I work for a small-medium company doing most of the IT tasks, including systems administration, network administration, and even developing in-house software. Recently, my boss (the CEO) told me that some money had been stolen from the company (electronically, like a wire transfer or something) and there was a strong indication that it was done by one of our employees.
The company hired a third party to investigate and one thing they did was look through a number of workstations, including the CEO's. One thing that caught my attention was he told me that the "investigator" wanted to look through his computer, which was either locked or not logged in at all. He offered to type in his password so the guy could do what he needed, but he declined and then plugged in a USB stick and suddenly was logged into the account.
I've tried searching online for information about a USB exploit like this, but I mostly came across information about the BadUSB vulnerability, which doesn't really seem like it applies here.
Does anybody know of any USB exploits like this?
The computer runs Windows 10 64-bit.