EEVblog Electronics Community Forum

Electronics => Projects, Designs, and Technical Stuff => Topic started by: R005T3r on June 25, 2016, 11:55:07 am

Title: Simple Ethernet killer switch.
Post by: R005T3r on June 25, 2016, 11:55:07 am
Hi,

After many times that I plug/unplug the ethernet socket of my pc, I've decided to make a project for doing it directly from my desk, pressing a button or via a switch.

I've also seen some other projects on the net, but many of them do not satisfy me: they plug the orange wire on a switch, but that's not what I'm looking for, because I would rather have something that is close to air gap. To make it short, i've decided to:
1. use an octal buffer tri-state device like the Texas Instruments 54AC541
2. a switch
3. power the driver via ethernet: ethernet standard plugs can be used to power up the chip, as a result the device would be plug and play.

Why I didn't opted for Arduino Instead? Well, considered this kind of application, using a microcontroller would be a waste. Relays costs a lot of money, and they also require a lot of current to work. and that's not their primary use.

Since this is my first project with buffer tri-state, I've found that they can be configured to be used as switches, but when the chip works in the high impedence zone, would it be enough to stop traffic data?Is there any better solution?
Title: Re: Simple Ethernet killer switch.
Post by: jtstowell on June 25, 2016, 12:03:24 pm
A $20 5-port unmanaged Gig-Ethernet switch plugged into a separate switchable power outlet might be a cleaner solution. Run your connection through that, and then cut power when you want to disconnect. It won't offer the same debugging opportunities, though.  ;D
Title: Re: Simple Ethernet killer switch.
Post by: wraper on June 25, 2016, 12:05:40 pm
1. use an octal buffer tri-state device like the Texas Instruments 54AC541
Excuse me, but how such IC has any chance to help you with your goal?

Do you really need to unplug Ethernet at all?
http://stackoverflow.com/questions/19021466/disabling-ethernet-connection-with-command-line (http://stackoverflow.com/questions/19021466/disabling-ethernet-connection-with-command-line)
Title: Re: Simple Ethernet killer switch.
Post by: rs20 on June 25, 2016, 12:06:26 pm
Do you want to run at 10 Mbps? 100? 1 Gbps?

Why is switching the orange wire not good enough? An off switch is an air gap.

Your requirements only make sense if a hacker can hack into your ADSL modem and convince it to communicate on wires other than the orange wire. I suspect this is an unreasonable assumption, and easily tested.

Have you considered shorting out the wires, rather than trying to open them? A switch on the line must actually carry the data. A switch across the lines just has to have a low enough off capacitance to not disturb the signal, a much easier task.

A $20 5-port unmanaged Gig-Ethernet switch plugged into a separate switchable power outlet might be a cleaner solution. Run your connection through that, and then cut power when you want to disconnect. It won't offer the same debugging opportunities, though.  ;D

Forgot everything I said, this is an even better solution.
Title: Re: Simple Ethernet killer switch.
Post by: uncle_bob on June 25, 2016, 12:28:33 pm
Hi

A lot depends on what you really are trying to do and why.

There is no solid state device that is more reliable or more of an "air gap" than a toggle switch. The fewer parts in a system, the easier it is to make sure it all is correct (no sneak paths). If the purpose is positive verification that you are off the net, a switch is as close to a physical disconnect (unplug) as you will ever get. If you are dealing with nuclear missile launch codes, the toggle switch likely isn't adequate.

If you have a modern computer and are concerned about intrusion, there a a *lot* of ways to get into most of them. As a minimum, some sort of faraday cage arrangement probably is called for to fully disconnect one. That will involve a lot more than a switch.

If security is the issue, there are a lot of things you need to consider that are *much* higher up on the list than Ethernet disconnect.

Bob

Title: Re: Simple Ethernet killer switch.
Post by: jtstowell on June 25, 2016, 12:34:07 pm
Indeed. Absolute security is a bit of a pipe dream.  :scared:

As practitioners we aspire to "good enough."
Title: Re: Simple Ethernet killer switch.
Post by: R005T3r on June 25, 2016, 02:40:48 pm
A $20 5-port unmanaged Gig-Ethernet switch plugged into a separate switchable power outlet might be a cleaner solution. Run your connection through that, and then cut power when you want to disconnect. It won't offer the same debugging opportunities, though.  ;D
Nah, not a good solution to me: I've already organized the stuff in a way that there's not a good way without re-arranging everything else, unless, there's a tiny 2 way switch, but I would probably need another plug on the wall...

That is more than $20, if you count that I have to buy the switch and adding antoher plug. That's why I want it plug and play.
Also, considered that I have pretty much anything other than the chip, that would be the cost of the chip only...
Title: Re: Simple Ethernet killer switch.
Post by: jeroen79 on June 25, 2016, 02:53:03 pm
What are you trying to achieve?
Why are you plugging and unplugging your ethernetplug so many times?

