Wi-Fi gets the headlines, yet in many offices the wired network is still the trusted one. A free network socket in a meeting room can quietly lead further inside than the guest Wi-Fi ever would.
Shark Jack: in and out in minutes
The Shark Jack is a pocket-sized device that plugs straight into a network socket and runs a Bash or DuckyScript payload, with a network scanner built in. Think of it as a quick snapshot: plug in, gather what the network reveals about itself, unplug. It suits the visit that lasts as long as a coffee.
Packet Squirrel Mark II: in the middle of the cable
The Packet Squirrel Mark II has two Ethernet ports and sits inline between a device and the network, at about 50 × 40 × 15 mm. It is a small Linux computer that can capture and manipulate traffic, spoof DNS and provide a reverse shell or VPN. A slider switch selects between payloads, so it can be prepared in advance and deployed without a laptop.
It also has a detail worth remembering for defence. According to the listed specifications it has 10/100 Ethernet, and gigabit networks negotiate down to 100 Mbit. A desk port that should run at gigabit and suddenly reports 100 Mbit is not proof of anything, but it is a question worth asking.
LAN Turtle: the adapter nobody looks at
The LAN Turtle takes a different approach and disguises itself as a generic USB Ethernet adapter. Hak5 describes it as a covert tool for remote access, gathering network information and man-in-the-middle surveillance. In a tangle of docking stations and dongles, one more adapter draws no attention.
The same three questions
These tools have legitimate uses. Administrators and testers use them, and Hak5 itself lists system administration among the uses. For a defender, they all lead to the same questions: can a new device get onto the network, what can it reach when it does, and would anyone notice?
What actually helps
- Disable unused ports. A socket that goes nowhere cannot be misused. It is an unglamorous fix that works.
- Use 802.1X, and know its limit. Network access control stops a device that simply plugs in. An inline device behind an already authenticated computer may still get through. Where the risk justifies it, MACsec encrypts the link itself.
- Segment the network. A meeting room socket should not reach the servers. Whoever gets in should find a small room and not the whole building.
- Harden the switch. DHCP snooping and dynamic ARP inspection make common man-in-the-middle techniques harder.
- Do not trust the LAN. With TLS on internal services and validated certificates, a device in the cable sees far less and can change far less.
- Alert on new devices. Unknown MAC addresses, changed link speeds and ports going down and up briefly are all cheap signals to collect.
Have your network tested with authorisation: pentesting and consulting →