Free Trials

Download a free trial to find out which Altium software best suits your needs

How to Buy

Contact your local sales office to get started on improving your design environment

Downloads

Download the latest in PCB design and EDA software

  • PCB DESIGN SOFTWARE
  • Altium Designer

    Complete Environment for Schematic + Layout

  • CircuitStudio

    Entry Level, Professional PCB Design Tool

  • CircuitMaker

    Community Based PCB Design Tool

  • NEXUS

    Agile PCB Design For Teams

  • CLOUD PLATFORM
  • Altium 365

    Connecting PCB Design to the Manufacturing Floor

  • COMPONENT MANAGEMENT
  • Altium Concord Pro

    Complete Solution for Library Management

  • Octopart

    Extensive, Easy-to-Use Component Database

  • PRODUCT EXTENSIONS
  • PDN Analyzer

    Natural and Effortless Power Distribution Network Analysis

  • See All Extensions
  • EMBEDDED
  • TASKING

    World-Renowned Technology for Embedded Systems Development

  • TRAININGS
  • Live Courses

    Learn best practices with instructional training available worldwide

  • On-Demand Courses

    Gain comprehensive knowledge without leaving your home or office

  • ONLINE VIEWER
  • Altium 365 Viewer

    View & Share electronic designs in your browser

  • Altium Designer 20

    The most powerful, modern and easy-to-use PCB design tool for professional use

    ALTIUMLIVE

    Annual PCB Design Summit

    • Forum

      Where Altium users and enthusiasts can interact with each other

    • Blog

      Our blog about things that interest us and hopefully you too

    • Ideas

      Submit ideas and vote for new features you want in Altium tools

    • Bug Crunch

      Help make the software better by submitting bugs and voting on what's important

    • Wall

      A stream of events on AltiumLive you follow by participating in or subscribing to

    • Beta Program

      Information about participating in our Beta program and getting early access to Altium tools

    All Resources

    Explore the latest content from blog posts to social media and technical white papers gathered together for your convenience

    Downloads

    Take a look at what download options are available to best suit your needs

    How to Buy

    Contact your local sales office to get started improving your design environment

    • Documentation

      The documentation area is where you can find extensive, versioned information about our software online, for free.

    • Training & Events

      View the schedule and register for training events all around the world and online

    • Design Content

      Browse our vast library of free design content including components, templates and reference designs

    • Webinars

      Attend a live webinar online or get instant access to our on demand series of webinars

    • Support

      Get your questions answered with our variety of direct support and self-service options

    • Technical Papers

      Stay up to date with the latest technology and industry trends with our complete collection of technical white papers.

    • Video Library

      Quick and to-the-point video tutorials to get you started with Altium Designer

    Your Office Network is Not Secure

    David Bortolami
    |  October 12, 2020
    Your Office Network is Not Secure

    Introduction

    A few years back, I was among the leaders in one of Italy’s biggest Hackerspaces. There was an unearthly atmosphere when a place meant to bring all sorts of folks together opened its doors for the first time. It reminded me of the internet-famous band 2Cellos. Their music is a mixture of classic, pop and metal covers, played on cellos with varying levels of distortion. They can swiftly escalate from harmonies of long-held soothing chords to screaming the bow onto the fingerboard in the blink of an eye. You can see couples in their 70s complaining about the poor quality of food-truck wine in plastic cups shoulder to shoulder with moderately intoxicated screaming teenagers.

    Working in a considerable hackerspace was something like that.

    We had over 600 members, countless professionals and enthusiasts from all walks of life and business. I have fond memories of all the weird and wonderful people that walked through our doors. One time this tall, long-haired fellow in his forties walked in with a humongous automated soap dispenser on a trolley. The rubber tires squashed in under the weight of the folded steel, and electrical cables and silicone tubing jingled inside the machine when he crossed the junctions between tiles on the floor. He planned to convert it into some sort of automated drink-making robotic bartender.

    We had many hackers among our members in the broader sense of the word, people who alter hardware or software for novelty, functional or creative reasons. We also had many hackers hackers, people who breach into computers and network systems and exploit technological weaknesses, either to follow their inner anarchist spirit or daily as IT security analysts and consultants. IT security is an exciting field of work, and the people in it are an interesting bunch. They have their own dress code, stereotypically composed of cargo shorts and black t-shirts with snarly comics printed on the chest, their own culture of morality, and all sorts of inside-jokes and contrived technical humour.

    Hacker Humor and cloud security
    Figure 1. (Absurd) Example of Hacker Humour.

    I’ve had the pleasure of working alongside several of them and learned a few tricks of the trade. While I’m by no means an expert in the field, I have some experience in pen testing small and medium businesses, and I would like to share with you some considerations that might very well apply to your business.

    Your Office is Insecure

    Your office is insecure, often wildly so. We tend to believe that an adverse event is less likely to happen to us than to everyone else. Sure, a couple of our neighbour houses were robbed, but it won’t happen to us.

    Or mental estimations of likelihood are often more based on how we perceive ourselves and how we perceive stereotypical victims than on objective statistics. We tend to adjust our perception to match the heuristics of what happens. Our neighbour got robbed, and we didn’t? They probably had friends in low places or liked to display their silverware to guests, and word got out. Anything but the bland statistics that all people living nearby have a similar chance of getting robbed and the spinning wheel of fortune.

    Similarly, we think nothing will ever happen to our precious data. We adopt insecure passwords, leave data stored on hard drives without encryption, forget to double-check the backups.

    Your electronic designs are undoubtedly some of the most critical data your company owns, and from my experience in testing the security of small enterprises, they’re probably up for grabs. Might as well put your schematics up on a ledger in your lobby.

    How Your Company Can Fall Prey of Targeted Attacks

    Many people tend to think stealing business data is like robbing an apartment, that you have to force your way through doors and security guards to get to the juicy bits. But it’s not like that.

    Breaking into computer systems resembles more pickpocketing. It only takes a swift, and gentle act by a skilled individual and your wallet is gone, with you none the wiser. A smile big enough can cover mischievously poking around or intruding into your infrastructure.

    Here are some ways your systems can be compromised. We’re not going to dive into the cinematic lone genius typing frantically at the keyboard to find the exploit to some remote device over the internet, because while it does have a foundation of truth, that is not how real systems get exploited. How your and my company data can get hacked can be far less glamorous.

    Getting into the Server Room

    If your company has a server room, how many times have you walked in front of it to find the door stuck open with a box of random computer parts while nobody was around? We have built computers with an innate trust on whoever (and whatever) can physically access them.

    A microcontroller system can be re-programmed if you have access to the debug interface, the most that can be done to protect it is usually to lock the firmware so it cannot be reverse-engineered and plagiarised. The logic for most computer systems, big or small, has always been the same. If you’re the one handling the computer, it’s yours, and you should be able to do what you want with it. Take a glance at any server, and you will find two USB 2.0 ports on the front, often accompanied by a VGA, meant for debugging the system without using any remote interface.

    Typical Server Rack for cloud security
    Figure 2. A typical server rack. Can you see the USB ports?

    If you’ve ever installed an operating system on any computer, you know the procedure is relatively straightforward:

    • Insert some storage media, such as a USB drive
    • Reboot
    • Keep pressing that F11 or ESC key
    • Install the new operating system

    All these operations can be done through plug-and-play USB devices supported by the computer’s BIOS. Once the system has been rebooted, you have all the power in the world to reprogram it as you please, including installing malware to exfiltrate the data and steal passwords.

    For those who do not like to type under pressure, many tiny and anonymous gadgets can automate this procedure, and most scripts to program them are freely available on the web. The most famous of these devices is the USB Rubber ducky, consisting of not much more than a USB-enabled microcontroller, a USB connector and a couple of capacitors.

    USB Rubber Ducky
    Figure 3. A USB Rubber Ducky, hardware hacking device, image courtesy of Hak5.

    More advanced devices can even emulate standard USB storage and USB to Ethernet bridges: your servers won’t know what hit them. An attacker can easily program such devices to start the action after a few days and in the middle of the night. The data can often be stolen without anybody noticing for months, if ever. Some of these devices can self-destruct after they lose power, leaving you with an empty piece of electronics of little use to law enforcement forensics.

    Hacking a Wired Network

    Do you have a meeting room?

    Last year I found myself in an increasing boring business meeting when everyone was speaking unintelligible business jargon. I just wanted to crawl back to my office, hide behind my desk and work on designing the next delightful optoisolator circuit.

    My eyes wandered around the walls of the room and fell upon a big blinking network switch under a shelf of cheap powder-milk candies and water bottles. Any guest of the meeting room that wanted some free candy or felt thirsty was in the prime position to gain access to that network switch.