If you find switching one wire insufficient then you could just use a switch with more poles to switch whatever wire you wish.
Or use a suitable relay if you want to do it remotely.
Title: Re: Simple Ethernet killer switch.
Post by: uncle_bob on June 25, 2016, 02:53:51 pm
A $20 5-port unmanaged Gig-Ethernet switch plugged into a separate switchable power outlet might be a cleaner solution. Run your connection through that, and then cut power when you want to disconnect. It won't offer the same debugging opportunities, though.  ;D
Nah, not a good solution to me: I've already organized the stuff in a way that there's not a good way without re-arranging everything else, unless, there's a tiny 2 way switch, but I would probably need another plug on the wall...

That is more than $20, if you count that I have to buy the switch and adding antoher plug. That's why I want it plug and play.
Also, considered that I have pretty much anything other than the chip, that would be the cost of the chip only...

Hi

The problem with the chip is that it is not going to work for what you want to do.

Bob
Title: Re: Simple Ethernet killer switch.
Post by: Ian.M on June 25, 2016, 03:01:43 pm
http://www.dx.com/p/mini-2-port-rj45-manual-network-switch-white-58286 (http://www.dx.com/p/mini-2-port-rj45-manual-network-switch-white-58286)
Title: Re: Simple Ethernet killer switch.
Post by: R005T3r on June 25, 2016, 03:06:16 pm
1. use an octal buffer tri-state device like the Texas Instruments 54AC541
Excuse me, but how such IC has any chance to help you with your goal?

Do you really need to unplug Ethernet at all?
http://stackoverflow.com/questions/19021466/disabling-ethernet-connection-with-command-line (http://stackoverflow.com/questions/19021466/disabling-ethernet-connection-with-command-line)

This chip here has this design here:
(http://circuits.datasheetdir.com/102/54AC541-pinout.jpg)
So, From I0 to I7 goes the ethernet in, to O 0-07 goes the output line. pin 1 and pin 19 are the control signals that open and closes the tri-states. What is really interesting about this IC is that actually all the eight tri-states are interconnected, as a result with a single toggle you can command all of them at once.
Title: Re: Simple Ethernet killer switch.
Post by: R005T3r on June 25, 2016, 03:07:55 pm
A $20 5-port unmanaged Gig-Ethernet switch plugged into a separate switchable power outlet might be a cleaner solution. Run your connection through that, and then cut power when you want to disconnect. It won't offer the same debugging opportunities, though.  ;D
Nah, not a good solution to me: I've already organized the stuff in a way that there's not a good way without re-arranging everything else, unless, there's a tiny 2 way switch, but I would probably need another plug on the wall...

That is more than $20, if you count that I have to buy the switch and adding antoher plug. That's why I want it plug and play.
Also, considered that I have pretty much anything other than the chip, that would be the cost of the chip only...

Hi

The problem with the chip is that it is not going to work for what you want to do.

Bob
Why?
Title: Re: Simple Ethernet killer switch.
Post by: MK14 on June 25, 2016, 03:15:31 pm
1. use an octal buffer tri-state device like the Texas Instruments 54AC541
Excuse me, but how such IC has any chance to help you with your goal?

Do you really need to unplug Ethernet at all?
http://stackoverflow.com/questions/19021466/disabling-ethernet-connection-with-command-line (http://stackoverflow.com/questions/19021466/disabling-ethernet-connection-with-command-line)

This chip here has this design here:
(http://circuits.datasheetdir.com/102/54AC541-pinout.jpg)
So, From I0 to I7 goes the ethernet in, to O 0-07 goes the output line. pin 1 and pin 19 are the control signals that open and closes the tri-states. What is really interesting about this IC is that actually all the eight tri-states are interconnected, as a result with a single toggle you can command all of them at once.

So that chip will handle the 5 different voltages then ?
(For clarity, I'm being sarcastic here)

tl;dr
It's a complicated very high frequency signal, which I doubt you can easily handle.

(http://www.rwmonline.org/Metrotek/SC/pics/PAM5.gif)
Title: Re: Simple Ethernet killer switch.
Post by: wraper on June 25, 2016, 03:22:42 pm
So, From I0 to I7 goes the ethernet in, to O 0-07 goes the output line. pin 1 and pin 19 are the control signals that open and closes the tri-states. What is really interesting about this IC is that actually all the eight tri-states are interconnected, as a result with a single toggle you can command all of them at once.
But why do you think cmos logic IC will work with ethernet signals  :palm:?
Title: Re: Simple Ethernet killer switch.
Post by: bktemp on June 25, 2016, 03:28:16 pm
You need an analogue switch, something like this one:
https://www.fairchildsemi.com/products/analog-mixed-signal/switches/analog-switches/FSAL200.html (https://www.fairchildsemi.com/products/analog-mixed-signal/switches/analog-switches/FSAL200.html)

Or much simpler: A small signal relay.
Title: Re: Simple Ethernet killer switch.
Post by: Delta on June 25, 2016, 03:33:12 pm
Why?

