This is just one example of an emerging technology that enables anyone with physical access to a computer’s USB port to potentially harvest data and gain access by spoofing an Internet ecosystem.

Matthew Rosenquist, Cybersecurity Strategist

December 6, 2016

2 Min Read

PoisonTap is a fully automated proof-of-concept USB device that, when connected to a locked PC, hacks the device and installs a backdoor onto the user’s PC, allowing the attacker to access the victim’s online activities. It takes less than a minute and costs about $5.

Coffee In The Café

Imagine you are in the popular café near your workplace where everyone tends to frequent, and you get up to refresh your drink. Being security conscious, you lock your laptop before you get up. Gone for only two minutes, it was enough for a smooth attacker to come by and slyly insert a small device into your laptop’s USB drive and then moments later remove it and walk away without anyone suspecting foul play. You return to your locked PC none the wiser and continue to work, never knowing you have just been hacked.

Security researcher Samy Kamkar built the working proof-of-concept (POC) on Raspberry Pi Zero and Node.JS. When installed, it siphons cookies, exposes internal routers, and installs a Web backdoor.

USB ports and drives have always been an infection point for malware to gain a foothold on computers. The reason for this is that most computers will install plug-and-play drivers for USB devices without much scrutiny. This trust can be taken advantage of by hackers who present less-than-secure drivers as a way to get in. With access to the USB port, credentials can be stolen even when the screen is locked. Current exploits can work against Windows, OSx, and Linux operating systems.

Protecting Devices

A new generation of hacking USB drives is being developed, putting all of our PCs at risk while we step away for a moment or are distracted. They will get more powerful and virulent over time. Professionals are at risk while at conferences, meetings, coffee shops, and other venues where potentially untrustworthy people are present. It could happen in public, while at a customer’s site, or even in your own work office. It can take as little as 13 seconds and in many cases less than a minute to compromise a system and install a backdoor for remote access by the attacker.

PoisonTap is just one example of an emerging technology that enables anyone with physical access to a computer’s USB port to potentially harvest data and gain access by spoofing an Internet ecosystem. Such bold and scary attacks highlight the need to incorporate both improved physical security and cybersecurity aspects to properly manage the evolving risks.

Interested in more? Follow me on Twitter (@Matt_Rosenquist) and LinkedIn to hear insights and what is going on in cybersecurity.

About the Author(s)

Matthew Rosenquist

Cybersecurity Strategist

Matthew Rosenquist is a cybersecurity strategist who actively advises global businesses, academia, and governments to identify emerging risks and opportunities.  Formerly the cybersecurity strategist for Intel Corp., he benefits from 30 years in the security field.

He is a keynote speaker, an evangelist for cybersecurity best-practices, a member on multiple technical and academic advisory boards, and collaborates with the top minds in the cybersecurity industry.  Recognized as a Top 10 Technology Voice in 2018 by LinkedIn and a Top 10 Cybersecurity Thought Leader in 2019 by Thinkers360, he is heavily engaged with an active following of over 190k professionals.

Matthew is a leader who champions collaboration, partnerships, and communication across technology and cybersecurity organizations.  He publishes blogs, evaluates technology and processes, authors opinion papers, and develops methodologies to improve security effectiveness and efficiencies across the digital ecosystem in the pursuit of optimal security.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights