Over the past year we have written about devices that type, listen and watch. This is the practical follow-up: a routine that anyone with a torch and permission can run, and the network signals that show what a walk through the building cannot.
Know what normal looks like
You can only spot what does not belong if you know what does. Before the first walk-through, photograph the standard setup of a desk, a meeting room and a network closet. Note the docking station, adapters and cables you actually issue. Devices such as the Bash Bunny, which can act as a trusted USB device such as a network adapter, keyboard or storage, or the LAN Turtle, which looks like a generic USB adapter, rely on nobody knowing what should be there.
At the desk
- Follow the keyboard cable from end to end. Is there anything between keyboard and computer?
- Check USB ports for sticks, adapters and short extension pieces that you did not issue.
- Follow the network cable, and look for a small box with two Ethernet ports.
- Follow the display cable, and watch for an inline device or an HDMI device drawing USB power.
In meeting rooms and shared areas
- Open floor boxes and look behind the screen. These are the spots that get the least attention.
- Check every network socket. Unused ones should be disabled at the switch, so note any that are not.
- Do not forget printers, phones and reception computers. They often have an unguarded cable, and nobody looks at them.
In network closets
- Compare the patch panel and switch with your documentation.
- Look for devices without a label, and power supplies or USB chargers with no obvious purpose.
- Check who can actually get in, and whether anyone would notice.
The signals on the network
A walk-through is a snapshot. The network can watch all the time, and several of these signals are cheap:
- New MAC addresses and new DHCP clients, especially on ports with a fixed purpose.
- Changed link speeds. A gigabit desk that now runs at 100 Mbit is worth a look.
- Ports that drop briefly. Placing something inline means unplugging the cable.
- Unusual outbound traffic. Cloud C² is self-hosted, so there is no single address to block. Watch instead for devices keeping long-lived connections to unknown destinations, and restrict outbound traffic by default.
- Unknown Wi-Fi networks and clients near your sensitive rooms, on all three bands.
If you find something
Do not just pull it out. Photograph it where it is, note the time and place, and call your security contact. It may be a device from an authorised test or something an employee brought in, but it may also be evidence. Its presence also tells you someone had access, and that is the more important finding.
Checks like this should have written approval, and that applies even more to testing with such devices yourself. In Switzerland, Article 143bis of the Criminal Code makes unauthorised access to data processing systems a criminal offence, so get permission first and in writing.