 :palm:

Ethernet is a differential signalling system using multiple voltage levels.  That's why.  Have you done any research at all?

Just use a switch to short a pair or two if you really need to do this...
Title: Re: Simple Ethernet killer switch.
Post by: uncle_bob on June 25, 2016, 03:52:08 pm
A $20 5-port unmanaged Gig-Ethernet switch plugged into a separate switchable power outlet might be a cleaner solution. Run your connection through that, and then cut power when you want to disconnect. It won't offer the same debugging opportunities, though.  ;D
Nah, not a good solution to me: I've already organized the stuff in a way that there's not a good way without re-arranging everything else, unless, there's a tiny 2 way switch, but I would probably need another plug on the wall...

That is more than $20, if you count that I have to buy the switch and adding antoher plug. That's why I want it plug and play.
Also, considered that I have pretty much anything other than the chip, that would be the cost of the chip only...

Hi

The problem with the chip is that it is not going to work for what you want to do.

Bob
Why?

Hi

In addition to all that has been said above:

1) They are floating AC signals and not referenced to a ground.

2) You seem to be concerned about something that drives you to disconnect the Ethernet. Breaking the signals over to a grounded system messes up all sorts of RF things about them. That makes them easier to intercept and or piggyback on to.

Yes there are more gotchas as well ...

Bob
Title: Re: Simple Ethernet killer switch.
Post by: joeqsmith on June 25, 2016, 03:55:13 pm
I am curious myself.   

What are you trying to achieve?
Why are you plugging and unplugging your ethernetplug so many times?

If you find switching one wire insufficient then you could just use a switch with more poles to switch whatever wire you wish.
Or use a suitable relay if you want to do it remotely.
Title: Re: Simple Ethernet killer switch.
Post by: R005T3r on June 25, 2016, 05:18:20 pm
Ok guys.... Sorry I'm just a beginner in electronics, I was assuming by given that Ethernet signaling was the classical digital 1/0 V system, I've hadn't any idea that there were 5 different voltages... Now, the chart above, explains a lot of things, that I didn't knew.

That said,  the best solution is:

http://www.dx.com/p/mini-2-port-rj45-manual-network-switch-white-58286 (http://www.dx.com/p/mini-2-port-rj45-manual-network-switch-white-58286)

Don't cost that much and so I don't have to mess up with Ethernet signaling and all that stuff...
Title: Re: Simple Ethernet killer switch.
Post by: Delta on June 25, 2016, 05:28:53 pm
Ok guys.... Sorry I'm just a beginner in electronics, I was assuming by given that Ethernet signaling was the classical digital 1/0 V system, I've hadn't any idea that there were 5 different voltages... Now, the chart above, explains a lot of things, that I didn't knew.

That said,  the best solution is:

http://www.dx.com/p/mini-2-port-rj45-manual-network-switch-white-58286 (http://www.dx.com/p/mini-2-port-rj45-manual-network-switch-white-58286)

Don't cost that much and so I don't have to mess up with Ethernet signaling and all that stuff...

Yeah, that's the way forward if you feel you need to do this mate.

But NEVER assume anything.  At least to a quick google or read the wiki article...
Title: Re: Simple Ethernet killer switch.
Post by: uncle_bob on June 25, 2016, 05:31:25 pm
Ok guys.... Sorry I'm just a beginner in electronics, I was assuming by given that Ethernet signaling was the classical digital 1/0 V system, I've hadn't any idea that there were 5 different voltages... Now, the chart above, explains a lot of things, that I didn't knew.

That said,  the best solution is:

http://www.dx.com/p/mini-2-port-rj45-manual-network-switch-white-58286 (http://www.dx.com/p/mini-2-port-rj45-manual-network-switch-white-58286)

Don't cost that much and so I don't have to mess up with Ethernet signaling and all that stuff...

Hi

Since we still don't have the slightest idea what you actually are trying to do ... there still may be a lot of important gaps that are not being addressed.

One possible gap:

Are you running 10 megabit ethernet (as in 1970's speeds) or something much faster? (as in your computer is < 20 years old).

Any time you mess with the wires in a ethernet cable, you create an impedance bump. That mismatch will degrade the signal to noise on the line and possibly introduce cross talk between the pairs. Put more simply - it adds a lot of noise.  The switch you show may be fine for 10 megabit. It may be a disaster in some modern setups.

