3

I work for a small-medium company doing most of the IT tasks, including systems administration, network administration, and even developing in-house software. Recently, my boss (the CEO) told me that some money had been stolen from the company (electronically, like a wire transfer or something) and there was a strong indication that it was done by one of our employees.

The company hired a third party to investigate and one thing they did was look through a number of workstations, including the CEO's. One thing that caught my attention was he told me that the "investigator" wanted to look through his computer, which was either locked or not logged in at all. He offered to type in his password so the guy could do what he needed, but he declined and then plugged in a USB stick and suddenly was logged into the account.

I've tried searching online for information about a USB exploit like this, but I mostly came across information about the BadUSB vulnerability, which doesn't really seem like it applies here.

Does anybody know of any USB exploits like this?

The computer runs Windows 10 64-bit.

2
  • 1
    If the computer was powered off or restarted, he could have used a live-boot tool such as Kon-Boot to disable the password. Sep 6, 2017 at 23:22
  • From what I understand, he never booted another OS. He plugged in a USB while at the Windows login screen, and then he was in the account. That's how it was described to me, but it is all second-hand information.
    – Gogeta70
    Sep 6, 2017 at 23:32

3 Answers 3

3

There is a category of programmable usb sticks-devices running on atmel or similar microprocessors that act like hid's. Shortly, an HID is plug-n-play. no security checks, no questions asked! He could have probably programmed it in a way that would execute such system commands, it would give him access to an account. It's not that hard. Windows loads all the passwords in memory. And since hid's run at a high-priviledge service, its not hard to give your code the rights to do these tasks.

Check these: rubber ducky, HIDIOT and even Arduino. Since their microcontrollers are capable and there are libraries, why should the developers' code be limited to legitimate usege? ;)

EDIT: Since it was asked, I found some examples of code that work with devices like this:

https://github.com/hak5darren/USB-Rubber-Ducky/wiki/Attacking-Windows-At-The-Logon-Screen,---Gaining-Access-To-CMD-With-System-Privileges.

So yes, hid devices like these can actually execute code.

I also found another type of usb attack: https://room362.com/post/2016/snagging-creds-from-locked-machines/

7
  • 1
    This is a pretty bold claim. You think that you can bypass the Windows lock screen using nothing but a keyboard and mouse? (HID = Human Interface Device.)
    – Ajedi32
    Sep 11, 2017 at 15:43
  • Yes! Because this "supposedly" keyboard or mouse can execute system commands. Sep 11, 2017 at 15:45
  • 3
    Sure, if you're logged in it can just type Win + R <command> <enter>. That doesn't mean it can bypass the login screen though.
    – Ajedi32
    Sep 11, 2017 at 15:48
  • 6
    More? Like what? Perhaps you could edit to explain that in a bit more detail in your answer? Because as-is it's not at all clear how an emulated HID could be used to bypass the Windows login screen.
    – Ajedi32
    Sep 11, 2017 at 17:04
  • 1
    FWIW, that Rubber Ducky attack requires the computer to already be compromised with a backdoor (Windows high contrast service modified to instead open a shell with SYSTEM privileges), and the second one doesn't bypass the login screen, it steals the Windows NTLMv2 hash using a fake network card (not a HID).
    – Ajedi32
    Oct 24, 2017 at 17:13
3

Throwing out some alternative ideas:

A LAN turtle type attack that obtains the hashes via a network device, cracks them in situ, switches over to HID and enters the password. This is far fetched because the cracking would take considerable time on an embedded device (unless it was "password").

A bootable USB that automates a reboot using HID and running of konboot, then rebooting again back into windows for login. This is a bit far fetched because you would have to know the boot order in advance (although if there has been multiple computers tested prior to this maybe they were all in the same state and the device was preconfigured). It would also probably take a minute or two and doesnt run as described.

A DMA attack using something like firewire instead of USB, this really can perform attacks like the one mentioned, but has supposedly been patched on Windows 10 lock screens (the DMA drivers devices don't load on a locked device).

I think though, that maybe something was missed or that the second hand information was a bit of an embellishment.

0

Well, it reallly depends! If your PC is Bitlocker protected, Security boot is on - renders all Live CDs or any other live-bootable drives/sticks useless. RubberDucky, WifiDucky, BashBunny - all will do only passing the strings/commands to the HID input mechanism of the login screen and will achieve nothing, except locking the target down consuming the attempts. the only 2 angles in such case are- USB Host Controller and DMA remapping ( xHCI v 3.xx as per Microsoft) or external NIC is connected and takes over as primary gateway obtaining creds, like in Mubix research with responder and WPAD (I guess pass the hash happened using NTLMv2). On secured machine without prior access- you cannot do much, ways are limited- either USB or NIC are the only accessible to mingle around. Given DMA protection isn't on, or USB isn't locked- depends on how LOCKED this locked is.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.