Slashdot Mirror
A $5 Tool Called PoisonTap Can Hack Your Locked Computer In One Minute (vice.com)
An anonymous reader quotes a report from Motherboard: A new tool makes it almost trivial for criminals to log onto websites as if they were you, and get access to your network router, allowing them to launch other types of attacks. Hackers and security researchers have long found ways to hack into computers left alone. But the new $5 tool called PoisonTap, created by the well-known hacker and developer Samy Kamkar, can even break into password-protected computers, as long as there's a browser open in the background. Kamkar explained how it works in a blog post published on Wednesday. And all a hacker has to do is plug it in and wait. PoisonTap is built on a Raspberry Pi Zero microcomputer. Once it's plugged into a USB port, it emulates a network device and attacks all outbound connections by pretending to be the whole internet, tricking the computer to send all traffic to it. Once the device is positioned in the middle like this, it can steal the victim's cookies, as long as they come from websites that don't use HTTPS web encryption, according to Kamkar. Security experts that reviewed Kamkar's research for Motherboard agreed that this is a novel attack, and a good way to expose the excessive trust that Mac and Windows computers have in network devices. That's the key of PoisonTap's attacks -- once what looks like a network device is plugged into a laptop, the computer automatically talks to it and exchanges data with it.
Physical access to equipment trumps (Trumps, heheheh!) almost all security. News at 11.
Is this seriously a story? You don't even need a device to plug in to do this. Why would there need to be a browser open in the background? What the fuck is "Motherboard"? Fucking hipsters.
Someone should inform Trump of this immediately. Kamkar is a foreign sounding name, he should be deported immediately. Put Steve Bannon on it right away!
That'll fix it!
What do you mean, he's already sacked Bannon?? That was quick.
"Once the device is positioned in the middle like this, it can steal the victim's cookies, as long as they come from websites that don't use HTTPS web encryption, according to Kamkar."
While I do think the fact that this works at all is problematic... if you're doing anything non-trivial on any website which doesn't employ https, that information has likely been available to anyone who really wanted it already.
#DeleteChrome
just a run of the mill man in the middle attack? How is that novel? And, where's the part where they break into the actual computer?
Yet another interesting use of a Raspberry Pi Zero. Give people a $5 computer and they just have to come up with something to use it for.
https://xkcd.com/538/
Website Just Down For Me? Find out
If you have physical access and the computer is on, you can already read the contents of RAM with some specialized hardware. That gives you access to pretty much everything.
wait till he discovers ARP Poisoning
Snowden and Manning are heroes.
I can't even get it to boot properly half the time. And when it does, it randomly cuts off within a few minutes. Total power down, have to unplug it.
I think I need a new motherboard.
You don't even need access to the computer to do this "hack" - just use an existing network cable or be on the same network and you can read and modify any plain text sent over the wire. This isn't even "new", compromised USB network cards were all the rage 10 years ago when they first came out with those wallplug computers (before RPi even existed)
Custom electronics and digital signage for your business: www.evcircuits.com
Sure, you can do anything with physical access if you have some time on your hands.
Sure, you can be persistent if you can leave something behind, like a modified keyboard.
Sure, you can be persistent if you can install something, but that USUALLY requires either the ability to use the mouse or keyboard on an unlocked machine or tricking the user to do so for you.
The novelty here is that it's a "plug it in, wait a few minutes, unplug it, and walk away" compromise, AND it doesn't make any permanent hardware changes such as blowing up your PC by sending a few hundred volts down the USB ports.
It's also novel in that it exposes a design flaw that should've been noticed and widely discussed decades ago.
By the way, am I the only one that remembers Thick Ethernet, aka 10BASE5, and its "vampire taps"?
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Once someone has physical access your fucked either way.
Made me think about who this will really affect. I mean who among us really leaves their browser window open and then logs out or times out from inactivity? I don't simply not to waste the cpu cycles when I know I'll be afk for long enough for inactivity to log me out. Most people I think this could affect are businesses and corporate workstations. They usually have a very short inactivity timer, log out whenever afk, and leave their browsers open while logging out. If your next thought is well who wants to compromise a single workstation anyway. Well what if it belongs to the admin in a server room? Perhaps a datacenter? Right tool for the right job and this certainly has espionage written all over it.