Bob
Title: Re: Simple Ethernet killer switch.
Post by: Ian.M on June 25, 2016, 05:44:10 pm
Chances are it will do 100 Megabit if the total cable length through it back to the 'hub' (actually active Ethernet switch) is a small fraction of the 100m permitted.  I wouldn't expect it to work for Gigabit Ethernet.  Its cheap enough to try anyway.

As to why to use one to physically isolate the network?  Well, if you frequently need to air-gap the PC, (e.g. when changing Antivirus or security programs) and both the back of the PC and the RJ45 wall socket are awkward to get at, or if the O.P. has a disability that makes unplugging/replugging a cable difficult, it makes sense to me.
Title: Re: Simple Ethernet killer switch.
Post by: joeqsmith on June 25, 2016, 05:51:03 pm
Why not just disable the card from software?   I was thinking they may be testing a new design and were looking for other problems with their stack design.  Again, no clue.  OP what's up?  Just playing?

As to why to use one to physically isolate the network?  Well, if you frequently need to air-gap the PC, (e.g. when changing Antivirus or security programs) and both the back of the PC and the RJ45 wall socket are awkward to get at, or if the O.P. has a disability that makes unplugging/replugging a cable difficult, it makes sense to me.
Title: Re: Simple Ethernet killer switch.
Post by: R005T3r on June 25, 2016, 05:59:06 pm
Ok guys.... Sorry I'm just a beginner in electronics, I was assuming by given that Ethernet signaling was the classical digital 1/0 V system, I've hadn't any idea that there were 5 different voltages... Now, the chart above, explains a lot of things, that I didn't knew.

That said,  the best solution is:

http://www.dx.com/p/mini-2-port-rj45-manual-network-switch-white-58286 (http://www.dx.com/p/mini-2-port-rj45-manual-network-switch-white-58286)

Don't cost that much and so I don't have to mess up with Ethernet signaling and all that stuff...

Hi

Since we still don't have the slightest idea what you actually are trying to do ... there still may be a lot of important gaps that are not being addressed.

One possible gap:

Are you running 10 megabit ethernet (as in 1970's speeds) or something much faster? (as in your computer is < 20 years old).

Any time you mess with the wires in a ethernet cable, you create an impedance bump. That mismatch will degrade the signal to noise on the line and possibly introduce cross talk between the pairs. Put more simply - it adds a lot of noise.  The switch you show may be fine for 10 megabit. It may be a disaster in some modern setups.

Bob


It's a modern setup, made just 6 months ago. Gigabit ethernet cable consider that transfers are about 60-80MB/s....
Title: Re: Simple Ethernet killer switch.
Post by: Monkeh on June 25, 2016, 06:03:21 pm
And just to chime in and ask the same question you've ignored numerous times now: Why do you need to keep disconnecting it?
Title: Re: Simple Ethernet killer switch.
Post by: Jeroen3 on June 25, 2016, 06:28:40 pm
Classic XY-problem (http://xyproblem.info/), or is there something special in why you want to "unplug"?
Are you writing device drivers? Or maybe an ethernet device?
I'd guess not, you'd have known ethernet used differential signalling with transformers.

Disabling the network adapter on any modern operating system works like this:
Code: (Windows) [Select]
netsh interface set interface name="Local Area Connection" admin=enable
netsh interface set interface name="Local Area Connection" admin=disable
Code: (Linux) [Select]
ifconfig eth0 up
ifconfig eth0 down
These should persist on reboot. Not recommended for servers.
You'd need to be root to do this, obviously.
Title: Re: Simple Ethernet killer switch.
Post by: joeqsmith on June 25, 2016, 06:41:30 pm
I was guessing they were a software type and had no clue about the hardware. 

Classic XY-problem (http://xyproblem.info/), or is there something special in why you want to "unplug"?
Are you writing device drivers? Or maybe an ethernet device?
I'd guess not, you'd have known ethernet used differential signalling with transformers.

Disabling the network adapter on any modern operating system works like this:
Code: (Windows) [Select]
netsh interface set interface name="Local Area Connection" admin=enable
netsh interface set interface name="Local Area Connection" admin=disable
Code: (Linux) [Select]
ifconfig eth0 up
ifconfig eth0 down
These should persist on reboot. Not recommended for servers.
You'd need to be root to do this, obviously.
Title: Re: Simple Ethernet killer switch.
Post by: jtstowell on June 25, 2016, 07:08:18 pm
There is also the other kind of ethernet killer. This one isn't mine, but I did wire up one of these at one point. It turned up recently.

Never had the guts to try it out...
Title: Re: Simple Ethernet killer switch.
Post by: Jeroen3 on June 25, 2016, 07:10:34 pm
You could always use a power over ethernet insertion cable as shown above to permantenly disable your ethernet adapter.
Title: Re: Simple Ethernet killer switch.
Post by: steverino on June 25, 2016, 07:41:57 pm
And just to chime in and ask the same question you've ignored numerous times now: Why do you need to keep disconnecting it?
It's a secret the OP wants to take to his grave.
Title: Re: Simple Ethernet killer switch.
Post by: MK14 on June 25, 2016, 07:55:47 pm
And just to chime in and ask the same question you've ignored numerous times now: Why do you need to keep disconnecting it?
It's a secret the OP wants to take to his grave.

If I take the liberty of explaining WHY, despite me NOT being the OP.
Disclaimer: Since I'm NOT the OP, I could be completely WRONG.

I think he is worried about some of the rumored, backdoor(s) that are implemented in (some) Intel cpus. He is especially concerned that they may be activated at some point, and cause issues. Hence by keeping the PC air-gaped/isolated, most of the time, he believes it will protect him. There is also concerns about keyloggers and things.

On pain of death, I will NOT ever reveal my source here (which was looking at his past posts, about his concerns about these issues).
Title: Re: Simple Ethernet killer switch.
Post by: jtstowell on June 25, 2016, 09:16:49 pm
It's fascinating, as a thought experiment, to consider the ramifications of such things. Building a SCIF might be a fun hobby.
Title: Re: Simple Ethernet killer switch.
Post by: Monkeh on June 25, 2016, 09:17:25 pm
 :palm:
Title: Re: Simple Ethernet killer switch.
Post by: R005T3r on June 25, 2016, 09:19:23 pm
And just to chime in and ask the same question you've ignored numerous times now: Why do you need to keep disconnecting it?
It's a secret the OP wants to take to his grave.

If I take the liberty of explaining WHY, despite me NOT being the OP.
Disclaimer: Since I'm NOT the OP, I could be completely WRONG.

I think he is worried about some of the rumored, backdoor(s) that are implemented in (some) Intel cpus. He is especially concerned that they may be activated at some point, and cause issues. Hence by keeping the PC air-gaped/isolated, most of the time, he believes it will protect him. There is also concerns about keyloggers and things.

On pain of death, I will NOT ever reveal my source here (which was looking at his past posts, about his concerns about these issues).

And, you are actually wrong. That's not why I keep disconnecting the eth plug: this regards only a special pc I have... I'm a bit keen on saying why, because  it's not really seen well by the majority of people I know, and some other may actually misunderstand, so, it may be better not to say anything about it...
Title: Re: Simple Ethernet killer switch.
Post by: R005T3r on June 25, 2016, 09:27:39 pm
There is also the other kind of ethernet killer. This one isn't mine, but I did wire up one of these at one point. It turned up recently.

Never had the guts to try it out...

Actually This device you have does not do any damage: Pc boards are optically insulated between parts, as a result  it will only fry the controller if you are lucky. You have a better result with some coke poured on a pc board: after the thing dries it screw up everything because it conducts electricity.
Title: Re: Simple Ethernet killer switch.
Post by: Monkeh on June 25, 2016, 09:28:44 pm
There is also the other kind of ethernet killer. This one isn't mine, but I did wire up one of these at one point. It turned up recently.

Never had the guts to try it out...

Actually This device you have does not do any damage: Pc boards are optically insulated between parts

No, they're not, and yes, it does.

Quote
as a result  it will only fry the controller if you are lucky.

If it gets through to the controller, you've got a good chance of being totally screwed, not just partially.
Title: Re: Simple Ethernet killer switch.
Post by: jtstowell on June 25, 2016, 09:33:02 pm
Actually This device you have does not do any damage: Pc boards are optically insulated between parts, as a result  it will only fry the controller if you are lucky. You have a better result with some coke poured on a pc board: after the thing dries it screw up everything because it conducts electricity.

I can't speak for all ethernet adapters across all time, but I have seen the results of a lightening strike that traveled via LAN wiring to destroy not only network adapters but also attached motherboards.
Title: Re: Simple Ethernet killer switch.
Post by: Monkeh on June 25, 2016, 09:33:39 pm
Actually This device you have does not do any damage: Pc boards are optically insulated between parts, as a result  it will only fry the controller if you are lucky. You have a better result with some coke poured on a pc board: after the thing dries it screw up everything because it conducts electricity.

I can't speak for all ethernet adapters across all time, but I have seen the results of a lightening strike that traveled via LAN wiring to destroy not only network adapters but also attached motherboards.

Lightning's a little more of an extreme. Okay, it's just a few million volts difference, but still.
Title: Re: Simple Ethernet killer switch.
Post by: jtstowell on June 25, 2016, 09:38:45 pm
Lightning's a little more of an extreme. Okay, it's just a few million volts difference, but still.

