-1

Scenario

An attacker successfully infiltrates the LAN and infects a device that acts as a future bridge. Once inside, the infected device can communicate with a malicious source outside of the local area network. We assume that only one device is infected and that the malware is located anywhere in the computer but it's unable to migrate to other devices in the same LAN. I'd imagine that the tools available today are much more sophisticated and can probably spread across devices by itself, in this case you can provide an answer with this alternative scenario described.

Security Measures

The scenario should be realistically simulated which means that there are some security measures put in place, like there are in most homes today. In this case, the scenario described that the attacker was already inside and had successfully infected a device, which means that the security measures were penetrated.

Question

The infected device is turned off and the power input is active. Can the infected device still function as an access-point from the outside of the LAN?

If so, what measures are needed to completely cut off the malicious communication?

  • 1. What do you mean by "it's unable to migrate to other devices in the same LAN"? That the malware is not able to spread to another device? From what you are describing it sounds like, the device itself can't migrate. 2. What exactly do you mean by device? This term is quite ambiguous. – Tom K. Nov 23 '17 at 12:39
  • Post was edited to clarify what was described. What I mean by device can be understood here [ux.stackexchange.com/questions/89876/… – windows1234 Nov 23 '17 at 12:48
  • Homework question by any chance? – motosubatsu Nov 23 '17 at 13:06
  • "The infected device is turned off and the power input is active" - if the power input is active or if the device is battery powered it might look off but can still be somehow on. But, this depends on the specific device, especially if the off-switch is software-only or what does it actually do even in case of real hardware. – Steffen Ullrich Nov 23 '17 at 13:08
  • 2
    Does the device support wake-on-LAN? If so, it could be booted up again by a suitable network packet. – Simon B Nov 23 '17 at 14:35
4

Some devices support Wake-on-LAN, which allows a magic packet to power up a device. In order to do this for malicious purposes, there would need to be another insider that turns the infected system back on.

If the device is infected and displays malicious behavior, it could very well change boot settings (if available) to automatically turn on at a certain time. It could also simply enter a low-power mode when you attempt to shut it off, without actually turning it off. If it truly is off, then it cannot execute code at all, including malicious code.

The best mitigation is to ensure it is powered off or physically lacks any network connection. It is unsafe to use a malicious device, especially if it is on your LAN or any other privileged network. It could attack other devices (such as insecure routers), and perform general lateral movement.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.