Shark Jack

Key Capabilities

1. Autonomous Network Reconnaissance:

• • Automatically starts scanning the local area network (LAN) as soon as it is plugged into an active Ethernet jack. It can identify connected devices, operating systems, and open network "doors" (ports).

2. Drop-and-Run Operation:

• • Equipped with an internal rechargeable battery (or continuous USB-C power on the cable version), allowing security auditors to plug it in, walk away, and return later to collect the gathered information.

3. Dual Form Factors:

• • Shark Jack (Pocket Tool): Battery-operated for quick 10–15 minute audit missions.

  • Shark Jack Cable: Looks like a standard network cable and receives continuous power via USB-C for extended testing.

4. Flip-of-a-Switch Modes:

• • Uses a simple 3-position physical switch to easily change between Arming Mode (for setup and viewing scan results) and Attack Mode (for running automated scans).

5. Cloud C2 Exfiltration:

• • If the local network has outbound internet access, the Shark Jack can silently upload its scan results directly to a remote security server (Hak5 Cloud C2) in real time.

Best Uses & Scenarios

1. Physical Port Security Audits:

   • Tests whether Ethernet ports in public areas—such as lobbies, conference rooms, hallway wall jacks, or behind unattended reception desks—are properly secured or exposed to unauthorized visitors.

2. Automated Network Mapping (Nmap Scans):

   • Quickly creates a digital map of all active servers, IP addresses, printers, and routers on an internal network segment without needing to unpack a laptop.

3. Rogue DHCP & Network Vulnerability Testing:

   • Evaluates whether an attacker plugging into a wall jack can receive an IP address, intercept unencrypted network traffic, or discover vulnerable network services.

4. Network Access Control (802.1X) Testing:

   • Validates whether corporate switches correctly block unrecognized physical devices from joining the internal corporate network.

Key Defensive Mitigations

Because the Shark Jack attacks networks from the physical wire level, traditional antivirus software on desktop PCs cannot block it. Defense requires strong physical and network infrastructure controls:

1. Network Access Control (802.1X Authentication):

   • Enforce 802.1X port authentication across all corporate Ethernet ports. Unrecognized physical devices (without valid digital certificates) will be blocked from accessing the network.

2. Disable Unused Physical Wall Jacks:

   • Deactivate unused network ports at the switch level in conference rooms, waiting areas, and hallways so an intruder cannot simply plug in and gain access.

3. VLAN Segmentation & Guest Isolation:

   • Place physical wall jacks in public areas onto an isolated "Guest" VLAN that cannot communicate with internal corporate servers, HR databases, or domain controllers.

4. MAC Address Filtering & Port Security:

   • Configure network switches to limit the number of MAC addresses allowed per port or lock ports strictly to approved corporate hardware IDs.

5. Network Intrusion Detection (IDS/NTA):

   • Monitor internal network traffic for rapid port-scanning activity (such as aggressive nmap sweeps) originating from newly connected network jacks.

Helpful links:

Shark Jack Product Page
Shark Jack Documentation page
Hak5 Youtube channel