PoisonTap Makes Raspberry Pi Zero Exploit Locked Computers

November 16, 2016 by Brian Benchoff 53 Comments

[Samy Kamkar], leet haxor extraordinaire, has taken a treasure trove of exploits and backdoors and turned it into a simple hardware device that hijacks all network traffic, enables remote access, and does it all while a machine is locked. It’s PoisonTap, and it’s based on the Raspberry Pi Zero for all that awesome tech blog cred we crave so much.

PoisonTap takes a Raspberry Pi Zero and configures it as a USB Gadget, emulating a network device. When this Pi-come-USB-to-Ethernet adapter is plugged into a computer (even a locked one), the computer sends out a DHCP request, and PoisonTap responds by telling the machine the entire IPv4 space is part of the Pi’s local network. All Internet traffic on the locked computer is then sent over PoisonTap, and if a browser is running on the locked computer, all requests are sent to this tiny exploit device.

With all network access going through PoisonTap, cookies are siphoned off, and the browser cache is poisoned with an exploit providing a WebSocket to the outside world. Even after PoisonTap is unplugged, an attacker can remotely send commands to the target computer and force the browser to execute JavaScript. From there, it’s all pretty much over.

Of course, any device designed to plug into a USB port and run a few exploits has a few limitations. PoisonTap only works if a browser is running. PoisonTap does not work on HTTPS cookies with the Secure cookie flag set. PoisonTap does not work if you have filled your USB ports with epoxy. There are a thousand limitations to PoisonTap, all of which probably don’t apply if you take PoisonTap into any office, plug it into a computer, and walk away. That is, after all, the point of this exploit.

As with all ub3r-1337 pen testing tools, we expect to see a version of PoisonTap for sale next August in the vendor area of DEF CON. Don’t buy it. A Raspberry Pi Zero costs $5, a USB OTG cable less than that, and all the code is available on Github. If you buy a device like PoisonTap, you are too technically illiterate to use it.

[Samy] has a demonstration of PoisonTap in the video below.

Continue reading “PoisonTap Makes Raspberry Pi Zero Exploit Locked Computers” →

How To Control Your Instruments From A Computer: It’s Easier Than You Think

November 16, 2016 by Jenny List 48 Comments

There was a time when instruments sporting a GPIB connector (General Purpose Interface Bus) for computer control on their back panels were expensive and exotic devices, unlikely to be found on the bench of a hardware hacker. Your employer or university would have had them, but you’d have been more likely to own an all-analogue bench that would have been familiar to your parents’ generation.

A GPIB/IEEE488 plug. Alkamid [CC BY-SA 3.], via Wikimedia Commons.

The affordable instruments in front of you today may not have a physical GPIB port, but the chances are they will have a USB port or even Ethernet over which you can exert the same control. The manufacturer will provide some software to allow you to use it, but if it doesn’t cost anything you’ll be lucky if it is either any good, or available for a platform other than Microsoft Windows.

So there you are, with an instrument that speaks a fully documented protocol through a physical interface you have plenty of spare sockets for, but if you’re a Linux user and especially if you don’t have an x86 processor, you’re a bit out of luck on the software front. Surely there must be a way to make your computer talk to it!

Let’s give it a try — I’ll be using a Linux machine and a popular brand of oscilloscope but the technique is widely applicable.

Continue reading “How To Control Your Instruments From A Computer: It’s Easier Than You Think” →

2,000 LEDs On Fire

November 15, 2016 by Al Williams 12 Comments

What’s 18 feet tall, 12 feet wide, has 2,000 LEDs and turbine-driven blast furnaces? Believe it or not, it is a piece of kinetic sculpture created by [Therm] (a collective, not a person) for Burning Man 2016. The project is about 60% salvage, has a Raspberry Pi 3 helping its three human operators, and took a team of 30 about 9 months to complete.

The Raspberry Pi drives LED using fadecandy. You can see a video of the sculpture (three giant moths, to be exact) and a video about fadecandy, below. (We’ve covered a subtler fadecandy project before if you want to see a different take on it.)

Continue reading “2,000 LEDs On Fire” →

Put An Honest Face On Alexa With This HAL 9000 Build

November 15, 2016 by Gerrit Coetzee 17 Comments

Amazon put out a version of Alexa’s software that could run on Raspberry Pi. Adafruit sold a big scary red button. For, [Keith Elliott] the project ahead was an obvious conclusion.

