IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Raspberry Pi Zero device can hack a computer in less than a minute

The £4 microcomputer can carry out a hack in seconds, even if it's locked

Despite complicated passwords and other security measures, PCs can still be vulnerable to hacking, even from a small device that costs under 5.

The so-called PoisonTap, developed by privacy and security researcher Samy Kamkar, is made out of a Rasperry Pi Zero microcomputer, which costs 4, and a common USB cable. When plugged into a computer, it can steal login details to websites in less than a minute.

The device hijacks the computer's internet traffic by giving it an IP address, easily stealing the users' login details for websites like Facebook or Gmail.

It prompts the computer to send requests from the web browser to websites to steel its cookies, which often contain login details of the person or people who generally use the browser.

These details are then sent to the hacker through the PoisonTap, allowing them to access users' personal accounts.

After it has been unplugged, the PoisonTap still maintains backdoor and remote access to the computer.

It works on locked computers as well, if the user happens to have left web browsers open. This can be detrimental in work places, where employees might have left their computer unattended to participate in a meeting or take a break.

The device is ideal for such circumstances, as it needs under a minute to work (usually around 30 seconds), and can carry out the whole process without unlocking the PC.

Security analyst Graham Cluley told IT Pro: "I'm not sure this is a huge threat to the typical computer user, but that if an attacker gets physical access to your turned-on PC then we often find that all bets are off."

In a post presenting the device, its creator, Kamkar, said: "Closing your browser every time you walk away from your machine can work, but is entirely impractical."

Instead, he suggests using HTTPS exclusively, at least for authentication and authenticated content, as well as ensuring the Secure flag is enabled on cookies, and using HSTS to prevent HTTPS downgrade attacks.

Finally, he also provides some Desktop Security advice, such as adding cement to USB and Thunderbolt ports or disabling them entirely.

Featured Resources

The state of Salesforce: Future of business

Three articles that look forward into the changing state of Salesforce and the future of business

Free Download

The mighty struggle to migrate SAP to the cloud may be over

A simplified and unified approach to delivering Enterprise Transformation in the cloud

Free Download

The business value of the transformative mainframe

Modernising on the mainframe

Free Download

The Total Economic Impact™ Of IBM FlashSystem

Cost savings and business benefits enabled by FlashSystem

Free Download

Recommended

Twilio account breach result of sophisticated social engineering campaign
Security

Twilio account breach result of sophisticated social engineering campaign

9 Aug 2022
Over 200,000 DrayTek routers vulnerable to total device takeover
Security

Over 200,000 DrayTek routers vulnerable to total device takeover

3 Aug 2022
Data on 69 million Neopets users stolen and listed for sale on hacker forum
Security

Data on 69 million Neopets users stolen and listed for sale on hacker forum

21 Jul 2022
HackerOne employee fired for using position to steal bug bounties
Security

HackerOne employee fired for using position to steal bug bounties

4 Jul 2022

Most Popular

Cyber attack on software supplier causes "major outage" across the NHS
cyber attacks

Cyber attack on software supplier causes "major outage" across the NHS

8 Aug 2022
Why convenience is the biggest threat to your security
Sponsored

Why convenience is the biggest threat to your security

8 Aug 2022
Electrical explosion reported at Google's Iowa data centre
data centres

Electrical explosion reported at Google's Iowa data centre

9 Aug 2022