Dell E-Port Plus User Manual download pdf (Page 11)

5 What would a hardware implant do?

There are a number of attacks that could be performed from a docking station; these are each

described in this section, but at a high level the requirements for a hardware implant in this scenario

are as follows:

• Capture data from connected laptop via interfaces

• Insert data, emulating devices

• Exfiltrate stolen data via an out-of-band channel

• Identify when different laptops are connected

• Remain as stealthy as possible

5.1 Network tapping

The most obvious attack is passive network sniffing. The circuit shown in Figure 12 (designed by

Michael Ossmann

[14]

) shows how this can be achieved (note that there are two tap points one for

traffic flowing in each direction). The obvious benefit of this approach is stealth, as the monitoring

implant will not be visible as a network-connected device:

Figure 12: Passive Ethernet tap

1 2 ... 6 7 8 9 10 11 12 13 14 15 16 ... 26 27

No comments

Dell E-Port Plus User Manual Page 11