PoisonTap, a $5 tool that invades password-protected computers

http://arstechnica.com/security/2016/11/meet-poisontap-the-5-tool-that-ransacks-password-protected-computers/

by emilong • 10 years ago

147 70 10 years ago

EwanG• 10 years ago

Presuming you are given free access to a USB port on the computer - and as we all know once you have physical control security is somewhat out the window anyway.

mpeg2• 10 years ago

As a user, it'd be nice to assume that if I'm not logged in new USB devices won't be installed though.

mnw21cam2• 10 years ago

What about a keyboard? How are you going to log in if your computer won't accept the keyboard that you are trying to plug in?

grkvlt• 10 years ago

What if you're not logged in on the console, but have an SSH session open over the network? Does that count as 'logged in' or not? Imagine a server under a desk with no monitor attached. Or, a thin-client situation, where I am logged in to a virtual console over VNC or RDP or X, but have no access to the actual machine's USB ports?

falcolas• 10 years ago

Imagine this built into a USB-C power adapter you could loan to a coworker, "leave behind" or install into a co-working space or coffee shop. Don't even need physical access in that case, just need to be a "Good Samaritan".

nullc• 10 years ago

I believe USB-C can tunnel the PCI bus. If your computer is doing that... a network adapter will be the least of your problems.

throwaway2016a5• 10 years ago

This is much faster than other ways of cracking a computer though. I can see this working while someone steps away for a few minutes.

Say you go in for a job interview at a company and the interviewer leaves for a minute with their computer locked but still on their desk. Most traditional methods would require you to move to the other side of the desk or pull the computer to you which is risky, but with this you can just reach over for a few seconds.

Not to mention many traditional attacks require rebooting the computer to a bootable CD which will be suspicious if the user has an active login system and all the sudden all their apps are closed.

Or say you are at a doctor's office and there is no CD drive and rebooting the computer would be suspicious. I'm left unattended in exam rooms with computers all the time.

I also imagine it could be fairly easily modified to act like a USB hub and be inserted between the computer and a legitimate device.

Edit: Think of how less dramatic the scenes will be in Mr. Robot and the like if the "hacker" doesn't have to rush to get back to their seat just in-time for the target to get back to their desk.

mtgx• 10 years ago

and as we all know once you have physical control security is somewhat out the window anyway.

This is such a defeatist attitude, and it has also proven to be (mostly) false by Apple and its iPhones. If we stopped saying that every time there is a hack like this, perhaps companies would actually give a damn to make sure it doesn't happen anymore, or not nearly as easily.

It's one thing to pay from tens of thousands of dollars to a million for modification of a chip in a factory or with highly-advanced equipment, and it's quite another to just insert a USB stick into a random PC and hack it.

pavel_lishin2• 10 years ago

it has also proven to be (mostly) false by Apple and its iPhones

Has it?

https://www.washingtonpost.com/world/national-security/fbi-p...

xoa• 10 years ago

and as we all know once you have physical control security is somewhat out the window anyway.

No, just no. It's long, LONG past time to retire this bit of ancient lore, which came out of a completely different time and place in computing. These days for most users not always having physical control is by far the norm, not the exception. And there are absolutely ways to make to mitigate security issues from physical access, that is after all the entire point of technologies like full disk encryption. FDE is completely pointless if physical security can be taken for granted, it exists entirely because physical security cannot be taken for granted. I presume you don't spend your days advocating nobody bother "because it's pointless anyway."

Technologies like specific CPU/SoC/chipset level hardware security zones, HSMs, use of IOMMUs and the like to prevent DMA from ports, etc. are all there in part to help prevent or mitigate certain physical attacks. For that matter, simple locks and/or sealing of computer units aids with both making attacks more difficult, slower (another key part of threat mitigation) and, just as importantly, making them noticeable. The final fallback of a good security system is to at least try to let the owner know that it broke if all else fails. There is a certain amount of disgruntlement amongst some tech people at highly sealed devices, but they do make it significantly more challenging to perform certain physical attacks quickly or undetectably.

