Re: Odd that there were network ports available inside the secure area
Thank you, Stoneshop. Indeed, why would you park a monitor in the ceiling when you would have to sit on a ladder, or get into the ceiling, to use it?! Far more likely the remote access, or a mobe, but also consider a secret KVM cable drop from the illicit host and you use it from the keyboard, screen, and mouse of the nearby "legit" system? Guard coming, switch to the safe host, once clear, switch back. So easy and cheap.
And as to the network connection; if those are home runs from a router, then you can piggyback any number of extra hosts on that wire, no problem, other than having your MAC addr and traffic view-able from any monitoring of it, or if the connections are individually secured. It also would have been safer to host a WiFi hotspot in the overhead, with remote power or a timer to keep it offline while not in use. If not, then you could hijack two spare pairs of wires in an Ethernet run (many have four pair, but only use two), and have it double back several times in another area so you can have time to spot anyone searching for your rig via the wiring. Still, what a great hack!
Biting the hand that feeds IT
