As an IT admin, what can I do to countermeasure an attack performed like this page explains? http://www.pivpn.net/2015/08/hide-your-ass-hide-by-mac-address-and.html

What they do is to put a raspberry pi running SSL VPN software on the inside of the office network with a virtual interface connecting to a cloud server with a dynamic DNS name. The external VPN client then connects to the cloud server too, linking up with the virtual interface.

The interface on the raspberry is blocking all incoming traffic except the created link from the VPN server to the cloud.

Of course, this means that they have access to your network, but as far as I can see, nmap is not figuring it out.

  • 3
    This isn't an attack, but merely plugging in an unauthorized computer on the network. – schroeder Aug 13 '15 at 14:35
  • A per router MAC white list, but that could be tedious. Unauthorized MAC turn port OFF. Now they have to call IT and explain themselves to get it back ON. – cybernard Aug 14 '15 at 20:25
  • Depending of the legal context and the company policy, this can be considered a criminal attack. For example such a rogue VPN router can be used to punch the network firewall and spy on the company traffic from the inside. – dan Oct 12 '15 at 19:33

The best way to mitigate this attack is likely to have good knowledge of the systems on your internal network and control access as much as possible.

One common way to address this is to make use of things like 802.1x authentication for endpoints, such that connecting a rogue system to the network will not provide an IP address and the connectivity that this attack would require.

You could also introduce authentication for web traffic on a proxy server and block all unauthenticated attempts to get access.

Also you could do monitoring of your Internet traffic to look for unusual traffic patterns. A node maintaining a VPN would be sending traffic 24/7 so should show up as anomalous if it was placed in a location that generally only had users present from 9-5 say.

As with all things security, there is no one measure that would prevent this but you can make it harder for attackers to execute, and give yourself more opportunities to detect it.


You can't analyze or countermeasure the connection of a rogue VPN router within your network with a sniffer. All the traffic (after the VPN build) is crypted.

You have 2 levels of action to engage in this order.

Legal defense

You have to define if this connection within your network is:

  • legal and hence managed,
  • illegal and then fought to all extents (warn then attack).

Technical defense

See: Rory McCune answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.