So yes, anything which unexpected speeds up physical attacks, renders them less/unnoticeable, or both, is a legitimate issue. Normal users of portable systems should be able to expect that, under normal circumstances, they can warm lock it (screen lock, put it to sleep), leave for a few minutes, and have a low likelihood of a low energy persistent evil maid attack being pulled off in the mean time. Treating modern security like it only needs to consider servers stashed in a secured room/data center is wrong.

walshemj• 10 years ago

I think if the op ment if you physically can touch the device the game is almost over

throwaway2016a5• 10 years ago

Is there somewhere I can get the source code for this to install on my own Pi 0? I tried a bunch of the links but couldn't find it.

I really dislike this trend of making the link text have little to nothing to do with where the link goes.

Edit: for research, I don't plan on using this against someone.

smarx007• 10 years ago

https://github.com/samyk/poisontap

https://samy.pl/poisontap/

But he has a history of intentionally withholding instructions on how to run it just to avoid script kiddies from using this not for research.

throwaway2016a5• 10 years ago

But he has a history of intentionally withholding instructions on how to run it just to avoid script kiddies from using this not for research.

Interesting approach. Although looking at the Github it seems pretty straight forward (not being a script kiddie I can't speak for if it would be straight forward to them).

ddworken• 10 years ago

Over on his website [0], Samy provides a link to the source:

https://github.com/samyk/poisontap

[0] https://samy.pl/poisontap/

throwaway2016a5• 10 years ago

Thank you both.

swehner• 10 years ago

Wonder if this could be a useful device in some other way (e.g. PC not responding)

Analemma_• 10 years ago

Am I correct in understanding that the device works by presenting itself as an Ethernet adapter and then poisoning the browser cache? Would the solution be as simple as an OS update that didn't use unknown network interfaces until the computer was unlocked?

SCHiM• 10 years ago

I agree, it does appear that way. Do not trust _any_ USB ethernet devices when the device is locked, (security) problem solved.

paulryanrogers• 10 years ago

If there is only one desktop user and their only session is locked, then yes. On a multi user workstation the current behavior--initiating new adapter--may be preferred.

olzaya• 10 years ago

Never trust user input :)

0xdeadbeefbabe• 10 years ago

Never trust

oandrei• 10 years ago

It seems that such exploit would require some kind of `network-manager` running. But if `network-manager` is disabled, and all interfaces configured in `/etc/network/interfaces`, then the new malicious interface will be just ignored. It will not come up.

ohstopitu2• 10 years ago

Since no one seems to be talking about how to secure devices, I guess I'll get started...

USB devices should not accept any incoming connection when the computer is locked. The only use of USB ports when a computer is locked should be for charging devices (current out, no data in). We also need to ensure that devices that were connected before the computer was locked continue to function.

Now obviously, the issue with this would be about external devices that are connected after the device has been locked (drives, keyboards etc. - say for example, keyboard stopped working so you switched it out) but in my opinion, that's an edge case and should not cause too much inconvenience.

theandrewbailey• 10 years ago

The only use of USB ports when a computer is locked should be for charging devices (current out, no data in). We also need to ensure that devices that were connected before the computer was locked continue to function.

Good idea, but...

(hypothetical helpdesk ticket) Oh crap! I knocked my coffee on my keyboard and ruined it as I was sitting down at my locked computer. I connected another keyboard, but the lock screen is not accepting my password!

Allow HID class devices to be connected when locked, and that should be OK.

0x6c6f6c• 10 years ago

At that point the measures taken by IT/helpdesk shouldn't allow for a random person to make changes to the computer security measures.

Scan your badge to helpdesk or contact local IT to do it for you. Proof of identity is required.

Social networking is another thing itself which should be guarded against in any environment, simply suggesting all you have to do is make a helpdesk ticket requires your access already be breached to be done electronically or poor protocols in IT.

ohstopitu2• 10 years ago

While I can't seem to think of a solution of the top of my head....

Sammy had an older video [0] which showed a device that was not a keyboard acting like a keyboard & mouse. While that required an unlocked computer to function, I feel like adding exceptions to a rule would just make it worse.

Another solution would be to sign USB devices (for example, Apple keyboards etc.) and only those signed devices would work when the computer was locked.

[0] https://www.youtube.com/watch?v=aSLEq7-hlmo

nickpsecurity• 10 years ago

Really?

https://hackaday.com/2013/01/26/extracting-data-with-usb-hid...

fweespeech• 10 years ago

Requiring a reboot seems more logical and less likely to result in implementation bugs tbh. The same security measures that prevent abuse would play out as normal. (i.e. If someone physically stole the drive and put it in another computer.)

