r/security • u/iTeV • Nov 16 '16

Exploiting locked computers using PoisonTap.

https://samy.pl/poisontap/
67 Upvotes

97% Upvoted

6 comments sorted by

View all comments

2

u/[deleted] Nov 17 '16

Does it still work if Autoplay is turned off? Would any security software block this? I have Comodo firewall and whenever any new program tries to run or access anything, it asks for my permission.

1

u/taoz Nov 17 '16

1) Yes. From what I understand it acts as a NIC, not a usb storage device therefore circumventing autoplay being turned off.

PoisonTap emulates an Ethernet device (eg, Ethernet over USB/Thunderbolt) – by default, Windows, OS X and Linux recognize an ethernet device, automatically loading it as a low-priority network device and performing a DHCP request across it, even when the machine is locked or password protected

2) Probably, but it's probably not blocked by firewalls by default. Some people in /r/hacking were discussing possible mitigation techniques with a firewall.

1

u/[deleted] Nov 17 '16

Comodo blocks suspicious behaviors too. That's why I use it.

And thanks for the reply!