News

Modded Raspberry Pi Zero Can Hack a Locked PC in under a Minute

An ethical hacker has built a device using a £4 single board computer that can hack a locked PC in less than sixty seconds. Samy Kamkar, a security researcher and whistleblower, used a Raspberry Pi Zero to build an Ethernet over USB device, dubbed PoisonTap, that can hijack internet traffic on the target computer even if the system has been locked.

According to Kamkar’s blog, the PoisonTap:

  • emulates an Ethernet device over USB (or Thunderbolt)
  • hijacks all Internet traffic from the machine (despite being a low priority/unknown network interface)
  • siphons and stores HTTP cookies and sessions from the web browser for the Alexa top 1,000,000 websites
  • exposes the internal router to the attacker, making it accessible remotely via outbound WebSocket and DNS rebinding (thanks Matt Austin for rebinding idea!)
  • installs a persistent web-based backdoor in HTTP cache for hundreds of thousands of domains and common Javascript CDN URLs, all with access to the user’s cookies via cache poisoning
  • allows attacker to remotely force the user to make HTTP requests and proxy back responses (GET & POSTs) with the user’s cookies on any backdoored domain
  • does not require the machine to be unlocked
  • backdoors and remote access persist even after device is removed and attacker sashays away

PoisonTap can bypass the following security:

Kamkar reveals that, short of severing USB connectivity from your computer, the best way to protect against the kind of attack that PoisonTap is capable of is to set your system to hibernate, rather than sleep. While PoisonTap is a white hat proof-of-concept, to show that it is possible, Kamkar has released the source code he used to achieve the feat. Start blocking your USB ports now.

Ashley Allen

Disqus Comments Loading...

Recent Posts

Still Wakes the Deep 

LIVE THE HORROR: An immersive disaster story aboard a stunningly realised North Sea oil rig,…

4 hours ago

PHILIPS 275V8LA – 27 Inch QHD Monitor

The Philips VA LED display uses an advanced multi-domain vertical alignment technology that gives you…

4 hours ago

EPOMAKER Ajazz AK820 Pro 75% Gasket-mounted Mechanical Keyboard 

【TFT Screen: The Interactive Interface】This 75% mechanical keyboard comes equipped with a TFT Screen, serving…

4 hours ago

Funko Fusion

FANDOM FUSION Play as your favorite characters and wield their unique weapons and skills. Team…

4 hours ago

Shin Megami Tensei V: Vengeance Standard Edition

The Definitive Version of Shin Megami Tensei V - Fully evolved with stunning visuals for…

4 hours ago

Hand Warmers Rechargeable 2 Pack

【Unique Split Design】5200mAh hand warmers rechargeable together with double-sided heating function, split snap swivel design,…

4 hours ago