PoisonTap: Even the strongest passwords don't seem to be enough, as Samy Kamkar proves, and sometimes it doesn't take more than a few seconds.
Kamkar's new exploit is called PoisonTap, and it uses free software that runs on a Raspberry Pi Zero microcomputer. After plugging the Raspberry Pi into a USB adapter on the target computer, the device gets to work. 
In 30 seconds, it bypasses the lock screen and begins installing a backdoor that works even when the device is removed from the USB port.
If you think a strong password will save you, you are wrong.
PoisonTap doesn't work that way. It doesn't try to guess your password, but bypasses it entirely – and it seems to work.
After the PoisonTap device is connected, it begins to emulate a USB internet-enabled device. Once detected by the target computer, it assumes it is connected via ethernet, and begins sending all unencrypted web traffic to the microcontroller.
Your existing network security cannot save you, as the device tricks the target computer into prioritizing all other connections rather than the one you are already connected to.
Acting as a man-in-the-middle attack, the device then begins stealing all the HTTP authentication cookies you have used to log into your accounts, as well as session data from a million top sites on the internet according to Alexa.
Due to the way it is designed, two-factor authentication may not help, since logins are made from the cookies that PoisonTap has stored and not from the actual login credentials.
The only downside to its effectiveness is that it requires the user to have a browser tab open on the locked device. But the vast majority of people don't close their browsers before closing the lid on their laptop.
Kamkar also gave some tips to protect yourself, although he acknowledges that most of them are impractical:
Set your computer to hibernate, rather than sleep. In hibernation, the computer suspends all its processes.
Close your browser every time you shut down your machine.
Clear your browser cache regularly.
Use full disk encryption
Disable USB ports
Watch the video