 :-DD

21 adapters were fried, along with 7 motherboards and one hub. Yes, hub. This was a while ago. For the record, it wasn't my idea to put the hub in the ceiling...



Title: Re: Simple Ethernet killer switch.
Post by: uncle_bob on June 25, 2016, 10:22:14 pm
And just to chime in and ask the same question you've ignored numerous times now: Why do you need to keep disconnecting it?
It's a secret the OP wants to take to his grave.

If I take the liberty of explaining WHY, despite me NOT being the OP.
Disclaimer: Since I'm NOT the OP, I could be completely WRONG.

I think he is worried about some of the rumored, backdoor(s) that are implemented in (some) Intel cpus. He is especially concerned that they may be activated at some point, and cause issues. Hence by keeping the PC air-gaped/isolated, most of the time, he believes it will protect him. There is also concerns about keyloggers and things.

On pain of death, I will NOT ever reveal my source here (which was looking at his past posts, about his concerns about these issues).

And, you are actually wrong. That's not why I keep disconnecting the eth plug: this regards only a special pc I have... I'm a bit keen on saying why, because  it's not really seen well by the majority of people I know, and some other may actually misunderstand, so, it may be better not to say anything about it...

Hi

With a proper security on a PC, it is essentially nothing on a network other than as an ARP entry. That's true if it is connected for 100 ms or for a few decades.  Without a proper security the first time you connect ..... it does not matter that you disconnected it a few seconds later. Your trust in this switch approach is misplaced ....

Bob
Title: Re: Simple Ethernet killer switch.
Post by: rs20 on June 26, 2016, 12:12:44 am
...this regards only a special pc I have... I'm a bit keen on saying why, because  it's not really seen well by the majority of people I know, and some other may actually misunderstand, so, it may be better not to say anything about it...

Pr0n confirmed!
Title: Re: Simple Ethernet killer switch.
Post by: bitslice on June 26, 2016, 12:41:30 am
Pr0n confirmed!

Porn really should be kept on a shared drive, not an air gapped PC, that's just not polite.
Title: Re: Simple Ethernet killer switch.
Post by: steverino on June 26, 2016, 01:16:24 am
...this regards only a special pc I have... I'm a bit keen on saying why, because  it's not really seen well by the majority of people I know, and some other may actually misunderstand, so, it may be better not to say anything about it...

Pr0n confirmed!
That was my initial thought also, but I bit my tongue and didn't post.  Sorry R005T3r, but secrets generate rumors...
Title: Re: Simple Ethernet killer switch.
Post by: BradC on June 26, 2016, 01:51:38 am
Porn really should be kept on a shared drive

It's colloquially known as "the internet".
Title: Re: Simple Ethernet killer switch.
Post by: NiHaoMike on June 26, 2016, 02:15:50 am
Or a PC being used to "test drive" Windows 10 with its built in "insecurity"? I don't see any reason keeping a porn PC offline so long as the content is legal. (In fact, just to mess with the "spies", have a Windows 10 PC dedicated to legal porn, always online, with an Arduino Leonardo semi randomly sending commands to play a video.)
Title: Re: Simple Ethernet killer switch.
Post by: uncle_bob on June 26, 2016, 02:48:40 am
Hi

So we all have had our fun and are completely sure that we know exactly what it going on. There is of course zero percent chance that it could be anything else. Nobody anywhere *ever* has a machine full of "borrowed" CAD software .... do they? :)

Bob
Title: Re: Simple Ethernet killer switch.
Post by: bitwelder on June 26, 2016, 07:46:19 am
Porn really should be kept on a shared drive
It's colloquially known as "the internet".
Bonus points: you don't need to waste disk space in backups, you'll find others glad to do it for you.

Regarding the 2-port network clunky-switch: any chance that it can cause damages to the connected devices (e.g. shorting wires while switching ports) ?
Title: Re: Simple Ethernet killer switch.
Post by: Ian.M on June 26, 2016, 08:46:28 am
Regarding the 2-port network clunky-switch: any chance that it can cause damages to the connected devices (e.g. shorting wires while switching ports) ?
Probably not - it would take a special level of incompetence to design one using make-before-break switches - and twisted pair Ethernet interfaces are fairly robust, typically tolerating shorts to other Ethernet signals without damage.  I wouldn't want to use it with POE though!
Title: Re: Simple Ethernet killer switch.
Post by: R005T3r on June 26, 2016, 09:19:25 am
...this regards only a special pc I have... I'm a bit keen on saying why, because  it's not really seen well by the majority of people I know, and some other may actually misunderstand, so, it may be better not to say anything about it...

Pr0n confirmed!
That was my initial thought also, but I bit my tongue and didn't post.  Sorry R005T3r, but secrets generate rumors...

