1

I work for a small-medium company doing most of the IT tasks, including systems administration, network administration, and even developing in-house software. Recently, my boss (the CEO) told me that some money had been stolen from the company (electronically, like a wire transfer or something) and there was a strong indication that it was done by one of our employees.

The company hired a third party to investigate and one thing they did was look through a number of workstations, including the CEO's. One thing that caught my attention was he told me that the "investigator" wanted to look through his computer, which was either locked or not logged in at all. He offered to type in his password so the guy could do what he needed, but he declined and then plugged in a USB stick and suddenly was logged into the account.

I've tried searching online for information about a USB exploit like this, but I mostly came across information about the BadUSB vulnerability, which doesn't really seem like it applies here.

Does anybody know of any USB exploits like this?

The computer runs Windows 10 64-bit.

  • If the computer was powered off or restarted, he could have used a live-boot tool such as Kon-Boot to disable the password. – multithr3at3d Sep 6 '17 at 23:22
  • From what I understand, he never booted another OS. He plugged in a USB while at the Windows login screen, and then he was in the account. That's how it was described to me, but it is all second-hand information. – Gogeta70 Sep 6 '17 at 23:32
1

There is a category of programmable usb sticks-devices running on atmel or similar microprocessors that act like hid's. Shortly, an HID is plug-n-play. no security checks, no questions asked! He could have probably programmed it in a way that would execute such system commands, it would give him access to an account. It's not that hard. Windows loads all the passwords in memory. And since hid's run at a high-priviledge service, its not hard to give your code the rights to do these tasks.

Check these: rubber ducky, HIDIOT and even Arduino. Since their microcontrollers are capable and there are libraries, why should the developers' code be limited to legitimate usege? ;)

EDIT: Since it was asked, I found some examples of code that work with devices like this:

https://github.com/hak5darren/USB-Rubber-Ducky/wiki/Attacking-Windows-At-The-Logon-Screen,---Gaining-Access-To-CMD-With-System-Privileges.

So yes, hid devices like these can actually execute code.

I also found another type of usb attack: https://room362.com/post/2016/snagging-creds-from-locked-machines/

  • This is a pretty bold claim. You think that you can bypass the Windows lock screen using nothing but a keyboard and mouse? (HID = Human Interface Device.) – Ajedi32 Sep 11 '17 at 15:43
  • Yes! Because this "supposedly" keyboard or mouse can execute system commands. – Chris Tsiakoulas Sep 11 '17 at 15:45
  • 1
    Sure, if you're logged in it can just type Win + R <command> <enter>. That doesn't mean it can bypass the login screen though. – Ajedi32 Sep 11 '17 at 15:48
  • Thats not the only way. It gains priviledges to execute more than that. The legit usage is keystrokes. But there is more... – Chris Tsiakoulas Sep 11 '17 at 16:02
  • 4
    More? Like what? Perhaps you could edit to explain that in a bit more detail in your answer? Because as-is it's not at all clear how an emulated HID could be used to bypass the Windows login screen. – Ajedi32 Sep 11 '17 at 17:04
2

Throwing out some alternative ideas:

A LAN turtle type attack that obtains the hashes via a network device, cracks them in situ, switches over to HID and enters the password. This is far fetched because the cracking would take considerable time on an embedded device (unless it was "password").

A bootable USB that automates a reboot using HID and running of konboot, then rebooting again back into windows for login. This is a bit far fetched because you would have to know the boot order in advance (although if there has been multiple computers tested prior to this maybe they were all in the same state and the device was preconfigured). It would also probably take a minute or two and doesnt run as described.

A DMA attack using something like firewire instead of USB, this really can perform attacks like the one mentioned, but has supposedly been patched on Windows 10 lock screens (the DMA drivers devices don't load on a locked device).

I think though, that maybe something was missed or that the second hand information was a bit of an embellishment.

-1

You can create a password reset disk with the help of a Windows Password Key, then use the tool to bypass Windows 10 password.

  • Welcome to Information Security Stack Exchange! Creating a password reset disk requires the original password, so I'm not sure if this was what happened here. Also, if you are affiliated with the product you mention, please disclose your affiliation. – S.L. Barth Aug 28 '18 at 8:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.