I've read that devices that look like USB flash drives can be hidden network cards that can then steal credentials even when the screen is locked. (Like the Bash Bunny)
I understand that being the network they can send internet traffic anywhere. But how would that help? I can even understand that if someone is willing to type their password into a non secure site (
http) - they can read that. But as long as
https is used (and I assume automatic traffic like Windows Update for example, even if they would send some credentials, would be over TLS) how would they read that? And besides, why would any automatic traffic send credentials?
So my question is how can a hidden network card steal credentials when not being used by a user (e..g. when the screen is locked)?