Same. I built one in the late 90s as a pen test project. It only had network support, no wifi, but you could plug it in anywhere and it would arpflood and then passive listen for everything, before running through some rules on what to keep and then sending it back to a dump box (and saving it to disk).
I was part way through setting it up to spoof as an active directory backup (or primary auth server) before we had the
plug pulled.
Did two real pentests with it. Went back to the client with a list of 90% of their passwords and hundreds of web account authentication details (shopping sites, email, amazon, slashdot, etc.).
I'd love to build one again today. Battery powered and a lot smaller than what is seen in that Ars article. They would be so cheap that it wouldn't be worth retrieving - just letting them run for a week and being able to reverse shell into it to control it.
Hacking an android phone would be good for this. remove the screen and get 10+ days of battery life of just the OS running (remove bluetooth, etc.). package it as something that looks innocent of place it under carper or in a void space in a wall.
I was part way through setting it up to spoof as an active directory backup (or primary auth server) before we had the plug pulled.
Did two real pentests with it. Went back to the client with a list of 90% of their passwords and hundreds of web account authentication details (shopping sites, email, amazon, slashdot, etc.).
I'd love to build one again today. Battery powered and a lot smaller than what is seen in that Ars article. They would be so cheap that it wouldn't be worth retrieving - just letting them run for a week and being able to reverse shell into it to control it.
Hacking an android phone would be good for this. remove the screen and get 10+ days of battery life of just the OS running (remove bluetooth, etc.). package it as something that looks innocent of place it under carper or in a void space in a wall.