Found This Plugged Into Network in Outdoor Display: No one knows why

Posted by TheFoxesMeow@reddit | sysadmin | View on Reddit | 34 comments

Hey everyone, I have a mystery for you! I found a device plugged into the internal network of a commercial store. Looks like someone broke into outdoor display in a drive through and installed it, no one knows when or why. It's not my environment so I'm not investigating it, I'll let the cooperation do that. Long story short. Router plugged with wan port to corporate network. USB dongle plugged into router. What does everyone think? Free wifi? Hacking? An interesting find! Here's the imgur [link](https://imgur.com/YN9b8aV) to the pictures

Reply to Post

Reply

34 Comments

[-]

jesusfuckngchrist@reddit

I'll bet it counts how many Bluetooth devices are in the area and reports back how busy the business is

Reply

[-]

TheFoxesMeow@reddit (OP)

A lot of store chains have devices that look at your wifi, Bluetooth Mac, and imic then create profiles about you in databases. Some triangulate where you are in the store, how long you're there, and then it compres that to your receipt at checkout. Others look at when you enter and leave stores. It's all "anonymous" leaked info from your phone. There's an exact term for the devices and process. It's one of those projects they don't tell many ppl about. They don't use openwrt devices with a Bluetooth USB for that. It's an entire system you buy into depending on how much info you want. They usually piggy back with their free wifi outside of the door scanner which grabs significantly more into.

Reply

[-]

zeroibis@reddit

Likely that they were trying to be on the same network as the POS systems in order to try to steal CC data from the machines.

Reply

[-]

TheFoxesMeow@reddit (OP)

I don't think the systems are separated. You'd be amazed how these multi-million and billion $$$ corporations handle things. Same passwords across the entire environment on every computer and the password is like.... H@mb3rg3r5! for a burger place or SummerFling2007 Those are not ones I've actually seen, but it gives you a good idea how things are. Passwording your stuff like it's 2003.

Reply

[-]

ThenCard7498@reddit

Certain fast food chain who has had their POS code leaked?

Reply

[-]

TheFoxesMeow@reddit (OP)

The code is pretty standard. It's a Toshiba lane with Toshiba software customized to the chain. There's no real original parts to the software except the graphics and menus.

Reply

[-]

graph_worlok@reddit

Those gl.Inet devices are great for “network fun” - they come with OpenWRT from the factory, so the software capability is “pocket sized linux system” rather than “cheap router” ( As seen in Mr Robot, even…) The Bluetooth device is an interesting choice - there’s an internal serial port for console access / device recovery, the Bluetooth device would likely need the OS to be booted up (some adaptors will talk straight serial but cost more than the router) I’d love to be a fly on the wall during the investigation - I’ve used gl.inet devices for all sorts of things.. it’s easy enough to configure as a wifi client or AP, or both…

Reply

[-]

BourbonXenon@reddit

It's a GLinet travel router. The 2g port is for the 2gbe port it's plugged into. It's most likely being used as a drop box. The person connects to the WAP and can (most likely) try to pop the POS system. The BT dongle might be a clever way for the person to enable/disable the AP or they may just be using it to sniff BT traffic as well.

Reply

[-]

TheFoxesMeow@reddit (OP)

Best answer so far. Good on you sir!

Reply

[-]

TheFoxesMeow@reddit (OP)

Gotcha. Some POS systems use Bluetooth to communicate also, so it might be a generic setup to cover all bases.

Reply

[-]

adamtmcevoy@reddit

Have you checked what the usb device is? Does the router have power?

Reply

[-]

TheFoxesMeow@reddit (OP)

The router was POE and had power. Wan connected to the corporate side if the network. I don't know what the USB device is.

Reply

[-]

adamtmcevoy@reddit

Was this on the same network as anything that dealt with payments or had and transaction details? Massive red flag if so.

Reply

[-]

TheFoxesMeow@reddit (OP)

Yes it was. We're talking, likely, 600k-3 million in sales a week. Large food chain that can print their own money.

