Is there a USB exploit to bypass Windows password login?

Question

I work for a small-medium company doing most of the IT tasks, including systems administration, network administration, and even developing in-house software. Recently, my boss (the CEO) told me that some money had been stolen from the company (electronically, like a wire transfer or something) and there was a strong indication that it was done by one of our employees.

The company hired a third party to investigate and one thing they did was look through a number of workstations, including the CEO's. One thing that caught my attention was he told me that the "investigator" wanted to look through his computer, which was either locked or not logged in at all. He offered to type in his password so the guy could do what he needed, but he declined and then plugged in a USB stick and suddenly was logged into the account.

I've tried searching online for information about a USB exploit like this, but I mostly came across information about the BadUSB vulnerability, which doesn't really seem like it applies here.

Does anybody know of any USB exploits like this?

The computer runs Windows 10 64-bit.

Answer 1

There is a category of programmable usb sticks-devices running on atmel or similar microprocessors that act like hid's. Shortly, an HID is plug-n-play. no security checks, no questions asked! He could have probably programmed it in a way that would execute such system commands, it would give him access to an account. It's not that hard. Windows loads all the passwords in memory. And since hid's run at a high-priviledge service, its not hard to give your code the rights to do these tasks.

Check these: rubber ducky, HIDIOT and even Arduino. Since their microcontrollers are capable and there are libraries, why should the developers' code be limited to legitimate usege? ;)

EDIT: Since it was asked, I found some examples of code that work with devices like this:

https://github.com/hak5darren/USB-Rubber-Ducky/wiki/Attacking-Windows-At-The-Logon-Screen,---Gaining-Access-To-CMD-With-System-Privileges.

So yes, hid devices like these can actually execute code.

I also found another type of usb attack: https://room362.com/post/2016/snagging-creds-from-locked-machines/

Answer 2

Throwing out some alternative ideas:

A LAN turtle type attack that obtains the hashes via a network device, cracks them in situ, switches over to HID and enters the password. This is far fetched because the cracking would take considerable time on an embedded device (unless it was "password").

A bootable USB that automates a reboot using HID and running of konboot, then rebooting again back into windows for login. This is a bit far fetched because you would have to know the boot order in advance (although if there has been multiple computers tested prior to this maybe they were all in the same state and the device was preconfigured). It would also probably take a minute or two and doesnt run as described.

A DMA attack using something like firewire instead of USB, this really can perform attacks like the one mentioned, but has supposedly been patched on Windows 10 lock screens (the DMA drivers devices don't load on a locked device).

I think though, that maybe something was missed or that the second hand information was a bit of an embellishment.

Answer 3

You can create a password reset disk with the help of a Windows Password Key, then use the tool to bypass Windows 10 password.