7

I've searched around about Windows 10 PINs and although have seen a few answers regarding the security of them as a whole, I haven't found any discussing the fact that when I type in my PIN, the desktop will begin logging in without me ever hitting enter. Assuming PIN is enabled for login, what's stopping someone from using something like the USB rubber Ducky and cycling through all possible number combinations up to, say 15 digits. Since there is no part where the user needs to hit "enter", incorrect PINs wouldn't have a chance to be counted and locked out.

From the sound of this, it seems a Windows 10 computer could be broken into relatively quickly brute-forcing the PIN. Is it really this easy or am I missing something? Is a having a Windows 10 pin really a safe option?

EDIT: I have done some testing around my question. So far, manually typing in incorrect PINs, deleting them if Windows doesn't automatically log in, and trying a new one has not caused a lock-out of any sort. If I type in an incorrect PIN and hit ENTER multiple times, I will eventually reach an "are you not a robot" screen. If I never hit ENTER it seems I won't see that screen (so far). I will continue testing and creating a script.

Improve this question
4
  • Did you at least try it before assuming this?
    – Julie Pelletier
    Jul 1, 2016 at 4:55
  • @JuliePelletier I have not tried it myself, I should clarify that I am wondering if the login would act this way in an attack.
    – Christian
    Jul 1, 2016 at 5:23
  • It doesn't seem to me as easy to hack as you make it sound. You should at the very least do different tests to see how the system behaves and how long it takes to test 100 or 1000 passwords and that should at least partially answer your question.
    – Julie Pelletier
    Jul 1, 2016 at 5:36
  • @JuliePelletier Sounds fair enough. As I do not have access to a Rubber Ducky on my, I'll try testing my method with a script. Thanks!
    – Christian
    Jul 1, 2016 at 5:42

2 Answers 2

Reset to default
3

Yes, Windows 10 use PINs as well as passwords, there are options to make PIN usage more secure. Fore example, if you enter wrong PINs several times, it will lock, so after that, you will have to enter unlock PIN, you will see under the login form, this is not so good security option for Windows 10, but it works.

Improve this answer
2
  • The thing is, when typing a PIN (at least in the current settings I have), I never have to hit the physical "ENTER" key. If the PIN is correct then it will automatically log in. This means if ENTER needs to be pressed, the pin is wrong. Could an attacker take advantage of this and continually type a number, clear the field, type the next, etc. until the computer automatically logs in at the correct PIN?
    – Christian
    Jul 1, 2016 at 16:22
  • @Christian, it's hard to brute without human help.
    – user83026
    Jul 2, 2016 at 16:59
1

I don't know about the Windows 10 behaviour when you tested this. But for Windows 10 1903 this brute force concept doesn't appear to work. If the pin was 1111 for example, and your keystroke injection tool tried any 4 digit number before or after that, eg. 0001, even though it's not hit enter, when it gets to 4 digits windows stops and says the pin is incorrect. And therefore registers a failed attempt. So you'll have many failed attempts in trying to get to the correct 1111 pin. And trigger the brute force prevention, even though you've never hit enter. So I guess they thought of this.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .