquarters. Prior to his current role, Max led the Threat and Vulnerability Management department for Hewlett-Packard in Central Europe. He was a member of the German Chaos Computer Club, working as a white hat hacker in penetration testing and red teaming engagements. Max holds a MSc from the University of Duisburg-Essen and a BSc from the Cooperative State University Stuttgart in International Business Information Systems.