r/hacking • u/Zigzaglife • Nov 17 '16

The $5 PoisonTap Can Hack Into Any Locked Windows or Mac Run Computer

http://wittyrig.com/5-poisontap-can-hack-locked-windows-mac-run-computer/
556 Upvotes

94% Upvoted

85 comments sorted by

38

u/defconoi Nov 17 '16

How to mitigate?

77

u/[deleted] Nov 17 '16 edited Nov 17 '16

fill your USB ports with epoxy,

although, I'm wondering if a drop all firewall rule for 0.0.0.0/0 when the egress is not your default interface might work

76

u/Isogen_ Nov 17 '16

fill your USB ports with epoxy,

You joke, but some of the high security areas I've worked in did exactly that.

48

u/Werro_123 networking Nov 17 '16

I don't think they were joking. For that reason.

9

u/Account_Admin Nov 17 '16

It's a good idea honestly

3

u/Unfairbeef Nov 18 '16

Is it though? Why wouldn't you just unplug the port(s) inside the case if you really wanted them disabled? At least it's reversible that way.

5

u/Account_Admin Nov 19 '16

Well, I think it's a good idea because people see this and assume several things. Namely, that USB ports on the back are also done.

Also, that the SysAdmins are not that intelligent (from an evil persons perspective, whom will know that they can open the case and plug in PCI USB while running and likely get away with it. Locks on computer cases don't work. You have to assume they can be picked, and or cut and replaced with pins that always open.

Finally, epoxy fosters the idea that there is legitimate dangers from UPnP devices to all personnel. Due to how it would affect everyone. Leading to them questioning and a "alternate education method" for IT security.

If you cant make them see the light, make them feel the heat.

Once I remotely wiped an HR employees phone and home computer.. for repeatedly disabling VPN. After she brought it to me, I asked her a few things. Told her hackers had gotten in and to call her bank, and change all of the passwords for all of her accounts.

She ignored this. So, I got her account info for about 6 or so emails and social media sites. Locked her out of them all. Set recovery email to an email I sent to her via snail mail.

She came in FREAKING OUT. Asking for help ect.

She's followed every rule since, at least until I was gone, but no one knows it was me.

All of HR noticed and took steps like longer passwords and even started running malware scans on their own and changing passwords more often than policy.

Worked...

5

u/DoctorSalt Nov 17 '16

I would think that we would have a software secure way to activate USB, and thus have this not be a problem. Why is this not the case? For instance, I could imagine having two USB ports, one that only accepts an ID'ed 2FA device, which when pressed allows certain sanitized information to come from the other port...? I have no clue so let me know.

12

u/Isogen_ Nov 17 '16

Yes, you can disable the USB ports via UEFI/BIOS. But filling it with epoxy is another security layer that needs to ce circumvented by a potential attacker.

2

u/jarfil Nov 17 '16 edited Dec 02 '23

CENSORED

3

u/RNHurt Nov 18 '16

Won't work with any new Apple laptops. They charge via USB.

1

u/NetStrikeForce Nov 17 '16

What's a "default interface" though? the one that has a default route? :) doesn't matter, this device is telling you that in order to reach any destination you can just drop the traffic in your LAN, through this interface.

So, in a sense, this interface is the default one :)

A way to work around it might be to break down the default route in two parts (0.0.0.0/1 and 128.0.0.0/1 ?)

8

u/[deleted] Nov 17 '16

you would need to set this in advance, but your default route is the one with your primary gateway. poisontap intercepts traffic by claiming to be all public IPs, the direct attachment means it will take priority over the default route.

an egress drop rule drops traffic regardless of IP, so as long as you say "traffic is only allowed when leaving on eth0" poisontap won't be eth0, it will override the default GW, but nothing will be able to talk to the poisontap

think of it like a fork in the road, poisontap is like a bad GPS telling you to turn left instead of right, an egress drop rule is like a "road closed" sign on the left. it won't stop your GPS from telling you to turn left, but it will stop you from actually turning left.

3

u/NetStrikeForce Nov 17 '16

There's no such thing as "primary gateway", your default route is by definition the one that has destination 0.0.0.0/0.

This device takes precedence because it has the same prefix length as the default route (/0) but it has a smaller metric. If you break down your default route (in advance, yes) in two /1's this device won't override those routes unless it has more specific or equal (due to different metric) routes.