Alright, I'll tell you why:

No it's not p0rn-related. Actually I study malware and viruses and I collect them, see their effects on many different virtual machines, see what changes between OS and OS, Decompose the things and reverse engineer them(if I can). Actually When you see this:
(http://static1.squarespace.com/static/5005b20824ac859904565eaf/t/5290b992e4b05972446f96bd/1385216404178/CL_TaskMan.jpg)

And after 2 minutes this:
(http://www.iperiusbackup.net/wp-content/uploads/2016/03/cryptolocker-come-difendersi-backup.png)

And that's on your real pc(or worse, it has spread all over your LAN)... Hmmm... Yes, you need to reinstall everything. That's why I need a toggle to disconnect your ethernet, because in some of  these programs you can't really see the effects if you don't have Internet on. And, when it's cryptolocker is quite easy to get rid of: you just make backups (since you alredy know what you are dealing with) and you are fine, but when a boot-kit/root-kit break in your real pc or some adware spreads over your LAN, yes, you can imagine that's a real issue, so, even if it may happen, you can control your connections...

DISCLAIMER: Even if I study these things, this don't mean I write them or decompose them in order to create more dangerous variations and stuff like that, because first it's illegal and second if the program goes into the wrong hands, well you potentially have court-nuclear warhead already launched against you...

Also, that's why I posted That the "loudspeaker virus" is a hoax: never seen one before and loudspeakers are a bad way to communicate. There are way more efficient ways to spy or make harm...
Title: Re: Simple Ethernet killer switch.
Post by: Jeroen3 on June 26, 2016, 10:20:22 am
That is a legitimate reason to perform an unplug if you ask me.
You can't trust the operating system in this case.

There are a few things you should be aware of though:
- you can also use routers to prevent access to other parts of the network. Only internet access can be router.
- ISP's perform checks and quarantine procedures if they suspect you're spreading malware intentionally or unintentionally.
Title: Re: Simple Ethernet killer switch.
Post by: Delta on June 26, 2016, 10:51:46 am
A-ha!  So you are distributing your ransomware via porn sites eh?  Very clever!  That's why all 7 of my dedicated porn machines are all running Linux and behind a firewall.

Everyone's got to make a living, good luck to you, I say!
Title: Re: Simple Ethernet killer switch.
Post by: madires on June 26, 2016, 11:15:37 am
Since you're using VMs you could assign a VLAN to each virtual NIC instead of bridging it to the physical NIC of your host PC. Then setup your router/firefall for VLANs and isolate the networks, allow the VMs just to access the internet. That way you could also view the complete network traffic and/or log it (pcap) for analyzing it later on. Monitoring the network traffic gives you hints about how the malware communicates to control servers or tries to find other victims. Or you could place a victim VM into the same VLAN and watch what happens.
Title: Re: Simple Ethernet killer switch.
Post by: timb on June 26, 2016, 12:53:36 pm
Since you're using VMs you could assign a VLAN to each virtual NIC instead of bridging it to the physical NIC of your host PC. Then setup your router/firefall for VLANs and isolate the netwoks, allow the VMs just to access the internet. That way cou could also view the complete network traffic and/or log it (pcap) for analyzing it later on. Monitoring the network traffic gives you hints about how the malware communicates to control servers or tries to find other victims. Or you could place a victim VM into the same VLAN and watch what happens.

Ding ding ding! We have a winner! This is the way to do it. What I would do is pickup a cheap 5-port managed or semi-managed (aka "smart") switch, which, in addition to allowing you setup VLANs would also allow you to implement port mirroring. That allows you to use a WireShark on a second machine to inspect the traffic on a much lower level. You can grab a 5-port semi-managed GigE switch on Amazon for ~$30 that do exactly that. (Assuming your existing router doesn't allow VLANs and mirroring.)
Title: Re: Simple Ethernet killer switch.
Post by: bitslice on June 26, 2016, 01:05:29 pm
Router/firewall/switchs all may have their vulnerabilities, so I wouldn't rely on "hardware" to solve your security issue.
Attacks on home ISP routers are well known, and the NSA had quietly hacked Cisco's gear years before anyone even considered the possibility. 

It's therefore not above a virus's capabilities to force its way through your network, even onto your GPU's bios
Title: Re: Simple Ethernet killer switch.
Post by: uncle_bob on June 26, 2016, 01:30:15 pm
Hi

Ok, I'd call that a legit reason to go for some sort of separation. My concern would then be for things like WiFi and Bluetooth that are a bit less easy to shut off. I have enough confidence in a managed switch (properly set up and used) that I would go that route rather than a physical switch. The whole VM thing has a few issues as well ...