My Macbook doesn't have any USB ports!
what's puzzling is that why it doesn't just get full access as YOU COULD JUST REDIRECT THE STUFF TO SOMETHING THAT CAUSES WINDOWS TO SEND THE MS ACCOUNT PASSWORD AND USERNAME IN PLAIN TEXT.. and while at that create a tunnel that stays once it gets plugged to real internet.
how is plugging a computer into a network an offline attack?
requiring physical access is less novel, especially when there are a number of attacks described where if you can place something like that, you could just get the keyboard codes by audio, em and a number of other ways - or heck, do this attack over recording the led at the router.
also it requires you to be logged into the sites already, the sites to not be https.. sorry about the yelling but this seems like a dolt just taking an existing concept, putting it on a raspberry pi and claiming fame based on that.
world was created 5 seconds before this post as it is.
well gosh golly gumpers, I can also plug an evil thing into the ethernet jack, and then plug that evil thing into the wired network, and do all manner of bad also. Hell I can substitute an evil hub for a good one and do even more bad. where will it end?
*snooze*
I have no ethernet jack - I have a Mac, you insensitive clod.
Make sure everyone's vote counts: Verified Voting
The latest Macs don't even have many ports of which to speak. Did the attacker bring a dongle with them?
READY.
PRINT ""+-0
I'm guessing (correct me if I'm wrong) this doesn't work against a linux kernel compiled with the minimal set of hardware drivers as non-modules. And preventing someone with physical access to your existing usb ethernet adapter. Whatever.
https://youtu.be/_LNET_reE6o
Physical access is king?
How is this news? In highschool, I was stealing admin passwords with OPHcrack and selling them to other kids. Took less than 5 minutes to do.
https://xkcd.com/386/
Disable cookies. Disable Javascript (no, I'm not talking about NoScript!).
That's my "regular" profile, the one I'm using right now. I've got a handful of (separate) profiles with a couple more of things enabled. I start them when I need them and stop them afterwards.
Still looking for a proxy à la Privoxy which can do TLS and excises in a controlled manner active content (& perhaps massages obvious "probe" image URLs, or downloads those via a cache network). Ideally the proxy should not rely on any one of the big Web or Javascript engines.
If you read the fine print, they say that the open in the background needs to be Internet Explorer 6.
Even better flamebait :
'This text can hack your computer'
just by reading this text, your computer has been hacked!! of course you need to have physical access to the computer and the person, a baseball bat, a wrench, an installation of kali linux on a usb drive, a non encrypted disk, cotton candy, and a captain crunch whistle ( optional, but very amusing )
https requires domain names = No LAN
Or do you have a certificate for 192.168.1.101
Also ... have fun updating the certificates every year when they expire.
The attacker will have to buy an Apple dongle for $200.
a good way to expose the excessive trust that Mac and Windows computers have in network devices.
The problem is wider. The trust is wrongfully placed on USB devices in general, not just network devices. The simple fact that OS X and Windows auto-mount anything inserted into their slots is just pissing me off. I think some "user-friendly" Linux distributions are also doing that. It's too hard to click an "allow" button anymore, not to mention using the terminal to type mount commands.
A much bigger problem is that device manufacturers typically don't care about security, allowing anyone to update their firmware with unsigned and potentially malicious code. It's not only important to always protect your computer from physical access: any time you plug-in a USB device that was left unattended, you are at risk of running malware.
No news. But it is selling the weakness of non-https as something new. This is so old school.
But hopefully somebody cn get the budget to implement HTTPS or whatever the purpose was.
Right and if you plug in a device straight into their ethernet port that snoops the line..
Anyway..OH MY GOSH NEWS NEVER KNEW!?!?!
> Man in the middle attack
> Novel attack
Sounds pretty contradictory to me.
This attack can in no way determine operating system passwords. It cannot "hack your locked computer".
Now if they had described powering off the computer and then booting it from external media running something like l0phtcrack, then they would be actually "hacking your (no longer) locked computer" - that's only if you do not have a bios power-on password set.
Hey, if I have physical access why not just remove the hard-disk(s) and put it in another system?