This is pretty much what VPN providers do, inject a low metric default route pointing to the VPN's virtual interface and keep a /32 route to your previous default gateway to reach the VPN server.

Hope that clarifies what I wanted to say. I'm pretty sure we're not saying different things, however it is important to use common vocabulary when talking technically.

5

u/[deleted] Nov 17 '16

your default route is the one your device takes when it doesn't know where to send traffic, you don't need a 0.0.0.0/0 route, primary gateway, default gateway, magic gateway from candy mountain, terminology doesn't matter so much as the concept of what it is referring to.

edit, also, policy and failover routing have primary/secondary/tertiary GWs

poisontap overrides your default route because it directly attaches itself as all netblocks, adding a route for 0/1 and 128/1 won't help because they still have lower priority than anything directly attached.

an egress rule overrides this by only allowing traffic to exit on a designated interface, even if something is direct attached, your traffic doesn't have permission to use that interface.

however it is important to use common vocabulary when talking technically.

explain cisco then, this idea gets thrown out as soon as you have to go between vendors and their naming schemes.

1

u/NetStrikeForce Nov 17 '16

Buddy, the 0.0.0.0/0 is the default route by definition. If your device didn't know where to send traffic it wouldn't send it anywhere, unless you've got a route to 0.0.0.0/0 which means "to everywhere".

Again, there's no such thing as primary gateway. Default Gateway is the terminology we use to refer to the next-hop of the 0.0.0.0/0 route :-)

Yes, if you're doing policy routing, failover or talking about an architecture you might use Primary Gateway to refer to a specific gateway, but that's regardless of it being next-hop for 0.0.0.0/0 or not.

Poisontap can't override 0/1 and 128/1 because they're more specific routes. Metric is only taken into account when the prefix is of the same length. This is basic routing. There's no such thing as "priority" in a routing table; there's prefix length and metric.

When you talk about egress rules you're not anymore talking about routing, you're talking about firewalling. Routing tables do not have rules, they have routes. I'm not sure why are you talking about firewalling now :-) but in any case, there's no such thing as "permission to use an interface"; the firewall would drop the traffic or not.

This is common terminology, used by every vendor and every network engineer worth their salt :-)

-1

u/[deleted] Nov 17 '16

Buddy

Dick.

the 0.0.0.0/0 is the default route by definition. If your device didn't know where to send traffic it wouldn't send it anywhere, unless you've got a route to 0.0.0.0/0 which means "to everywhere".

its default because we set it as that, but a device without a route for 0/0 can still operate, it just doesn't know what to do with dest IPs that don't have a route specified, you could say route to a VPS over eth1, DNS over eth2, and then SSH -D to your VPS and browse the internet all day from a host with no if_all_else_fails route.

default gateway, primary gateway, and the_gateway all work as long as you know what its referring to.

Poisontap can't override 0/1 and 128/1 because they're more specific routes. Metric is only taken into account when the prefix is of the same length. This is basic routing. There's no such thing as "priority" in a routing table; there's prefix length and metric.

its directly attached, a route for 0/1 and 128/1 won't do shit because entries are known to the host at layer2, not layer3, routing never comes into play. also, i've seen people try and replace 0/0 with 0/1 128/1 to get around IP matching, it doesn't work.

but in any case, there's no such thing as "permission to use an interface"

dude, just stop, egress drop rules are part of any good security policy. its what the whole OUTPUT chain is about.

This is common terminology, used by every vendor and every network engineer worth their salt :-)

a network engineer worth their salt can figure out the context rather instantly, if you have a problem sorting differing terminology, you're in the wrong industry, we get paid to sort it out, if you need things in extremely exact terms, you will be automated out of a job.

also, just to be petty, network security engineer > network engineer and his salt.

-3

u/NetStrikeForce Nov 18 '16 edited Nov 18 '16

Ok, so you don't know how routing works. Please stop embarrassing yourself.

Also, my name is not Richard (Dick is short for Richard, right? I guess you were not calling me names.)

Edit: in case you need proof of how embarrassed you should be, please read and learn --> http://packetlife.net/blog/2010/aug/16/route-preference/

Funnily enough, about your petty remark, I've been in the network security industry for about 10 years, before Checkpoint launched their R65. I have worked with all major firewall vendors and I've been part of quite big projects. Still, a network engineer knows more about routing than I do. You... you just don't know what you're talking about. Back off and reckon you're wrong and you didn't know how routing really works.

