The security expert and blogger Rob Fuller demonstrated how to exploit a USB SoC-based device to sniff credentials from a locked laptop. The expert has modified the device in a way that once it is plugged into an Ethernet adapter, it acts as a network gateway, a DNS server, and WPAD (Web proxy autodiscovery protocol) server for the targeted machine. The attack leverages on Laurent Gaffis Responder to capture the credentials, the Hak5 Turtle already has a module for it.”]
Source: http://securityaffairs.co/wordpress/51026/hacking/sniff-credentials-ethernet-adapter.html