Bob
Title: Re: Simple Ethernet killer switch.
Post by: jtstowell on June 26, 2016, 02:36:22 pm
It would also be pretty wise to route all traffic from your malware research lab through a VPN service, or perhaps tor. (i.e., do you like DDoS attacks? because that's how you get DDoS attacks...)
Title: Re: Simple Ethernet killer switch.
Post by: NiHaoMike on June 26, 2016, 03:08:55 pm
My concern would then be for things like WiFi and Bluetooth that are a bit less easy to shut off.
If your "safe" machines are vulnerable to a compromised wireless device you own, they're also vulnerable to a "compromised" wireless device you do not own - i.e. one owned by an attacker.
Title: Re: Simple Ethernet killer switch.
Post by: joeqsmith on June 27, 2016, 03:55:53 am
OP, thanks for clearing that up.    I could see why you would not want to post that sort of info but it does make more sense now. 

I worked with a guy who collected code like this.   One day I heard he had told someone that if something were to happen he would infect the companies LAN.   Gone, right then and there.    :-DD   I didn't say he was all that bright.   

Title: Re: Simple Ethernet killer switch.
Post by: hendorog on June 27, 2016, 04:14:35 am
How about getting a small ethernet switch or router - one with a power button - and physically turning that off and on as needed?

Put a big red e-stop switch in the power cord of the thing if you want it really obvious.

That way its a physical thing, not a bit of software, and there is a physical action required to connect to the network.

Edit: Doh I missed that this was already suggested early in the thread..





Title: Re: Simple Ethernet killer switch.
Post by: R005T3r on June 27, 2016, 09:03:39 am
A-ha!  So you are distributing your ransomware via porn sites eh?  Very clever!  That's why all 7 of my dedicated porn machines are all running Linux and behind a firewall.

Everyone's got to make a living, good luck to you, I say!

HAaha...  :-DD Yes , exactly.I posted this thread as it can be used as evidence against me. You shouldn't be afraid of ransomware on linux: here there's a small list of what kind of threats there are out there:
https://help.ubuntu.com/community/Linuxvirus (https://help.ubuntu.com/community/Linuxvirus)
http://www.chkrootkit.org/ (http://www.chkrootkit.org/)

That is only a small fraction of the threats available on windows (you know there's an entire encyclopedia dedicated to important viruses):
http://virus.wikidot.com/ (http://virus.wikidot.com/)
http://www.trendmicro.com/vinfo/us/threat-encyclopedia/ (http://www.trendmicro.com/vinfo/us/threat-encyclopedia/)
Title: Re: Simple Ethernet killer switch.
Post by: R005T3r on June 27, 2016, 09:10:15 am
Hi

Ok, I'd call that a legit reason to go for some sort of separation. My concern would then be for things like WiFi and Bluetooth that are a bit less easy to shut off. I have enough confidence in a managed switch (properly set up and used) that I would go that route rather than a physical switch. The whole VM thing has a few issues as well ...

Bob
No the machine have no wifi, not any bluetooth... it's only a cpu + old hard drive + motherboard, 4Gb ram and a dvd drive...
Title: Re: Simple Ethernet killer switch.
Post by: R005T3r on June 27, 2016, 09:23:01 am
OP, thanks for clearing that up.    I could see why you would not want to post that sort of info but it does make more sense now. 

I worked with a guy who collected code like this.   One day I heard he had told someone that if something were to happen he would infect the companies LAN.   Gone, right then and there.    :-DD   I didn't say he was all that bright.
Exactly, that's what I'm talking about. This is a really really dangerous rumor, because if your employer know this, you are the first to be blamed if something happens to them. Also, when the voices spreads, you are probably not able to get a work on an office again.
Title: Re: Simple Ethernet killer switch.
Post by: R005T3r on June 27, 2016, 10:03:09 am
Since you're using VMs you could assign a VLAN to each virtual NIC instead of bridging it to the physical NIC of your host PC. Then setup your router/firefall for VLANs and isolate the netwoks, allow the VMs just to access the internet. That way cou could also view the complete network traffic and/or log it (pcap) for analyzing it later on. Monitoring the network traffic gives you hints about how the malware communicates to control servers or tries to find other victims. Or you could place a victim VM into the same VLAN and watch what happens.

Ding ding ding! We have a winner! This is the way to do it. What I would do is pickup a cheap 5-port managed or semi-managed (aka "smart") switch, which, in addition to allowing you setup VLANs would also allow you to implement port mirroring. That allows you to use a WireShark on a second machine to inspect the traffic on a much lower level. You can grab a 5-port semi-managed GigE switch on Amazon for ~$30 that do exactly that. (Assuming your existing router doesn't allow VLANs and mirroring.)
My router allows VLANs.
Title: Re: Simple Ethernet killer switch.
Post by: bitseeker on June 27, 2016, 10:34:26 pm
Thanks for clearing up the mystery, R005T3r. Security can be a double-edged sword and your motives easily misconstrued. But such research is an important and necessary thing.