109 comments

[ 1.7 ms ] story [ 183 ms ] thread
Seems a bit large for it to not draw attention
With a correctly designed enclosure (chamfered edges, black), it might not look all that suspicious tucked away somewhere charging a phone.
You’d be better off putting a battery in it and dropping it under a bin or something.
That’s going to be way more suspicious that plugging in a phone charger, given the history of bombs being left in trash cans.
The reason why there's a history of bombs being left in trash cans is because it's easy and discrete.
Which is also why it’s suspicious if someone sees you do it. Someone seeing you plug in a phone charger is much less suspicious.

Obviously it’s not suspicious if no one sees you do it.

Not that much larger than those big block laptop adaptors, black injection molding would make it look pretty legit.
There's a TP-Link WR810N, that looks quite a lot like a knockoff Mac charger. Can run OpenWRT, though a lot less well equipped than the device in the linked article.

https://www.tp-link.com/us/home-networking/wifi-router/tl-wr...

I use their updated version, advertised as a travel router. It is pretty small and I carry it while traveling.

https://www.tp-link.com/us/home-networking/wifi-router/tl-wr...

The 1st Gen Apple Airport Express, with the wall plug, was once a good option.

I use them (AirPort 1st gen) for a printer access point to enable wireless printing. Unfortunately they can't act as a wireless bridge due to hardware limitations and need to be hardwired to a network to function.
AAE it's different because uses Broadcom chipsets.

That TP-Links are running on Athreos and later on MediaTek.

Difference - Broadcom drivers are old and for old Linux versions (like 2.4 or 2.6).

I have a couple OpenWRT configurations that I used to use with the 703N to turn it into specific plug-and-play appliances: https://github.com/sowbug/703n.

I'm not sure if they'd work with this model, but I hope they're helpful.

How can you leave that 'in a McDonalds for days'? I bet it would be nicked within the hour (by someone thinking it's just a charger).
Perhaps a wall-plug air-freshener form factor would last longer?
Even better (or worse?) hide it behind the faceplate, a little more work but certainly better hidden! Just turn up in a yellow jacket, official looking lanyard and tools...
Don’t forget to bring a clipboard.
You laugh, but when I was in graduate school working long hours, if I needed a break from the PhD's who controlled me, I would go to a random building with a clipboard and one other item (flashlight, red pen, sometimes just a stick) and find a dark room to hide/sleep in. No one asks you questions if you have a clipboard and something else that makes them assume you know what you're doing.
or make it look like a blank wall faceplate on the consumer facing side, but on the other side it has a plug in to get power. Ideally, no tools are required to "install" it.

To consumers, it should look like this: https://www.homedepot.ca/product/leviton-1-gang-midway-nylon...

Coincidentally I just got an el-cheapo one, that bar the quite obvious antennas and blinking leds is a "direct plugin" (as your typical air freshener), the thingy is sold everywhere with different brands but the origin should be this[0], the nice thing is that it has the plug that can be rotated 90 degrees so it is good for both horizontal and vertical sockets.

[0] http://www.pix-link.com/page50?product_id=144

I wouldn't steal it but I would unplug it to stop the stink. Air fresheners do not.
perfect, get a whole bunch and we'll have potentially compiled a network of thieves without their knowledge

do you think enough people are opportunistically malicious to form a reliable mesh network of jerks?

It depends on the placement of the outlet. I think some are pretty inconspicuous under tables or seats. I bet there are places that wouldn't be noticed for days.
While I’m unsure how it would pick up anything useful I can certainly see how it would work in an enterprise office.

I’ve worked in the public sector for decades, and if you left an iPhone charger somewhere in an open office space, it would get used by someone.

Slip a few of those chargers into one of our massive orders for hardware and no one would ever find out.

Yeah, stuxnet type of distribution, you keep few of them around the office "dropped on the pavement" and chance of success is quite high
I’ve heard of IT departments who place USB sticks around the building and then send nasty-grams to whoever plugs it into a device on the corporate network. (I don’t know exact details.)
What I don’t understand about this is how it’s supposed to work.

Plug anything into any port on our machines and it’ll either have the key to be recognised as one or our devices or be denied any sort of access.

This wasn’t always possible, but today even the keyboard is encrypted. And this is in a medium sized Danish municipality with a technical staff of 5, and it department of 20 and 10.000 employees.

If we can do it, any enterprise can do it.

This was probably more useful in the past but nowadays even local traffic is usually encrypted. All you'd catch is DNS lookups.
That’s sort or my point. Everything is encrypted, even your keyboard and mouse are encrypted, so how is this supposed to work?
> Drop one of these in a Mcdonald's, and nobody’s going to expect a thing. You can leave it for days, while it collects data and marshals it back to your home network.

brave assumptions. it's will be gone in 30 minutes.

