PoisonTap - A Hacker Tool (Usage and Prevention)

The working principle of PoisonTap

PoisonTap generates a cascading effect of information leakage, network access, and installation of semi permanent backdoors by leveraging existing trust in various mechanisms of machines and networks, including USB/SSH, DHCP, DNS, and HTTP.

PoisonTap is built for the $5 Raspberry Pi Zero and has no other components except for a micro USB cable and microSD card. It can work on any Raspberry Pi (1/2/3) with Ethernet to USB/Thunderbolt dongles, or on other devices that can simulate USB gadgets such as USB Armory and LAN Turtle.

When PoisonTap (Raspberry Pi Zero&Node.js) is inserted into a locked/password protected computer, it:

• Simulate Ethernet devices through USB (or Thunderbolt)

• Hijacking all Internet traffic from the machine (although it is low priority/unknown network interface)

• Extract and store HTTP cookies and sessions from web browsers of the top 1000000 Alexa ranked websites

• Expose the internal router to attackers, allowing them to rebind remote access through outbound WebSocket and DNS (thank you to Matt Austin for the idea of rebinding!)

• Install a persistent web-based backdoor in HTTP cache for hundreds of thousands of domains and common Javascript CDN URLs, all of which can access users' cookies through cache poisoning

• Allow attackers to remotely force users to send HTTP requests and proxy responses (GET and POST) using any user cookie on the backdoor domain

• No need for machine unlocking

• Even after the device is removed and the attacker leaves, backdoors and remote access still exist

PoisonTap circumvents the following security mechanisms:

• Password protected lock screen

• Routing table priority and network interface service order

• Same origin strategy

• X Framework Options

• HttpOnly Cookie

• SameSite cookie properties

• Two factor/multi factor authentication (2FA/MFA)

• DNS fixed

• Cross Origin Resource Sharing (CORS)

• HTTPS cookie protection when security cookie flag and HSTS are not enabled

Preventing PoisonTap

Server side security

If you are running a web server, protecting PoisonTap is simple:

Only use HTTPS, at least for authentication and authenticated content

To be honest, you should specifically use HTTPS and always redirect HTTP content to HTTPS to prevent users from being deceived into providing credentials or other PII through HTTP

Ensure that security flags are enabled on cookies to prevent HTTPS cookies from leaking through HTTP

When loading remote Javascript resources, use the Subresource Integrity script to mark properties

Using HSTS to prevent HTTPS downgrade attacks

Desktop Security

Adding cement to your USB and Thunderbolt ports will be very effective

Closing the browser every time you leave the machine is fine, but it's completely impractical

Disabling USB/Thunderbolt ports is also effective, but not practical

Locking your computer has no impact as the network and USB stack run when the computer is locked. However, entering encrypted sleep mode that requires a key to decrypt memory (such as FileVault2+deep sleep) can solve most problems as your browser will no longer make requests, even if awakened