6

I've searched around about Windows 10 PINs and although have seen a few answers regarding the security of them as a whole, I haven't found any discussing the fact that when I type in my PIN, the desktop will begin logging in without me ever hitting enter. Assuming PIN is enabled for login, what's stopping someone from using something like the USB rubber Ducky and cycling through all possible number combinations up to, say 15 digits. Since there is no part where the user needs to hit "enter", incorrect PINs wouldn't have a chance to be counted and locked out.

From the sound of this, it seems a Windows 10 computer could be broken into relatively quickly brute-forcing the PIN. Is it really this easy or am I missing something? Is a having a Windows 10 pin really a safe option?

EDIT: I have done some testing around my question. So far, manually typing in incorrect PINs, deleting them if Windows doesn't automatically log in, and trying a new one has not caused a lock-out of any sort. If I type in an incorrect PIN and hit ENTER multiple times, I will eventually reach an "are you not a robot" screen. If I never hit ENTER it seems I won't see that screen (so far). I will continue testing and creating a script.

  • Did you at least try it before assuming this? – Julie Pelletier Jul 1 '16 at 4:55
  • @JuliePelletier I have not tried it myself, I should clarify that I am wondering if the login would act this way in an attack. – Christian Jul 1 '16 at 5:23
  • It doesn't seem to me as easy to hack as you make it sound. You should at the very least do different tests to see how the system behaves and how long it takes to test 100 or 1000 passwords and that should at least partially answer your question. – Julie Pelletier Jul 1 '16 at 5:36
  • @JuliePelletier Sounds fair enough. As I do not have access to a Rubber Ducky on my, I'll try testing my method with a script. Thanks! – Christian Jul 1 '16 at 5:42
3

Yes, Windows 10 use PINs as well as passwords, there are options to make PIN usage more secure. Fore example, if you enter wrong PINs several times, it will lock, so after that, you will have to enter unlock PIN, you will see under the login form, this is not so good security option for Windows 10, but it works.

  • The thing is, when typing a PIN (at least in the current settings I have), I never have to hit the physical "ENTER" key. If the PIN is correct then it will automatically log in. This means if ENTER needs to be pressed, the pin is wrong. Could an attacker take advantage of this and continually type a number, clear the field, type the next, etc. until the computer automatically logs in at the correct PIN? – Christian Jul 1 '16 at 16:22
  • @Christian, it's hard to brute without human help. – Zviad Gabroshvili Jul 2 '16 at 16:59
0

I don't know about the Windows 10 behaviour when you tested this. But for Windows 10 1903 this brute force concept doesn't appear to work. If the pin was 1111 for example, and your keystroke injection tool tried any 4 digit number before or after that, eg. 0001, even though it's not hit enter, when it gets to 4 digits windows stops and says the pin is incorrect. And therefore registers a failed attempt. So you'll have many failed attempts in trying to get to the correct 1111 pin. And trigger the brute force prevention, even though you've never hit enter. So I guess they thought of this.

New contributor
CSE4 is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.