USB, PoisonTap, used as backdoor tool by hackers 
Hacker Samy Kamkar has created "the most cleverly designed and effective backdoor tool", a USB dongle called PoisonTap. When plugged into a computer, the $5 Raspberry Pi microcomputer creates a new ethernet connection, spoofs page responses and steals cookies, while at the same time remaining hidden in a browser's cache. Kamkar admitted there is no "good, convenient" solution to PoisonTap, and warns users to never leave their browsers open and clear their cache regularly.

You probably know by now that plugging a random USB into your PC is the digital equivalent of swallowing a pill handed to you by a stranger on the New York subway. But serial hacker Samy Kamkar's latest invention may make you think of your computer's USB ports themselves as unpatchable vulnerabilities---ones that open your network to any hacker who can get momentary access to them, even when your computer is locked.

Today Kamkar released the schematics and code for a proof-of-concept device he calls PoisonTap: a tiny USB dongle that, whether plugged into a locked or unlocked PC, installs a set of web-based backdoors that in many cases allow an attacker to gain access to the victim's online accounts, corporate intranet sites, or even their router. Instead of exploiting any glaring security flaw in a single piece of software, PoisonTap pulls off its attack through a series of more subtle design issues that are present in virtually every operating system and web browser, making the attack that much harder to protect against.

"In a lot of corporate offices, it’s pretty easy: You walk around, find a computer, plug in PoisonTap for a minute, and then unplug it," Kamkar says. The computer may be locked, he says, but PoisonTap "is still able to take over network traffic and plant the backdoor."

Rather than installing malware, which can often be easily detected, PoisonTap creates its backdoor access by hiding malicious code in the victim's browser cache. "This is going to be really hard to detect," says Jeremiah Grossman, a web security researcher and chief of security strategy at the firm SentinelOne. "Provided you have physical access, I think it’s actually the most cleverly designed and effective backdoor tool that I’ve seen."

A Long Chain of Weak Links

Kamkar's trick works by chaining together a long, complex series of seemingly innocuous software security oversights that only together add up to a full-blown threat. When PoisonTap---a tiny $5 Raspberry Pi microcomputer loaded with Kamkar's code and attached to a USB adapter---is plugged into a computer's USB drive, it starts impersonating a new ethernet connection. Even if the computer is already connected to Wifi, PoisonTap is programmed to tell the victim's computer that any IP address accessed through that connection is actually on the computer's local network rather than the internet, fooling the machine into prioritizing its network connection to PoisonTap over that of the Wifi network.

With that interception point established, the malicious USB device waits for any request from the user's browser for new web content; if you leave your browser open when you walk away from your machine, chances are there's at least one tab in your browser that's still periodically loading new bits of HTTP data like ads or news updates. When PoisonTap sees that request, it spoofs a response and feeds your browser its own payload: a page that contains a collection of iframes---a technique for invisibly loading content from one website inside another---that consist of carefully crafted versions of virtually every popular website address on the internet. (Kamkar pulled his list from web-popularity ranking service Alexa's top one million sites.)

As it loads that long list of site addresses, PoisonTap tricks your browser into sharing any cookies it's stored from visiting them, and writes all of that cookie data to a text file on the USB stick. Sites use cookies to check if a visitor has recently logged into the page, allowing visitors to avoid doing so repeatedly. So that list of cookies allows any hacker who walks away with the PoisonTap and its stored text file to access the user's accounts on those sites.

Poisoned Caches

PoisonTap's initial attack isn't as serious as it may sound: It only works on sites that use HTTP rather than the far more secure HTTPS protocol, which signals to a browser to only share cookie data with a verified site. But stealing cookies is merely the first in a series of techniques. As the little USB stick loads the collection of site addresses in the user's browser, it also tricks the browser into storing its own, carefully manipulated version of those sites in its cache---the feature of browsers that maintains pieces of websites on your computer rather than loading them from the web again and again. That's called cache poisoning, and it means that even after PoisonTap is unplugged, the browser will still continue to load the corrupted version of the sites it planted in the browser's cache.

Each of the manipulated versions of the sites PoisonTap tucks into the browser's cache includes a kind of persistent communications channel---what's known as a websocket---that connects the site back to a server controlled by the hacker. Through hidden iframes, the hacker can make HTTP requests through the cached site backdoors and receive responses, continuing to exploit the victim's browser without detection long after the hacker has pulled out PoisonTap and walked away. "Their browser basically acts as a tunnel into their local area network," Kamkar says.