It’s conventional wisdom these days that your computer should be password protected so no one can mess with it while you’re away, but a new exploit has rendered that accepted reality void. Now, even if your computer is password protected, someone with access to it can install a privacy bypassing backdoor. And all they need is a $5 Raspberry Pi.
Meet PoisonTap, the free software turning your humble, single-board computer into a hacking behemoth.
PoisonTap is a freely available program that runs on a Raspberry Pi Zero. Once loaded onto the credit card-sized computer, an unscrupulous hacker only needs to plug it into your computer’s USB slot to access all of your unencrypted Web traffic, from the sites you visit to the cookies your browser uses to log into your accounts.
The information is then sent back to the attacker via a server they control. Perhaps even more impressively, PoisonTap’s backdoor allows the attacker to control the owner’s personal browser and local network remotely.
PoisonTap was created by Samy Kamkar, an engineer and programmer who will be familiar to Daily Dot readers thanks to projects like hacking garage doors, hacking drones, or building a lock picking robot. Kamkar’s inventions aren’t necessarily designed to hurt users; they exist to show security flaws in the day-to-day systems. In a statement to Ars Technica, he explained why he made something as potentially dangerous as PoisonTap:
“The primary motivation is to demonstrate that even on a password-protected computer running off of a WPA2 Wi-Fi, your system, and network can still be attacked quickly and easily. Existing non-HTTPS website credentials can be stolen, and, in fact, cookies from HTTPS sites that did not correctly set the ‘secure’ flag on the cookie can also be siphoned.”
You can watch a demonstration of PoisonTap by Kamkar below. If you’d like to view the source code and technical details you can find those here. We just ask that you not use this program to be a jerk.
H/T Ars Technica