    Once you have access to a LAN port in your office, it’s incredibly easy to have permanent access to the whole network. You can buy a Raspberry PI, plug in a cellular SIM in a cheap USB dongle and use any of the free anonymous services that allow you remote access to IoT devices. Once the device is installed, mimicking any of the weird hardware often found in meeting rooms, the intruder has all the time in the world to peek around and do harm to your business.

    If you think someone would notice a Raspberry Pi, there are more discreet alternatives that mimic more common enterprise network hardware.

    LAN Turtle cloud security
    Figure 4. A popular covert pentesting device called LAN Turtle, image courtesy of Hak5

    The device depicted above is called the LAN Turtle, and for such a cute name, it’s a terrifying piece of hardware. Once implanted, it can create a permanent backdoor to your network using the built-in 3G modem, run periodic analysis to find vulnerable devices and launch attacks to exploit them.

    Hacking a Wireless Network the Easy Way

    Does everyone in your company have a different password to access the WiFi? If so, good job! If multiple people share the same password and the same network, then every account the network could be already compromised.

    It only takes one compromised Android phone, laptop, or a piece of paper caught by the wind and flown out of the window with your WiFi password on it and your network security is gone. Many business WiFi networks are easily accessible from the parking lot or the road near offices with the aid of a high-gain antenna.

    Hacking a Wireless Network the Hard Way

    Even if the network was set up and secured the first time properly, all network devices must be regularly updated to patch security vulnerabilities. Now and then, new vulnerabilities for commonly deployed WiFi access points are released publicly on the internet, including plenty of bypasses that allow full access to the whole network from the guest WiFi.

    I will not go into the details of how such a feat can be accomplished, but if you want to get scared, you can search for your preferred brand on CVEDetails.com and order the results by the highest CVSS score first. Any score higher than seven out of ten means a great deal of troubles.

    How Cloud Security Solutions Help You Keep Your Data Secure

    Your PCB design data is not only precious, it also enables you to keep your position in the market and the loyalty of your customers. If your product designs are compromised, your competitors could be able to catch up faster than you’re able to start production of the next great gadget. Engineering firms must be extra cautious when hosting their customer’s intellectual property in their networks, as it only takes one bad actor to break the trust of long-standing customers and expose the company to costly legal action.

    Cloud providers are some of the biggest IT companies on the face of the planet, most notable among them Amazon Web Services, Google, and Microsoft. These companies have armies of IT security specialists, including many ex black-hat hackers, whose only job is guaranteeing the security of your data. Here are some of the actions these companies take to keep your data secure:

    • Cloud providers monitor their internal networks using analysis algorithms based on artificial intelligence, and any threat can be addressed by teams of experts working 24x7 to keep your data safe.
    • Microsoft and its cloud services branch, Azure, one of the leading cloud providers, employs over 3500 security professionals and invests over one $1 billion (with a B!) every year on security and security research. Other companies like Amazon, Google, and IBM invest similarly large sums on security research.
    • Cloud data centres have a layered physical security approach with fences, armed guards, biometric access control, cameras, and extensive personnel background checks. They have comparable levels of physical security to bank vaults.
    • Most cloud data hosting systems automatically distribute data redundantly across multiple data centres in different geographic zones. Cloud-hosted data can survive wars, natural disasters, and infrastructure breakdown due to political instability.

    If you worry about the safety of your data and you want to take advantage of cloud security for your PCB designs, take a look at Concord Pro® on the Altium 365® platform. You get all the security and redundancy of cloud services trusted by millions of enterprises and virtually all Fortune 500 companies coupled with Altium 365 advanced sharing, user and data management. This is the only platform that provides integrated cloud security and sharing for Altium Designer®. No other design platform helps you keep your data so secure and easily accessible.

    Would you like to find out more about how Altium can help you with your next PCB design? Talk to an expert at Altium.

    About Author

    About Author

    David Bortolami is electronic engineer with a broad knowledge in PCB and circuit design. Currently, he is the head of Fermium, a small British enterprise that manufactures some of the world's most advanced scientific instruments for teaching and research.

    "Every product can be made twice as good at half the cost; it's a matter of diving deeply into why it should exist - then taking the rest out."

    As an Entrepreneur, David has experience with all the hurdles of manufacturing, integrated electronic-mechanical product design, meeting EMC & Regulatory requirements. In the past, he ran one of the biggest Italian Fablab/Hackerspace and Coworkings and was in charge of PCB Engineering for companies specialised in EMI-heavy industries such as electronic inverters.

    You can contact David directly at: d@fermium.ltd.uk

    most recent articles

    Back to Home