The Raspberry Pi version of Alexa’s software was lagging behind the release version. You had to press a button to input a command, which really steals a lot of the joy out of a creepy voice controlled robot listening to you putz around the house. Now, it can wake on command.

Since this sold him on finally adding Amazon’s ever watching witch eye to his home, he decided he would give it appropriately sinister clothes. These were 3D printed from files based on Adafruit’s guide. He ended up with a fairly convincing facade.

The inside is kind of melancholy. A lone Raspberry Pi 3 is held company by a microphone and audio amplifier. These are pretty much all that’s needed to make you home automated shopping experience dreams come true. Video after the break.

Continue reading “Put An Honest Face On Alexa With This HAL 9000 Build” →

Put A Pi In Your JAMMA

November 12, 2016 by Jenny List 13 Comments

Most of us who play an occasional arcade game will have never taken a look inside a cabinet however much its contents might interest us. We’ll know in principle what kind of hardware we’d expect to see if we were given the chance, but the details are probably beyond us.

In fact, there is a standard for the wiring in arcade cabinets. Arcade operators demanded running costs as low as possible, and the industry responded with the JAMMA wiring standard. The Japan Amusement Machinery Manufacturers Association was the name the Japanese trade body was known under in the 1980s, and they originated a specification for both wiring and connector that would allow hardware to be easily installed for any game that supported it.

[Jochen Zurborg] has created an interesting board supporting the JAMMA connector, one that interfaces it with a Raspberry Pi and offers full support of the Pi as a video source. He’s launching his Pi2Jamma as a commercial product so sadly there are no schematics or Gerbers for you to look at, but if you’d prefer to roll your own it probably wouldn’t be beyond most Hackaday readers to do so. What it does though is open up the huge world of emulation on the Pi to owners of classic cabinets, and if you don’t mind forking out for one then we can see it might make for a very versatile addition to your cabinet.

We’ve featured [Jochen]’s work before here at Hackaday with a joystick that faithfully replicates arcade items. As to the Pi, this is the first JAMMA board we’ve seen with video, but we’ve featured another board using a Pi to bring console controllers to JAMMA boards in the past.

Pi Zero Transforms To Game Boy

November 12, 2016 by Al Williams 11 Comments

[GreatScott] bought a Game Boy case. Normally, you’d assume you wanted this to repair a damaged Game Boy, but in this case [GreatScott] used a Pi Zero and some 3D printing to build a game system into the tiny box. You can see some videos, below.

Two interesting parts of the project are the source of the LCD display (a rearview camera screen) and the selection of batteries. Lithium ion batteries are all the rage. But if you watch the news, you know there are some safety issues with using the batteries, especially if you use them improperly. [GreatScott] decided to go with nickel metal hydride cells which still need a protection circuit, but are typically less of a danger than the newer technology cells.

Continue reading “Pi Zero Transforms To Game Boy” →

Raspberry Pi Spies On… Err… Monitors Baby

November 12, 2016 by Dan Maloney 7 Comments

“Quick! We’re having a baby and we need a baby monitor!” Rather than run to the local big box and plunk down cash for an off-the-shelf solution, any self-respecting hacker would rise to the challenge and hit the shop to build something like this live streaming eye-in-the-sky baby camera. Right?

At least that’s how [Antibore] handled the situation, and the results are pretty good. He designed his build around an old Raspberry Pi 2 that was hanging around. That required a WiFi adapter, and since he wanted video and audio he needed a camera and mic. The first USB mic had a nice compact design but didn’t perform well, so a gutted gooseneck mic soldered right to the USB connector joined the design spec. A camera module, cell-phone quick charge battery bank, and a 3D printed case round out the BOM. A knitted cozy to keep it looking warm and fuzzy was provided by the mother-to-be — although we think it looks a little like [Mike Wazowski].

This self-contained unit will work anywhere it has access to a WiFi network. Mounted on the baby carrier, it’ll provide a live stream to any browser and provide the new parents with a little peace of mind.

There are a lot of baby monitors on the market, some of them terrible and in need of a rebuild. Kudos to [Antibore] for deciding to roll his own custom solution and for getting it done before the blessed event. Now how about painting that nursery?