PoisonTap - siphons cookies, exposes internal router & installs web backdoor on locked computers

All credits go to samy kamkar.
He is the guy that released this.
I just thought I would share it here.

PoisonTap - siphons cookies, exposes internal router & installs web backdoor on locked computers.

PoisonTap is built for the $5 Raspberry Pi Zero without any additional components other than a micro-USB cable & microSD card, or can work on any Raspberry Pi (1/2/3) with an Ethernet-to-USB/Thunderbolt dongle, or can work on other devices that can emulate USB gadgets such as USB Armory and LAN Turtle.

When PoisonTap (Raspberry Pi Zero & Node.js) is plugged into a locked/password protected computer, it:
emulates an Ethernet device over USB (or Thunderbolt)
hijacks all Internet traffic from the machine (despite being a low priority/unknown network interface)
siphons and stores HTTP cookies and sessions from the web browser for the top 1,000,000 websites
exposes the internal router to the attacker, making it accessible remotely via outbound WebSocket and DNS rebinding (thanks Matt Austin for rebinding idea!)
installs a persistent web-based backdoor in HTTP cache for hundreds of thousands of domains and common Javascript CDN URLs, all with access to the user’s cookies via cache poisoning
allows attacker to remotely force the user to make HTTP requests and proxy back responses (GET & POSTs) with the user’s cookies on any backdoored domain
does not require the machine to be unlocked
backdoors and remote access persist even after device is removed.

Custom spoilers do not work here at totseans. (Well properly):
.
Custom spoiler tags:
[spoiler=name me]
What you want in the spoiler then close with [\spoiler]
OK so it "kinda" works in code tags (cannot see whats inside though)
Also seems it only kind of works in message preview not in actual posted information.
We don't need to but for research sake,
let's try something else .
[pooiler=name me]
What you want in the spoiler then close with [\pooiler]
**should be spoiler not pooiler
And because
Print (" this will show up"); 
<p> So will this. </p>
// This is not meant to show up
  <!-- this shouldn't show either -->
/*Technically this 
shouldn't either*/
Printgln (" but this should ");

"Safely Deposited Box" or "STOP BOX (storage off property)" of successful author:
E5PLXD2TZ4.jpg

A few people have asked so.
The meaning behind the word enso:
ensō, are symbols of teaching, reality, enlightenment, and a myriad of things in between.

Seemingly perfect in their continuity, balance, and sense of completeness, and yet often irregular in execution, ensō are at once the most fundamentally simple and the most complex shape.
They seem to leave little room for variation, and yet in the hands of Zen masters, the varieties of personal expression are endless.
Ensō evoke power, dynamism, charm, humor, drama, and stillness.

Comments

  • Fuck, that would wreck havoc in University or Cafe :(
    Disclaimer: I am writer and I love writing fucked up things, I am not responsible if those fucked up things are accurate or get used for illegal purposes. Please, do not bother me."

    IRC: https://rizon.net/chat #totse
  • Dfg wrote: »
    Fuck, that would wreck havoc in University or Cafe :(

    Yeah man... Could really wreck havoc anywhere...

    Definitely some pretty crazy tech.
    Custom spoilers do not work here at totseans. (Well properly):
    .
    Custom spoiler tags:
    [spoiler=name me]
    What you want in the spoiler then close with [\spoiler]
    
    OK so it "kinda" works in code tags (cannot see whats inside though)
    Also seems it only kind of works in message preview not in actual posted information.
    We don't need to but for research sake,
    let's try something else .
    [pooiler=name me]
    What you want in the spoiler then close with [\pooiler]
    **should be spoiler not pooiler
    
    And because
    Print (" this will show up"); 
    <p> So will this. </p>
    // This is not meant to show up
      <!-- this shouldn't show either -->
    /*Technically this 
    shouldn't either*/
    Printgln (" but this should ");
    

    "Safely Deposited Box" or "STOP BOX (storage off property)" of successful author:
    E5PLXD2TZ4.jpg

    A few people have asked so.
    The meaning behind the word enso:
    ensō, are symbols of teaching, reality, enlightenment, and a myriad of things in between.

    Seemingly perfect in their continuity, balance, and sense of completeness, and yet often irregular in execution, ensō are at once the most fundamentally simple and the most complex shape.
    They seem to leave little room for variation, and yet in the hands of Zen masters, the varieties of personal expression are endless.
    Ensō evoke power, dynamism, charm, humor, drama, and stillness.
Sign In or Register to comment.