Dell E-Port Plus User Manual download pdf (Page 26)

12 Conclusion

Laptop docking stations are widely used and trusted devices, which provide extensive access to

potentially sensitive data. Their anonymity, accessibility and lack of physical protection within an

organisation can easily result in them being substituted for an identical-looking dock containing a

hardware implant.

Attackers have historically targeted hardware interfaces e.g. key-loggers or video-loggers and

therefore, docking stations are the next logical technological development, as they are normally

permanently connected to a power supply and also to the network. Furthermore, in a modern hot-

desking environment a dock-based implant has the potential to attack different target laptops each

day. As more and more network services are protected with strong encryption by default, the ability

the intercept data at the endpoint i.e. a laptop either after it has been decrypted or before it has been

encrypted is the most attractive property of this attack approach.

There are a number of different interfaces that attackers would be interested in targeting via a

docking station; these include:

 Network data – sensitive data sent using unencrypted network services

 Video – screenshots of the laptop screen could reveal sensitive data

 Audio – If softphones are in use then conversations could be monitored

 Keyboard – keystrokes could be captured or potentially inserted

 Webcams – Video-conferencing sessions could be monitored

There are a number of potential techniques for detecting various elements of hardware implants,

some more effective than others. However, the most effective detection process would most likely

involve a combination of different approaches, ranging from technical techniques such as detecting

the hardware “downgrade attack” required for passive Ethernet sniffing in combination with more

physical techniques such as the use of a Thermal Imaging camera.

By far the easiest and most effective approach to prevention is physical security. Locks should be

used to prevent docking stations from being substituted and the use of anti-tamper stickers, which

can reveal that a docking station has been subject to unauthorised opening.

1 2 ... 21 22 23 24 25 26 27

No comments

Dell E-Port Plus User Manual Page 26