Compromising a computer's security has never been so cost-effective. While writing code takes time and effort, what every security enthusiast always seeks is an effective platform to deploy it, and that's where the Raspberry Pi Zero comes in. The risks of leaving a computer unattended take on new dimensions with PoisonTap, an attack capable of intercepting Web traffic even on a password-protected system, and installing a backdoor, enabling remote access.
I'm the only one who touches the computers at home, and any Internet-related request goes through my hands, making me act like some kind of proxy. It's not a rule or anything like that: They know computers are work resources and that I need them in optimal condition. Some shut down or go into hibernation after a few minutes, and all are password-protected. That should be enough, supposedly, but now let's apply these parameters to public computers, office terminals, and any other system left unattended for a while. The possibilities of compromising such a system are already huge once you have physical access, but if time is short, the idea is to automate the attack to the extreme.
This brings us to PoisonTap, a new project by Samy Kamkar, known for geolocation vulnerabilities, the SkyJack that attacks drones in the air, and his RollJam accessory that intercepts remote control signals to open doors. The foundation of PoisonTap is a Raspberry Pi Zero, which despite its poor availability still costs five dollars, and a bit of software, Node.js to be precise. In general terms, once PoisonTap is connected to a USB port, it fools the computer so that it doesn't present itself as a USB device but as an Ethernet connection that simulates being the Internet (in other words, it becomes a gateway). As soon as the computer sends an HTTP request from a browser (be it telemetry, website advertising, etc.), PoisonTap responds with a barrage of malicious iframes for a million sites, the most important according to Alexa. To this we must add the opening of a backdoor and the collection of cookies and entire sessions, which the attacker can manage from a remote server.
System administrators can thwart PoisonTap at its root by forcing HTTPS over all generated traffic; however, the story is a bit more complicated on the terminal side. PoisonTap's effectiveness depends on many factors (an encrypted computer with deep hibernation might ignore the physical connection entirely), but its first move exposes a detail that companies like Apple and Microsoft should address once and for all. It is unacceptable that an operating system immediately responds, with no security considerations, to anything connected via USB. One of the first things malware exploited was the famous AutoRun (remember all those autorun.inf files running junk?). How long must we wait for something like an "automatic vote of no confidence" to be implemented on unknown devices as soon as they are connected? Back then we mocked the paranoid User Account Control a lot, but with something like PoisonTap out there, no one is laughing...
