June 26, 2015 By Shane Schick 2 min read

You can pack a lot into the average pita: lettuce, tomatoes, sliced chicken — even enough hardware to wirelessly steal data from a nearby laptop.

As reported in Wired, among other sources, a group of researchers from Israel’s Technion research institute and Tel Aviv University have collaborated on a prototype of what’s been described as a spy bug small enough to fit into a sandwich. At a cost of just $300, the Portable Instrument for Trace Acquisition (PITA) includes a controller chip, antenna and software-defined radio that could transmit data from a victim’s computer via Wi-Fi.

Security experts told BBC News they weren’t very impressed with the PITA, given that it needs to be within a range of about 19 inches from a potential victim’s laptop in order to steal data. Still, the researchers proved the device could intercept email information and obtain access credentials in a lab test. Several encryption programs were reportedly worked around as part of the experiment.

The PITA doesn’t need to rely on Wi-Fi, either. Engadget said hackers could also store data on a microSD card. And of course, real cybercriminals probably wouldn’t try to disguise this kind of listening device in food, but would likely put it in a small space near a desk or workspace where it remain undisturbed.

Beyond the ingenuity of the PITA hardware, PC World noted that the researchers made use of a flaw in GnuPG, an open source software from the Free Software Foundation designed to protect user privacy. In the interest of preventing cybercriminals from doing the same thing, however, the flaw was reported to the organization and fixed prior to the paper’s publication.

There are potential measures that would make it difficult for something like the PITA to work. IT Pro wrote that companies might deploy Faraday cages, which are a sort of enclosure that could shield corporate devices from third-party electronic signals. Given that the researchers plan to show off their prototype at a security conference later this year, the best defense tactic will likely be the same one applied to so many other potential threats: increased awareness among potential victims.

More from

CISA hit by hackers, key systems taken offline

3 min read - The Cybersecurity and Infrastructure Security Agency (CISA) — responsible for cybersecurity and infrastructure protection across all levels of the United States government — has been hacked.“About a month ago, CISA identified activity indicating the exploitation of vulnerabilities in Ivanti products the agency uses,” a CISA spokesperson announced.In late February, CISA had already issued a warning that cyber threat actors are exploiting previously identified vulnerabilities in Ivanti Connect Secure and Ivanti Policy Secure gateways. Ivanti Connect Secure is a widely deployed…

Cloud security evolution: Years of progress and challenges

7 min read - Over a decade since its advent, cloud computing continues to enable organizational agility through scalability, efficiency and resilience. As clients shift from early experiments to strategic workloads, persistent security gaps demand urgent attention even as providers expand infrastructure safeguards.The prevalence of cloud-native services has grown exponentially over the past decade, with cloud providers consistently introducing a multitude of new services at an impressive pace. Now, the contemporary cloud environment is not only larger but also more diverse. Unfortunately, that size…

PixPirate: The Brazilian financial malware you can’t see

10 min read - Malicious software always aims to stay hidden, making itself invisible so the victims can’t detect it. The constantly mutating PixPirate malware has taken that strategy to a new extreme. PixPirate is a sophisticated financial remote access trojan (RAT) malware that heavily utilizes anti-research techniques. This malware’s infection vector is based on two malicious apps: a downloader and a droppee. Operating together, these two apps communicate with each other to execute the fraud. So far, IBM Trusteer researchers have observed this…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today