Meet PoisonTap, the $5 tool that ransacks password-protected computers

Enlarge (credit: Samy Kamkar)

The perils of leaving computers unattended just got worse, thanks to a newly released exploit tool that takes only 30 seconds to install a privacy-invading backdoor, even when the machine is locked with a strong password.

PoisonTap, as the tool has been dubbed, runs freely available software on a $5/£4 Raspberry Pi Zero device. Once the payment card-sized computer is plugged into a computer's USB slot, it intercepts all unencrypted Web traffic, including any authentication cookies used to log in to private accounts. PoisonTap then sends that data to a server under the attacker's control. The hack also installs a backdoor that makes the owner's Web browser and local network remotely controllable by the attacker.

(credit: Samy Kamkar)

PoisonTap is the latest creation of Samy Kamkar, the engineer behind a long line of low-cost hacks, including a password-pilfering keylogger disguised as a USB charger, a key-sized dongle that jimmies open electronically locked cars and garages, and a DIY stalker app that mined Google Streetview. While inspiring for their creativity and elegance, Kamkar's inventions also underscore the security and privacy tradeoffs that arise from an increasingly computerized world. PoisonTap continues this cautionary theme by challenging the practice of password-protecting an unattended computer rather than shutting it off or, a safer bet still, toting it to the restroom or lunch room.

Read 11 remaining paragraphs | Comments

Linux bug leaves USA Today, other top sites vulnerable to serious hijacking attacks

(credit: Cao et al.)

Computer scientists have discovered a serious Internet vulnerability that allows attackers to terminate connections between virtually any two parties and, if the connections aren't encrypted, inject malicious code or content into the parties' communications.

The vulnerability resides in the design and implementation of RFC 5961, a relatively new Internet standard that's intended to prevent certain classes of hacking attacks. In fact, the protocol is designed in a way that it can easily open Internet users to so-called blind off-path attacks, in which hackers anywhere on the Internet can detect when any two parties are communicating over an active transmission control protocol connection. Attackers can go on to exploit the flaw to shut down the connection, inject malicious code or content into unencrypted data streams, and possibly degrade privacy guarantees provided by the Tor anonymity network.

At the 25th Usenix Security Symposium on Wednesday, researchers with the University of California at Riverside and the US Army Research Laboratory will demonstrate a proof-of-concept exploit that allows them to inject content into an otherwise legitimate USA Today page that asks viewers to enter their e-mail and passwords. The malicious, off-site JavaScript code attack is possible because the vulnerable USA Today pages aren't encrypted. Even if they were protected, attackers could still terminate the connection. Similar attacks work against a variety of other unidentified sites and services, as long as they have long-lived connections that give hackers enough time—roughly 60 seconds—to carry out the attack.

Read 8 remaining paragraphs | Comments

The massive password breach that wasn’t: Google says data is 98% “bogus”

(credit: CBS)

Earlier this week, mass panic ensued when a security firm reported the recovery of a whopping 272 million account credentials belonging to users of Gmail, Microsoft, Yahoo, and a variety of overseas services. "Big data breaches found at major email services" warned Reuters, the news service that broke the news. Within hours, other news services were running stories based on the report with headlines like "Tech experts: Change your email password now."

Since then, both Google and a Russia-based e-mail service unveiled analyses that call into question the validity of the security firm's entire report.

"More than 98% of the Google account credentials in this research turned out to be bogus," a Google representative wrote in an e-mail. "As we always do in this type of situation, we increased the level of login protection for users that may have been affected." According to the report, the compromised credential list included logins to almost 23 million Gmail accounts.

Read 10 remaining paragraphs | Comments

Airplanes grounded in Poland after hackers allegedly attack flight plan computer

Around 1400 passengers at Warsaw's Chopin (Okecie) airport in Poland were grounded on Sunday after hackers allegedly attacked the computer system used to issue flight plans to the airplanes. The source of the attack isn't yet known.

The alleged hack targeted LOT, the state-owned flag-carrying Polish airline. Reuters is reporting that the attack took place on Sunday afternoon, and was fixed about five hours later. 10 LOT flights were cancelled and about a dozen more were delayed, according to a LOT spokesman.

The spokesman didn't provide any details of what had actually occurred, though he did give away this one tantalising morsel: "We're using state-of-the-art computer systems, so this could potentially be a threat to others in the industry." The spokesman said that flights that were already in the air were not affected by the hack and could land normally. Also, the hack didn't affect the airport itself; it was just the LOT computers.

Read 3 remaining paragraphs | Comments