You can pack a lot into the average pita: lettuce, tomatoes, sliced chicken — even enough hardware to wirelessly steal data from a nearby laptop.
As reported in Wired, among other sources, a group of researchers from Israel’s Technion research institute and Tel Aviv University have collaborated on a prototype of what’s been described as a spy bug small enough to fit into a sandwich. At a cost of just $300, the Portable Instrument for Trace Acquisition (PITA) includes a controller chip, antenna and software-defined radio that could transmit data from a victim’s computer via Wi-Fi.
Security experts told BBC News they weren’t very impressed with the PITA, given that it needs to be within a range of about 19 inches from a potential victim’s laptop in order to steal data. Still, the researchers proved the device could intercept email information and obtain access credentials in a lab test. Several encryption programs were reportedly worked around as part of the experiment.
The PITA doesn’t need to rely on Wi-Fi, either. Engadget said hackers could also store data on a microSD card. And of course, real cybercriminals probably wouldn’t try to disguise this kind of listening device in food, but would likely put it in a small space near a desk or workspace where it remain undisturbed.
Beyond the ingenuity of the PITA hardware, PC World noted that the researchers made use of a flaw in GnuPG, an open source software from the Free Software Foundation designed to protect user privacy. In the interest of preventing cybercriminals from doing the same thing, however, the flaw was reported to the organization and fixed prior to the paper’s publication.
There are potential measures that would make it difficult for something like the PITA to work. IT Pro wrote that companies might deploy Faraday cages, which are a sort of enclosure that could shield corporate devices from third-party electronic signals. Given that the researchers plan to show off their prototype at a security conference later this year, the best defense tactic will likely be the same one applied to so many other potential threats: increased awareness among potential victims.