Reply

[-]

adamtmcevoy@reddit

Oh dear. Someone fucked up if that switch port wasn’t MAC address restricted.

Reply

[-]

TheFoxesMeow@reddit (OP)

It's not. It's connected to an unmanaged Netgear switch.

Reply

[-]

zeroibis@reddit

>unmanaged Netgear switch. Sounds like no network segmentation and a possible PCI violation. Those POS machines should not be sharing a network with anything if I understand correctly.

Reply

[-]

TheFoxesMeow@reddit (OP)

I'm not sure how the backend and database works TBH. I know they all have the same class c addresses and, from what I've seen, there's no separation. After you wrote this, I think you're right. I might hook up my notebook and do a quick ping test next time and see if I can ping a POS till. Now I'm curious. The fact that a router could be connected to a network for who knows how long and no one noticed a bit of concern. Unless it was supposed to be there, but no one knows.

Reply

[-]

Stryker1-1@reddit

I'm going to guess someone used this to console into the device and forgot to remove it.

Reply

[-]

ruyrybeyro@reddit

If I had to guess, it would be a mouse adapter, strange finding it plugged into a router though.

Reply

[-]

TheFoxesMeow@reddit (OP)

[This was the usb](https://www.silabs.com/wireless/bluetooth/bluegiga-low-energy-legacy-modules/device.bled112) Seems like it does com over Bluetooth for programming purposes.

Reply

[-]

Marrsvolta@reddit

If it does come over bluetooth then it would essentially be a wireless ssh connection to that router. Whoever was using that router could have been using bluetooth to ssh in and configure/manage/get logs off the router that way.

Reply

[-]

karateninjazombie@reddit

Have you examined the router for.traces of who it might be in the config? Maybe there is Mac address.tables to look at? Also what's the black usb stick plugged into the ap?

Reply

[-]

TheFoxesMeow@reddit (OP)

No, I'm a contractee. It's possibly a police matter, I'm not going to mess around with it especially because it's not my job. The media player and switch got wet because someone pried the back panel open, broke bolts, and bent the panel with the hermetic seal. Then reattached the back panel with bolts that are not to the enclosure. I'm assuming this person? The store chain has a netsec department. If they deem it an issue, they will investigate and get into contact with the police

Reply

[-]

karateninjazombie@reddit

Fair enough. All you can do is your due diligence and hand it off appropriately.

Reply

[-]

Citizen493@reddit

Possible man in the middle attack? Users connect to the "free" WiFi provided by the router with custom firmware and all captured data is logged to the usb storage.

Reply

[-]

Adimentus@reddit

Probably more for recon unless it's been there a long time. Little bit of packet sniffing and IP/MAC getting.

Reply

[-]

TheFoxesMeow@reddit (OP)

Interesting. If they constantly changed the wan ip address and spoofed Mac addresses of POS computers, that might do it. My home network. I had someone from the WAN use a 192 address and try to connect ssh/web to my router. That was an interesting day.

Reply

[-]

BasicallyFake@reddit

is that how they remotely manage the display?

Reply

[-]

TheFoxesMeow@reddit (OP)

No. They have industrial PCs connected via HDMI directly to the display. It was plugged into the same switch that this device was.

Reply

[-]

moderatenerd@reddit

I have seen dummy usb drives plugged into ports before with no discernible purpose or function before. My guess is to protect the port from elements during travel/transport or being outside.

Reply

[-]

TheFoxesMeow@reddit (OP)

The entire wireless router shouldn't be plugged into the network.

Reply

[-]

moderatenerd@reddit

Weird. I wonder what type of data you can get from a drive through window. Maybe there are known vulnerabilities in them. Which wouldn't surprise me

Reply

[-]

TheFoxesMeow@reddit (OP)

The entire network doesn't have a vlan from what I know with the only exception likely being the debit/credit machines. The POS computers are likely on the same network as the displays. Also, the displays have industrial computers that are connected back to a very large corporation that handles signs across multiple corporations like McDonald's (this was not a McDonald's, but a very large chain).

Reply