Researchers Develop Hacking Gear Small Enough to Fit inside a Pita Sandwich

You can pack a lot into the average pita: lettuce, tomatoes, sliced chicken — even enough hardware to wirelessly steal data from a nearby laptop.

As reported in Wired, among other sources, a group of researchers from Israel’s Technion research institute and Tel Aviv University have collaborated on a prototype of what’s been described as a spy bug small enough to fit into a sandwich. At a cost of just $300, the Portable Instrument for Trace Acquisition (PITA) includes a controller chip, antenna and software-defined radio that could transmit data from a victim’s computer via Wi-Fi.

Security experts told BBC News they weren’t very impressed with the PITA, given that it needs to be within a range of about 19 inches from a potential victim’s laptop in order to steal data. Still, the researchers proved the device could intercept email information and obtain access credentials in a lab test. Several encryption programs were reportedly worked around as part of the experiment.

The PITA doesn’t need to rely on Wi-Fi, either. Engadget said hackers could also store data on a microSD card. And of course, real cybercriminals probably wouldn’t try to disguise this kind of listening device in food, but would likely put it in a small space near a desk or workspace where it remain undisturbed.

Beyond the ingenuity of the PITA hardware, PC World noted that the researchers made use of a flaw in GnuPG, an open source software from the Free Software Foundation designed to protect user privacy. In the interest of preventing cybercriminals from doing the same thing, however, the flaw was reported to the organization and fixed prior to the paper’s publication.

There are potential measures that would make it difficult for something like the PITA to work. IT Pro wrote that companies might deploy Faraday cages, which are a sort of enclosure that could shield corporate devices from third-party electronic signals. Given that the researchers plan to show off their prototype at a security conference later this year, the best defense tactic will likely be the same one applied to so many other potential threats: increased awareness among potential victims.

Shane Schick

Writer & Editor

NIST’s role in the global tech race against AI

4 min read - Last year, the United States Secretary of Commerce announced that the National Institute of Standards and Technology (NIST) has been put in charge of launching a new public working group on artificial intelligence (AI) that will build on the success of the NIST AI Risk Management Framework to address this rapidly advancing technology.However, recent budget cuts at NIST, along with a lack of strategy implementation, have called into question the agency’s ability to lead this critical effort. Ultimately, the success…

Researchers develop malicious AI ‘worm’ targeting generative AI systems

2 min read - Researchers have created a new, never-seen-before kind of malware they call the "Morris II" worm, which uses popular AI services to spread itself, infect new systems and steal data. The name references the original Morris computer worm that wreaked havoc on the internet in 1988.The worm demonstrates the potential dangers of AI security threats and creates a new urgency around securing AI models.New worm utilizes adversarial self-replicating promptThe researchers from Cornell Tech, the Israel Institute of Technology and Intuit, used what’s…

Passwords, passkeys and familiarity bias

5 min read - As passkey (passwordless authentication) adoption proceeds, misconceptions abound. There appears to be a widespread impression that passkeys may be more convenient and less secure than passwords. The reality is that they are both more secure and more convenient — possibly a first in cybersecurity.Most of us could be forgiven for not realizing passwordless authentication is more secure than passwords. Thinking back to the first couple of use cases I was exposed to — a phone operating system (OS) and a…

Security Intelligence

{{title}}

{{title}}

{{title}}

Topics

More from

NIST’s role in the global tech race against AI

Researchers develop malicious AI ‘worm’ targeting generative AI systems

Passwords, passkeys and familiarity bias

Topic updates