A Tiny Scrap of Note on Physical Attacks Against LAN Networks

Physical Attacks on LAN Networks" is part of the security training materials I gave to the Indonesian Police. This article is a translation of excerpts from those materials. (I haven't had time to share the specific details on how to build the hacking devices yet, but I plan to release the electronic components, Schematic and Code in the future.)

Physical Attacks on LAN networks are attack methods where the perpetrator must directly interact with the hardware, cable infrastructure, or physical location where the network resides.

Unlike remote attacks that are blocked by firewalls, physical attacks are often more devastating because the perpetrator is already inside the digital security perimeter.

The following are the types of physical attack techniques on LAN networks along with examples:

1. Hardware Keylogging

The perpetrator installs a small hardware device between the keyboard cable and the USB port of the victim's computer. This device records every keystroke (including passwords and secret messages) into its internal memory.

Example: Someone disguised as a cleaning staff installs a USB Keylogger on the receptionist's computer while the room is empty.

2. Rogue Access Point (Illegal Access Point Installation)

The perpetrator secretly connects their own wireless router or access point to an active LAN port (RJ45) on the office wall. This creates a backdoor that allows the hacker to access the LAN from outside the building via Wi-Fi.

Example: A hacker sneaks into a meeting room, installs a mini router under the table connected to the LAN outlet, then controls the network from the parking lot.

3. Network Sniffing via Physical Tapping

This technique involves directly tapping into the network cable (Ethernet). The perpetrator can use a device called a Network Tap or split a LAN cable to copy all data traffic passing through.

Example: Using a device such as a Throwing Star LAN Tap installed between the cable connecting an important computer to the main switch to copy transaction data.

4. Bypassing NAC (Network Access Control) Using Rogue Devices

Many offices have systems that restrict which devices can connect to the LAN. Hackers use devices such as a Raspberry Pi or Bash Bunny to spoof the MAC address (MAC Spoofing) of a printer or other legitimate device to gain network access undetected.

Example: Disconnecting the LAN cable from an office printer and connecting it to the hacker's laptop, which has been configured to appear as that printer to the security system.

5. Physical Port Security Breach

This attack exploits unguarded physical ports, such as USB ports or LAN ports in public areas (lobby, cafeteria, or corridors).

Example: Rubber Ducky Attack. A hacker inserts a USB device that looks like an ordinary flash drive into an unlocked computer. This USB is actually an automated keyboard that can type malicious commands (such as disabling the firewall or stealing data) within seconds.

6. Juice Jacking

The perpetrator modifies USB charging outlets in public places (such as an office waiting area) to not only supply power but also steal data from phones or laptops that are connected.

Example: Providing a free charging station in the company cafeteria that secretly copies contact lists and files from employees' devices while they charge.