Was thinking the same thing. Leaving stuff in public that resemble known consumer electronics will guarantee they perform disappearing acts ASAP.

Ideally, you'd want something firmly attached to a wall, something that looks industrial/enterprisey, like it's an important part of the building alarm, water, power, HVAC or network system. Then people won't fuck with it.

And when you're installing it, wear a brightly coloured safety vest, helmet, badge, clipboard, safety boots and a tool belt around your waist. That way you look super official and nobody will question you and I just made this stuff up, no guarantee that it'll work IRL :)

Agreed. I was thinking something like a GFCI Outlet Tester would have a better chance of sticking around... Make it seem like the electrician forgot to retrieve it but will be back for it in a few.
Anything that looks like it is attached to wall or just hidden from eyes, will have a lot more chances to avoid being stolen/reported.

When i see one of the usb outlets with exposed screws in public the only thing that comes to mind is to partially disassemble the oulet and power the device from it leaving the device inside. There is much less of a chance that someone will report a partially malfunctioning USB outlet than someone snatching a free power brick.

Never done anything like that with a public outlet, did something similiar with my personal hardware.

Regarding size, Lichee Pi [0] comes to mind.

[0] https://www.licheepizero.us/

:( it's the second time today I've read the 'F' word on HN. I usually don't encounter it here which makes me like this community more.

I'm not a leader of this community so my opinion doesn't matter but as a fellow human I'd like to request that you use another word to express yourself. I know this is subjective but I wanted to share this with you. In any case, I hope you have a good day :)

Cursing is pretty common on here. Just re-read the guidelines and there's no rules against inappropriate language like the "f-word"... Especially when considering such a benign usage as the parent comment, ie: just replacing the verb in "mess with" which is not targeting the language at anyone/anything.

It may not be as common as other platforms, but casual conversation does happen here which includes the occasional curse word.

Just trying to inform - I'm sorry you're sensitive to it.

Thanks for letting me know, I really appreciate it :)
Keep in mind that you're not allowed to use any sort of colorful language when disagreeing with whatever the mainstream take on an issue is. Those people get down-voted and a bunch of "y u so mad" (but in better more relevant words, this is HN, not youtube comments) replies. Hooray for double standards.
(comment deleted)
folkhack is correct - I'll just add that this has been the case for a long time on HN: https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que... - indeed it's always functioned this way. We care about people not being mean to each other, but profanity isn't that.

No doubt there are downsides and I'm sorry that it's disagreeable to you.

Die in a fire, politically-correct scum.
lol I hope that gets you through your day
I'm going to assume that this was a low-quality joke rather than a literal attack, but since we've had to warn you before not to attack other users on HN (https://news.ycombinator.com/item?id=25309677), it would be better not to go there.
The police on my city arrested this week 3 people that stole ~4tons of cable, on daylight, in crowded streets.

They did exactly that. Got a very visible vest, with a company logo, closed part of the walkway, and dig the cables without anybody suspecting anything.

c'mon epoxy the thing to the outlet
Order two game theoretic trick: fake a main socket device that is in fact a battery powered sniffing tool. Robber may willingly carry that thing in his home.
Are you saying that you need to hide a USB thumb-drive in a wall charger instead?
> Drop one of these in a Mcdonald's, and nobody’s going to expect a thing. You can leave it for days, while it collects data and marshals it back to your home network.

Haven’t you seen the 90s Hollywood smash hit ‘hackers’ starring Angelina Jolie? Never hack from you home network, it’s universally stupid man!

You don't hack a bank across state lines from your house, you'll get nailed by the FBI. Where are your brains, in your ass? Don't you know anything?
Okay, the quote is spot-on, sure; but the username? This is just surreal.
Except it was phreak that said it wasn't it?
You're correct, but still, a suspiciously-accurate username for the quote-poster!
Now I want to post a Nikon quote. You're in the butter zone now, baby!
It's stupid, man, it's universally stupid.
This movie is how I learned not to store my meta mask mnemonic in a file named "junk"
i thought it was the trash file
yeah, garbage, okay, give me garbage
> I ended up choosing the Allwinner A33; it’s an older MPU that came out in 2014. Tablet manufacturers used it in their Android devices, and since Android uses Linux, we should get good mainline support.