And neither of these approaches would be news.
This is fucking retarded bullshit clickbait. There is no story.
We discussed this previously. Too lazy to find the conversation, but then, so are the Slashdot "editors". This is actually a non-problem in a Windows corporate environment because if you have not already prevented users from installing hardware via group policy, you have already failed as a Windows admin.
It's not terribly difficult to prevent hardware hotplugging on Linux.
Couldn't tell you about Mac, don't care.
Wank wank, flonk flonk.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
Too Many Secrets: https://www.youtube.com/watch?...
We'll make great pets
So that means it's pretty ineffective. everything that is important to me is HTTPS, even my routers config pages.
I have yet to see any important site not force HTTPS. Will this see that I log into "fluffybunnypodcast.com" with the username bunnyman42 and the password 12345? yep. but I fully expect that the chinese hackers already have this as I really dont care if they get free copies of the latest free fluffybunny broadcast.
Do not look at laser with remaining good eye.
Of course. That require a lot of courage, an trait that Apple exceed in exhibiting.
According to people right here on Slashdot, you can't find the Raspberry Pi Zero anywhere.
As above, where can we buy one?
Just cruising through this digital world at 33 1/3 rpm...
My C=64 doesn't have pesky USB ports.
#CBM4LIFE
Sound like a hardware version of a proxy
Coder's Stone: The programming language quick ref for iPad
Maybe not even the skiddies in a few years: All those AMD processors now have Trustzone cores installed that are either vendor (AMD) or OEM (Mobo/system manufacturer) signed, with higher than supervisor level access to the system memory space.
Why do I mention it? Because it isn't much of a stretch to assume besides spying on you for copyright infringement purposes they will have the ability in place to snoop and exfiltrate all your encryption keys currently in use via the trustzone processor, or 'SMM' type processes running on the x86 cores. Point being, without being able to audit it, you won't know if that has happened until it is too late for your security, be it sensitive info, or pirated wares.
The security of ANY 'anonymous networks' is under attack in a way most people don't realize or consider and it makes the odds of a Sybil attack increase to 'every node on the network' instead of just 'intel service hosted' nodes, traditionally hacked nodes, or confiscated ones. Now the potential is there to skip all three steps and just 'find key to pwn that type of device' and viola they have full access to your cell phone, your computer, your tablet, or your other 'secure' device (thankfully this isn't in network devices yet, although with how exploitable most stock firmware are....)
It also depends on where the computer is positioned. If it's under the desk with rear USB ports available it's going to be fairly trivial to hide such a device (possibly a bit harder to get at surreptitiously, but just wear a badge that says "IT Dept" for that).
In certain more high security environments I've seen them do things like glue the keyboard/mouse into the computer and use a special cover (or just hot glue in some cases) to block out any unused ports. Makes it a big PITA when you actually need to use those ports.
In other words, it was common enough knowledge that "yes, you can and in fact should disable plug and play in some situations". Just another autorun-default-on issue.
Coworker goes to lunch and locks his PC, you go and steal his cookies and mess with his project files while making it look like it's him.
Many fat client applications have been replaced by REST apps and web based approaches, and many companies do not use HTTPS for servers that can only be accessed internally. Yes, even companies that should be security conscious. The attack scenario is not webservers out on the internet but company-internal servers. Once I was even told by a client that this actually increases their security because port 80 is never accessible from the outside, so it's safer (I still have the bite marks on my tongue, I think).
And locking USB ports isn't always an option.
Though I have to say, I'm very glad this happened, for it will certainly support my case for more encryption even for servers that have no business communicating to the outside world.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
USB is a trusted bus. This is not news. Reading the headline alone I muttered to myself, "I bet they are just using USB trust." USB is root. By definition, whatever you plug your computer into with USB *owns* your computer. What is does with that ownership is of great importance. But the fact that USB is trusted is not in any way shape or form interesting or new.
This is why it is common to epoxy USB ports on secured machines, and why you should never ever plug unknown USB into anything, ever (except maybe a honeypot research workstation.)
APK, you asked for forgiveness, and I forgive you.
https://hardware.slashdot.org/...
Maybe it's time to move on with your life.
lucm, indeed.