poisontap

This is a slight variation on the "Poison Tap" attack from Samy Kamkar in 2016, where you do the same thing but with a USB/Thunderbolt network adapter. You plug it into the victim device, advertise two more specific routes of 0.0.0.0/1 and 128.0.0.0/1 and then you get all the traffic in preference to other system interfaces despite interface ordering: https://github.com/samyk/poisontap I imagine there is also probably some other prior art. But that's a very well known one. They also claim that it affects all VPN clients in the headline, yet so many such clients setup firewall rules to block traffic to/from the physical interface as they acknowledge in the write-up. Most of the VPNs that are claiming to hide your identity or where such cloaking is important tend to implement that. I'm sure plenty of setups don't have it enabled by default,

I agree. They could and IMHO should have given a disclosure window since there was no evidence of active exploitation. However it wouldn’t be that difficult to actually execute this attack. It’s not that difficult to spoof the DNS server or even DHCP responses on public wifi networks (or local LANs). Yes you can setup enterprise networks to detect or block that but plenty of people aren’t on enterprise networks: https://charlesreid1.com/wiki/Ettercap It’s also easy to stand up wireless SSIDs of common public networks (eg “Apple Store”) and have devices preferentially connect to you if it happens to be earlier in the wifi network order list. You can also steal all of a machines traffic by plugging a USB network adapter in: https://github.com/samyk/poisontap Working SSL would prevent all of that auto running a downloaded executable by such

Sounds like Chrome is finally taking steps to combat that, as the post mentions they plan to "Restrict how, and for how long, Chrome stores site content provided over insecure connections" PoisonTap is a particularly good example of how devastating this type of attack can be: https://github.com/samyk/poisontap

I can't believe of the 363 comments no one has mentioned Samy K and his awesome Poisontap project. Parts of which did this local scanning and connecting to your internal router management page. https://github.com/samyk/poisontap See also, https://www.theregister.co.uk/2010/01/05/geo_location_steali...

If you have an open browser you can easily get HTTP cookies: https://github.com/samyk/poisontap

You can't blame the USB ports entirely... I mean, yes, it's insane he can force requests that trick your machine into dumping unencrypted cookies, but remember this intercepts and modifies unencrypted traffic, which any packet sniffer or upstream provider (router, ISP, et al) can already see/modify. So even if you follow Samy's recommendation of putting cement on your USB ports, [0] you're still vulnerable to injection and interception. Moral of the story: encrypt all the things. [0]: https://github.com/samyk/poisontap#desktop-security

Over on his website [0], Samy provides a link to the source: https://github.com/samyk/poisontap [0]: https://samy.pl/poisontap/

https://github.com/samyk/poisontap https://samy.pl/poisontap/ But he has a history of intentionally withholding instructions on how to run it just to avoid script kiddies from using this not for research.