Not quite. Mainlining ARM chips tend to be a demanding task, and the not-so-widespread A33 is still a work in progress

Do yo know why this is the case? Due to integrated peripherals? Or is there something particularly incompatible about the ARM architecture?
I think there's a fair amount of ARM that's different about each implementation.

eg: early boot - initialization of hardware is timing/order dependent

ARM SoCs are complex and often undocumented to anyone outside the company making them. The arch is fine, but many drivers are needed e.g. for clocks (and a lot of reversing has to be done). Having said that, downstream (Android) kernel will probably be fine for a simple use case such as this
Looks well enough supported, looking at the DT files in Linux.
(comment deleted)
Why assume that it will not go missing? People will probably get it and tinker with it at home. Some might throw it away outside of the establishment.
Right. The author mentions McDonald's as a site: I'd assume Starbucks or another coffee shop is probably a better one, since more people bring laptops there to work. Does a wall charger last more than a day plugged in at a Starbucks location before getting stolen or, at the very least, removed during cleaning?
Why as a wall wart? Odds of discovery and removal are high.

Instead fit it into a lightbulb form factor, and replace a lightblub in the restroom. Or you can be SUPER brave and fit it into a wall outlet form factor and replace the whole outlet / receptacle.

(comment deleted)
I've heard of electricians who will change a live receptical. I even found this video exhibition https://www.youtube.com/watch?v=WERqtFfgcyo
Many electricians will do this if needed. My brother-in-law gets shocked with 110v on a regular basis, and doesn't really mind anymore. I don't think many would work on a hot 240v circuit, though.
UK (230V) here, I've observed electricians working on live circuits frequently. That's why tools like this exist, 'safe' for working up to 1000V:

https://www.machinemart.co.uk/c/vde--insulated-tools/

Despite being warned not to over and over again, I have replaced multiple electrical outlets and light switches in my home without flipping the breakers

At least please don’t be seen by kids. They might believe it’s nothing.
I did commercial lighting for a few years. Relamp/reballast or LED retrofits are almost always done during business hours, with the lights on. Big lighting systems usually run at 277V. (Phase-to-neural voltage of 480V three-phase)

I would much rather work on a hot 277V lighting fixture than a 120V wall socket. Much more room to work, wire gauge is way thinner. The downside is that you're always on a ladder, so a big shock is comes with a ten foot fall as a free bonus. If I'm touching anything inside a wall, the breaker is getting flipped.

> Despite being warned not to over and over again, I have replaced multiple electrical outlets and light switches in my home without flipping the breakers

The consequences at hand make working with even house-voltage electricity a "wicked learning environment" [1]. The first time you get things wrong may be lethal, without the opportunity to learn from experience.

Please consider turning the power off the next time you do electrical work. I don't know you, but I still care whether or not you get zapped :).

[1] https://www.psychologytoday.com/us/blog/experience-studio/20...

I've accidentally touched 230V a few times. It happened when I thought I turned off power but I didn't. (which is why you should short live and ground after turning off power to make sure it is actually turned off)
"Despite being told I was doing something stupid over and over again, I continued to do that stupid thing."
Yes? Do you have anything more to say?

The egg safety standards in the US and EU come to mind. Each standard considers the other standard to be so unsafe it must be banned. But they're both fine.

They are both fine, but probably dangerous to have mixed.
I don't know anything about egg, but presumably they don't advocate working on live household electrics.
That's not 'why' they exist, (at least, that's not my understanding, or why I have a set) it's not easy to not touch anything with anything else, but it's a nice safeguard while poking about somewhere you think is made safe.

What I haven't seen (and don't know why?) is a VDE screwdriver in the neon/LED voltage detection style.

Personally I even isolate lighting circuits to change a bulb. It almost certainly wouldn't be a problem if I didn't, but it's so easy, why not.

Because [this] https://de.wikipedia.org/wiki/Spannungspr%C3%BCfer#/media/Da... is all that is needed to do it. Can you think of a way to do this safely with less commonly available electronics? Get rich quick! :-)
Sure, but you could also say 'all that's needed' is an appropriately rated multimeter, no need for a 'Spannungsprüfer' (I don't speak German btw!).

Those neon/LED drivers (non-(intended)-contact) are in basically every 'dad toolbox' and 'man drawer', a VDE 1000v rated one just seems appealing/like it'd sell well, even if sure, people who actually need that (or should be doing things that do) have better tools for it.

I posted that link because I didn't find any other one which illustrated the point I tried to make so well with one large picture. To put it in different words: this exists like pictured because it is the most simple and cheap method to safely implement with currently available parts.
confirm from experience: 240V is no joking matter, but it's not _that_ dangerous either (otherwise it would be higher)
As long as 110 doesn't go through your chest, it's probably fine. I've had 110 through my chest and I was fine. 240 through your chest is a lot scarier.
Macbooks (since the 'unibody' aluminium design) infamously pass a little stray current through the chassis, even earthed in the UK. It's quite unpleasant if I rest my hand between laptop and desktop keyboard (laptop sometimes to the side) touching both, like a steadily warming burn.

Hardly compares to the shock (pun intended) I got when I happened to touch the long-'tingly' light switch at the same time as another well-earthed one through the door though.

I’ve been accidentally zapped by 110 and 220 and former feels like a tickle compared to latter which was seriously painful
A residential voltage electric shock has a low probability of killing you, but each one has that probability, and some day you may be unlucky.

Knowing how to move around the wire will further reduce the probability, so you can indeed learn to improve your odds. But still, each shock carries that probability (and it's much higher than the things we consider common, like driving a car in a high-speed road). How many times are you ok with putting your life at risk?

One should better avoid working on live wires. If you can't avoid, there are gear and safety procedures that may save your life, uncomfortable as they are. There is no reason for getting shocked all the time.

> How many times are you ok with putting your life at risk?

That's not the right question to ask. If it was that black and white then you'd never get in a car.

Ok, if you really want a cost-benefit analysis, please state what is the benefit, because out of not bothering to turn the electricity off or not buying some cheap protection gear, I'm out of ideas.
Saving a chunk of time and effort. The same benefit you get from unimportant car trips.

Most people go on unimportant car trips just to save a few minutes or for a minor convenience, despite the risk.

It's not a huge benefit each time, but it's also not a huge risk each time. So don't round just one side to zero.

Also who said they aren't using protective gear like insulated tools? That sentence was talking about electricians after all.

Getting a shock is much more dangerous than doing a random car trip. Orders of magnitude more. Switching the power off takes a minute or two (how large is the building?).

Looks to me the OP's friend is just rounding the risk on his life to zero due to normalization of deviance alone and you are keen on defending it because "well, if a professional does it, there may be some good reason". Rest assured that plenty of professionals die because of the that kind of thing. (Normalization of deviance is the large cause of death on every dangerous profession, and mostly done by professionals.)

By the way, the safety gear for working on life wires is more than insulated tools. Insulating yourself from the wire and the ground are just as important.

> Getting a shock is much more dangerous than doing a random car trip.

...similarly, a car crash is much more dangerous than doing a random electrical adjustment.

You don't get to assume one of them fails but not the other.

> Looks to me the OP's friend is just rounding the risk on his life to zero due to normalization of deviance alone

He's rounding it to zero because it's a very low risk, just like people do with car trips.

> that kind of thing

Do I get to lump drunk driving into normal driving? It's still "that kind of thing". I think we need to look at the risk of the specific type of dangerous activity, instead of lumping it into a generic "danger" bin and ignoring car danger because you personally don't feel it qualifies as "normalization of deviance".

Interesting. I would be inclined to attach ground and neutral first, though. That seems to be the algorithm for all manner of connectors (UK plugs interfacing with outlets, USB, SATA, etc. -- they all make sure ground makes contact before power or data).
Devices connect ground first because if there's a fault when something else connects, they want to be able to send the power to ground.

I think his plan was the opposite: to avoid having a path to ground, in the case his body was part of that path.

Isn't your body the best path to ground when the outlet isn't grounded?

I kind of see what he's up to, though. Basically, if you touch the hot wire, or one of the screws that it's attached to, you probably get shocked. That is unavoidable; turn off the power before starting work to minimize your risk. (The risk is, of course, never zero, so do be careful even if you're sure the power is off.)

If you connect neutral first and then hot, you still get shocked if you touch the hot wire... but you also short out if the hot wire that you're screwing to the terminal touches the neutral (or ground) wire. That will cause the circuit breaker to open (or failing that, a fire), defeating the purpose of working on an energized system. So I guess this procedure is optimized for uptime, at an increased risk of death.

I think that is also likely, but I was thinking along the lines of: yes, your body is the best path to ground when the outlet isn't grounded, but, [hot > body > your shoes > floor] is higher resistance than [hot > body > neutral/ground]
Make it look like a hubble-twist-lock that a 120VAC standard 15A recepticle accepts. No one would suspect. Scuff it up and make it dirty. Bingo.
I've always wanted to make something like this, but have it connect to a public WiFi network and operate as a VPN server. Thereby allowing fully anonymous internet browsing. One of many challenges would be getting past the captive portal.

This would in practice be violating the terms of service of the WiFi network and possibly also be illegal?

> This would in practice be violating the terms of service of the WiFi network and possibly also be illegal?

Probably but you'd have to check the captive portal's TOS