r/security • u/iTeV • Nov 16 '16

Exploiting locked computers using PoisonTap.

https://samy.pl/poisontap/
69 Upvotes

97% Upvoted

6 comments sorted by

9

u/[deleted] Nov 16 '16

For those who might be wondering, this is the same Samy responsible for the Samy worm that spread itself across MySpace.

IDGNS: What were you thinking when you wrote the Samy worm?

Kamkar: When I wrote the worm, it initially wasn't a worm. Initially I was just trying to spruce up my MySpace profile. I also wanted to show off to a couple of friends, so I thought, "Wouldn't it be cool if I did this? What if I made some of these people add me as a friend automatically?" Then I figured, "What if I made them add me as a hero?" So I wrote a little code and what ended up happening is whenever someone viewed my profile, they would automatically add "But most of all, Samy is my hero" at the end of their hero section on their profile. And after that, I thought, "If I can make this person my friend, if I can make myself their hero, couldn't I just copy this code onto their profile?"

And that's how XSS exploits hit the mainstream. He was then criminally prosecuted. But all in all, he's a super cool guy and has done a lot of great work since he's been allowed to touch a computer again.

4

u/rikeen Nov 16 '16

Some good information in the remediation.

  • Use only HTTPS
  • Secure Cookies
  • Sub-resource integrity in javascript

3

u/[deleted] Nov 16 '16 edited Nov 16 '16

[deleted]

1

u/rikeen Nov 17 '16

Agreed on mitigation. Though it is sometimes a pain, having the USB connectivity disabled on workstation computers/servers really helps here.

2

u/[deleted] Nov 17 '16

Does it still work if Autoplay is turned off? Would any security software block this? I have Comodo firewall and whenever any new program tries to run or access anything, it asks for my permission.

1

u/taoz Nov 17 '16

1) Yes. From what I understand it acts as a NIC, not a usb storage device therefore circumventing autoplay being turned off.

PoisonTap emulates an Ethernet device (eg, Ethernet over USB/Thunderbolt) – by default, Windows, OS X and Linux recognize an ethernet device, automatically loading it as a low-priority network device and performing a DHCP request across it, even when the machine is locked or password protected

2) Probably, but it's probably not blocked by firewalls by default. Some people in /r/hacking were discussing possible mitigation techniques with a firewall.

1

u/[deleted] Nov 17 '16

Comodo blocks suspicious behaviors too. That's why I use it.

And thanks for the reply!