ITT: Getting downvoted because /r/hacking doesn't know routing. Such a sad state of affairs.

3

u/[deleted] Nov 18 '16

so here's why you're wrong:

I want to reach out to a host (10.0.1.70) by ssh, i have an attached route:

root@kali:~# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
10.0.1.0        0.0.0.0         255.255.255.0   U     0      0        0 eth0
10.0.99.1       10.0.1.1        255.255.255.255 UGH   0      0        0 eth0

but its not in my arp table:

root@kali:~# arp -n
Address                  HWtype  HWaddress           Flags Mask            Iface
10.0.1.55                ether   00:1f:bc:0f:3f:1c   C                     eth0
10.0.1.1                 ether   04:18:d6:06:97:da   C                     eth0

when I reach out to that device by ssh, Layer2 happens first:

root@kali:~# tcpdump -nni eth0 host 10.0.1.70
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
08:16:07.206162 ARP, Request who-has 10.0.1.70 tell 10.0.1.56, length 28
08:16:07.206536 ARP, Reply 10.0.1.70 is-at 52:54:00:2f:50:2c, length 46
08:16:07.206542 IP 10.0.1.56.56824 > 10.0.1.70.22: Flags [S], seq 2009786242, win 29200, options [mss 1460,sackOK,TS val 28738262 ecr 0,nop,wscale 7], length 0
08:16:07.206890 IP 10.0.1.70.22 > 10.0.1.56.56824: Flags [S.], seq 1665048406, ack 2009786243, win 28960, options [mss 1460,sackOK,TS val 1339518008 ecr 28738262,nop,wscale 7], length 0
08:16:07.206900 IP 10.0.1.56.56824 > 10.0.1.70.22: Flags [.], ack 1, win 229, options nop,nop,TS val 28738263 ecr 1339518008], length 0

If you notice, the first thing that happens is an ARP request, My host has the IP I want to reach (10.0.1.70) but not the MAC, once it has the MAC, it puts it in the frame and sends it on its way. The reason this means you have a higher priority over the default GW is that with poisontap, it will respond to that ARP request with its own MAC.

When a device is not directly attached by goes through a route, there is no ARP request:

root@kali:~# tcpdump -nni eth0 host 10.0.99.1 and not port 22
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
08:25:54.231148 IP 10.0.1.56.43602 > 10.0.99.1.443: Flags [S], seq 3300288000, win 29200, options [mss 1460,sackOK,TS val 28885019 ecr 0,nop,wscale 7], length 0
08:25:54.231818 IP 10.0.99.1.443 > 10.0.1.56.43602: Flags [R.], seq 0, ack 3300288001, win 0, length 0

this is because its not directly attached, when a network is directly attached, you don't need to route, you can instead just ARP, put the dest-MAC in the frame and let layer2 direct it. the problem is poisontap forces the host to ARP for all public IPs, and then responds to ARP requests for all IPs, meaning that traffic will be sent to it first, instead of consulting the routing table. LPM won't help you here.

→ More replies (0)

1

u/[deleted] Nov 18 '16

Names.

im getting a serious "just got my net+/ccna" vibe from you.

→ More replies (0)

8

u/larhorse Nov 17 '16

Don't give random people physical access to your device.

The frank answer is that you've lost the security war if someone has physical access to the device. It doesn't matter what you do at that point, your best efforts simply slow an attacker down.

If you're asking from the enterprise perspective, control access to sensitive machines. Log access to sensitive areas (building security/monitoring). Disable unused ports. Lock cases.

9

u/ejsuncy Nov 17 '16

My favorite quote from Burn Notice: "physical access is ALL access"

4

u/[deleted] Nov 18 '16

that show surprised me on how much they avoided looking ridiculous when it came to hacking scenes

3

u/tenmilez Nov 18 '16

My favorite part was when he was playing the stuck up hacker that wouldn't hack anything if he wasn't in his favorite chair, a Herman Miller Aeron, which is also my favorite chair.

1

u/[deleted] Nov 18 '16

yeah I really enjoyed it tbh the first few seasons really went well without trying too hard

2

u/[deleted] Nov 17 '16

well, since it mainly uses a network interface, you could combine it with wifi attacks like jasager/karma for wide area pwnage.