TazeTSchnitzel• 10 years ago

What about monitors?

Tepix2• 10 years ago

Is this really limited to USB devices? What happens when you plug the ethernet cable into a malicious router?

FilterSweep3• 10 years ago

I didn't realize PoisonTap's creator, Samy, is also the creator of the Evercookie[0], a persistent identifying cookie that remains sharded(then recombines) in your system even after clearing your cookies. While a very cool project, it has some scary implications on users not trained in their removal.

[0] https://github.com/samyk/evercookie

devy• 10 years ago

He's a prolific security researcher. Evercookie got him the fame and since then he's been researching all sorts of security vulnerabilities even on things like combination locks [1], I enjoy his video tutorials a lot.

[1] http://samy.pl/combobreaker/

rudolf02• 10 years ago

I'd argue the Myspace worm [1] was what really got him the fame.

[1] https://en.wikipedia.org/wiki/Samy_(computer_worm)

lolc2• 10 years ago

I don't see how this device is in a more privileged position than the router your system is connected to. The way I see it, any vulnerabilities used in this attack are MITM-vulnerabilities plain and simple and need to be fixed regardless of this specific attack. Am I missing something?

Tepix2• 10 years ago

If the router you are connected to is a WiFi router, then this device is indeed in a more priviledged position because as a LAN connection it will have precedence over WiFi.

lolc2• 10 years ago

Well yes, but that's not the kind of privilege I had in mind. The router could have used the very same attacks with lower risk of detection. So unless you can trust the network you're connected to (which is rare) this attack is not any more dangerous than any other MITM-attack.

I like the attack for how it combines different methods. I just had a hard time understanding the risk from that article.

snake_plissken• 10 years ago

There is a lot of cool hackery going on here but the most beautiful part is how it tricks the target computer into thinking that the entire internet is directly connected to the computer via the USB ethernet interface (I think, I thought the 128.0.0.0 subnet would mean half the addressable space? I've never gotten to 100% understanding of subnets). Although the deception relies on the priority in routing (LAN over outside), it's still a real beaut.

aftbit2• 10 years ago

OpenVPN uses the same trick to establish a higher-priority default gateway:

    def1 -- Use this flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway.

This works because routing tables prioritize "tighter" routes. I do think that 128.0.0.0/1 would only map to 1/2 of the address space. I cannot find the isc-dhcp server config files in the source code to verify. :disappointed:

aftbit2• 10 years ago

Is there some way to configure network-manager to not autoconnect to new ethernet adapters that show up? I don't mind clicking the nm-applet dropdown and clicking on the device...

DINKDINK2• 10 years ago

If you concerned about security, you should have full disk encryption (FileVault) turned on and be powered down anytime you walk away. Though you question still has value for the low percentage of times one forgets to power down.

jbverschoor• 10 years ago

What's the difference between this and just doing the same at the router itself?

OJFord• 10 years ago

    > The primary motivation is to demonstrate that even on a
    > password-protected computer running off of a WPA2 Wi-Fi,
    > your system and network can still be attacked quickly
    > and easily.

Oh no!

    > [... with physical access.]

Oh. Has this ever been disputed?

freehunter• 10 years ago

Generally, once an attacker has physical access to your machine, you're already owned.

However, something like this would make insider threats a bit more dangerous. Leaving your laptop at your desk when you go to a meeting or to the bathroom is perfectly normal, and if a coworker can sneak in and break into your machine while you're not looking, that's a game changer.

6stringmerc2• 10 years ago

As a writer who just included a plot device of providing a loaded USB flash drive as temptation for a target to pick up and plug into their computer and deliver a payload, I'm exceptionally pleased this device reaffirms the risk of malware being deployed by way of USB ports. From time to time it's hard as a writer to try and pick tech and things that hopefully won't sound dated, or if they eventually do, will at least fit within a specific story's time-place-world-setting.

JoeAltmaier• 10 years ago

Isn't how certain uranium refinement centrifuges were compromised? USB drives entering a building contrary to security rules.

6stringmerc2• 10 years ago

I think I recall seeing that one of the pathways of Stuxnet was thought to have been a found USB stick, so yes I think your hypothesis aligns with my studies as well. Humans are so much more weak protocol wise, kind of sad and funny at the same time.

PoisonTap, a $5 tool that invades password-protected computers

Related Stories