3 ms·

This seems like it would be noticed quickly if access to the internet stops working. Can it proxy intercepted traffic to the real internet? Does the raspber

This seems like it would be noticed quickly if access to the internet stops working. Can it proxy intercepted traffic to the real internet? Does the raspberry pi need its own internet connection in order to act as a proxy, or can it get a real internet connection via the host device somehow?

stephengillie 10y ago
PoisonTap responds with a barrage of data-caching malicious iframes for the top million Alexa sites. And those iframes, equipped with back doors, stick around until someone clears them out. It sounds like this is the default response to any HTTP request, so I'm guessing these top million iframes are stored locally on the device. The TechCrunch photo shows a 32GB card - how many iframes could that store, alongside a tiny Linux-based OS? And it's not that attacks can only happen while the PoisonTap is connected - it's that connecting the PoisonTap for just 60 seconds or so will likely have it install itself and respond to at least 1 request, seeding the laptop, desktop, or server with 1 million backdoor'd iframes, likely in some background AJAX process that you don't even know is happening in your browser, or when some process like Windows Update or Chrome or Firefox or Safari or Spotify or Skype or Hangouts or Dropbox tries to phone home. Or anywhere. Then, once the PoisonTap is disconnected, those 1 million iframes are free to route through the same wifi or other connection the device used prior to the attack, to the general internet, for whatever secondary steps the attackers choose to perform. What may be even more worrisome would be something like this, but with wifi capabilities. It could pose as a free wifi hotspot, possibly even bridging other free / easily hackable / commonly-known wifi hotspots - while replacing ad banners with the same malicious barrage. Or even filtering ads completely, for a "Knight in Shining Armor" solution.
- Tepix 10y ago
  It generates the response to the 1 million Alexa sites on the fly, no need to actually store them on the Pi Zero.
m00x 10y ago
If you add a wifi module, you could potentially configure it to connect to the hotspot, then act as a network bridge for the laptop. Something like this: http://www.glennklockwood.com/sysadmin-howtos/rpi-wifi-island.html http://www.glennklockwood.com/sysadmin-howtos/rpi-wifi-islan...

stephengillie 10y ago

PoisonTap responds with a barrage of data-caching malicious iframes for the top million Alexa sites. And those iframes, equipped with back doors, stick around until someone clears them out. It sounds like this is the default response to any HTTP request, so I'm guessing these top million iframes are stored locally on the device. The TechCrunch photo shows a 32GB card - how many iframes could that store, alongside a tiny Linux-based OS? And it's not that attacks can only happen while the PoisonTap is connected - it's that connecting the PoisonTap for just 60 seconds or so will likely have it install itself and respond to at least 1 request, seeding the laptop, desktop, or server with 1 million backdoor'd iframes, likely in some background AJAX process that you don't even know is happening in your browser, or when some process like Windows Update or Chrome or Firefox or Safari or Spotify or Skype or Hangouts or Dropbox tries to phone home. Or anywhere. Then, once the PoisonTap is disconnected, those 1 million iframes are free to route through the same wifi or other connection the device used prior to the attack, to the general internet, for whatever secondary steps the attackers choose to perform. What may be even more worrisome would be something like this, but with wifi capabilities. It could pose as a free wifi hotspot, possibly even bridging other free / easily hackable / commonly-known wifi hotspots - while replacing ad banners with the same malicious barrage. Or even filtering ads completely, for a "Knight in Shining Armor" solution.

Tepix 10y ago
It generates the response to the 1 million Alexa sites on the fly, no need to actually store them on the Pi Zero.

m00x 10y ago

If you add a wifi module, you could potentially configure it to connect to the hotspot, then act as a network bridge for the laptop. Something like this: http://www.glennklockwood.com/sysadmin-howtos/rpi-wifi-island.html http://www.glennklockwood.com/sysadmin-howtos/rpi-wifi-islan...