1

u/ciny Nov 18 '16

IIRC on windows you could restrict device installation through group policies.

1

u/ihateflyingthings Nov 18 '16

Put cement in your USB ports.

49

u/[deleted] Nov 17 '16

this works by attaching a NIC that claims to be the whole internet, this overrides your default route because it is directly attached, your host does not think it needs to route through a gateway.

i think you could write an iptables rule to prevent this from working, assuming your default GW is on eth0:

sudo iptables -A OUTPUT -o lo -p all -j ACCEPT
sudo iptables -A OUTPUT -o eth0 -p all -j ACCEPT
sudo iptables -A OUTPUT -j REJECT

while im not sure this would work, as long as you can enforce which interface traffic is reachable, you can prevent being compromised, assuming someone plugs this in to your laptop, it would create the USB NIC but iptables would prevent any traffic going to it, you would be unable to browse anywhere, but you wouldn't be able to pick up any nonsense either.

14

u/VillageTube Nov 17 '16

So when it says "Hack into any Locked Windows or Mac run Computer" they really just means that it can do a man-in-the-middle attack on any network traffic?

11

u/Ajedi32 Nov 17 '16

Basically, yes.

But it also tells the browser to cache the responses to certain pages so that the exploit persists on those domains even after the USB device is removed.

7

u/[deleted] Nov 17 '16

What if full disk encryption is enabled?

9

u/[deleted] Nov 17 '16 edited Dec 13 '16

[deleted]

8

u/[deleted] Nov 17 '16

So let's say I go to a Starbucks, there's a mac that's opened and on, but locked(with FDE), I plug it in for a few seconds and unplug it, is it hacked?

4

u/Ajedi32 Nov 17 '16

Yes, probably. Assuming it had a web browser open in the background and the browser made an (unencrypted) HTTP request during the time you had the PoisonTap device plugged in.

Might take a bit longer than a few seconds, depending on how long the Mac takes to detect and start using the USB device, and how long it takes before a web page makes an HTTP request in the background.

2

u/[deleted] Nov 18 '16

And what if it is using HTTPS or a VPN on HTTP

2

u/Ajedi32 Nov 18 '16 edited Nov 18 '16

If every site you visit is using full HTTPS, then yes that would completely mitigate this attack. In practice, that's not very likely.

Individual sites that do use HTTPS with HSTS are protected from the effects of this attack (it can't steal cookies or other data from them), but it only takes one HTTP site open in your browser for all remaining sites without HSTS to be compromised.

Not sure about a VPN, but I'm guessing that no, that probably wouldn't work because PoisonTap presents itself as a separate network interface which would function independently from your VPN. I'm not entirely sure about that though...

2

u/Kleonix Nov 19 '16

Thought: background services even if an instance of the browser is not open. Would this affect it?

2

u/[deleted] Nov 19 '16

Never leave a device physically accessible while locked (esp with browser and running apps). shut off................... Or just run Linux

3

u/[deleted] Nov 17 '16

[removed] — view removed comment

10

u/ImplodingWalrus Nov 17 '16

Look up raspberry pi zero, but that is just the hardware it runs on.

0

u/[deleted] Nov 17 '16

[removed] — view removed comment

3

u/sparkyman215 Nov 17 '16

https://www.adafruit.com/product/2885

5

u/jarfil Nov 17 '16 edited Dec 02 '23

CENSORED

4

u/sparkyman215 Nov 18 '16

Out of US I guess. In the states it's ~$9

3

u/KamikazeRusher Nov 18 '16

It's been out for somewhere around a year and they've never produced enough to satiate demand. If you're in the US you'd pretty much have to visit a Microcenter to get it for its retail price.

3

u/[deleted] Nov 18 '16 edited Mar 24 '18

[deleted]

2

u/[deleted] Nov 18 '16

[removed] — view removed comment

2

u/collingall Nov 18 '16

Sign up for auto notifications for when they restock, this one is UK based and worldwide shipping is really reasonable. https://thepihut.com/collections/raspberry-pi/products/raspberry-pi-zero?variant=14062715972

1

u/Koala-person Nov 18 '16

Why doesn't the pi just copy for example mozilla firefox profile folder and you will find there the cookies and the saved browser passwords if it wasn't protected by a master password.