127

I’m asking the question with these conditions:

  1. The device (computer or mobile phone) is in a running state.
  2. “Momentary” refers to a reasonably short period of time, such as 5 to 10 seconds.
  3. The system may not be in a “locked” state (e.g. showing a lock screen asking for a password). However, the active session doesn’t have superuser privilege (the usual case for a mobile phone).

What can a hacker do to gain further access to the system?

  • 40
    Third Law of security: If a bad guy has unrestricted physical access to your computer, it's not your computer anymore. Even with limited time access, the moment a bad guy has physical access, consider it compromised. – Mast Jun 11 '18 at 12:49
  • 9
    If you mean they only have access for a short period of time, "brief" would probably be a better word to use. Instantaneous is typically a whole lot shorter than a few seconds and instantaneous access is ambiguous (and most would probably assume the other meaning, i.e. the process to gain access is instantaneous). – NotThatGuy Jun 11 '18 at 12:51
  • 8
    Well, if it's a mobile phone or a laptop, he could steal it. – Steve-O Jun 11 '18 at 18:11
  • 4
    @immibis Hence the last part of that comment. I'm perfectly aware of what's stated in the question. – Mast Jun 12 '18 at 5:58
  • 8
    A second or so may be enough to swap your phone with a lookalike in locked state. A minute or so later, when the attacker has left, you try to unlock your phone by typing your PIN into that device, which has the sole purpose of sending that PIN to the attacker ... – Hagen von Eitzen Jun 13 '18 at 20:43
209

That all depends on the system, the attacker, and the level of preparation they had. If they have unlimited preparation, they could do effectively anything that they could do with an unlimited access window. Even if they do not have in-depth knowledge of the specific system, it would not be difficult to very quickly inject malicious code that allows for subsequent remote access. They could:

  • Connect a PCMCIA or PCIe card and dump memory or inject code.

  • Splice a hardware keylogger in between the keyboard's PS/2 or USB cable.

  • Quickly download and execute malicious code, or modify existing code.

  • Access sensitive files and save them (e.g. with a camera or USB flash drive).

  • Physically destroy the computer (e.g. with a hammer or a power surge over USB).

  • Simply grab the system and pawn it off for a quick buck.

Time for a story. I once had a target who I would be in close proximity to for a brief period. My goal was to gain persistence on their laptop to exfiltrate sensitive documents. I knew I had only a few seconds every time they went out of sight, so I couldn't just grab their laptop and take my time. I obviously also could not steal it. Luckily, I came prepared. I had a programmable USB device that I plugged in. As soon as it was plugged in, it simulated keyboard input to open PowerShell and execute a few commands to download a payload I had set up earlier. The scenario went like this:

  1. I waited until this person had left to get something for me in another room.

  2. I leaned over on the table where the laptop was and surreptitiously plugged in the device.

  3. I waited a few seconds to be safe, unplugged it, and tried to keep a straight face.

  4. After they gave me what I asked for, I thanked them and left.

  5. When I got home, I got on my computer and connected to their machine.

It was not difficult, did not take an extensive period of preparation, and was moderately stealthy. I could have made it even more stealthy if I used something that looked like a cell phone so I could claim I was just charging the device and didn't see any other USB ports around. The moral is that you can do a lot with just a few seconds of access, so you must never underestimate the risk.

So how do you protect against these threats? You need to develop a threat model. Figure out who your adversary is, what assets of yours they are after, and what their resources are. If you don't want your mother to see your porn when you're at her house, you probably don't need to worry about exploits abusing corrupt EDID in a VGA or HDMI cable. If you are holding extremely valuable company secrets in a highly competitive industry (robotics, epoxy, etc) and are going to a high-risk country like France or China, you absolutely need to worry about sophisticated attacks, because industrial espionage (aka the more illicit side of "corporate intelligence") is rampant. Stay with your computer at all times in adversarial situations. Lock it if you are going out of its line of sight, and bring it with you or physically secure it in a safe if you are going to be away for a longer period.

  • Comments are not for extended discussion; this conversation has been moved to chat. – Rory Alsop Jun 14 '18 at 17:34
  • 17
    Read this on Wednesday. On Thursday the exact same procedure was shown in new ep of the TV show Humans. Plug in USB, watch Powershell commands appear, exploit installed, wait a few moments for good measure, take USB out just as target returns from printer. Genius. – Lightness Races with Monica Jun 15 '18 at 12:03
  • 5
    @forest: It was frustrating that at the time I couldn't point it out to anybody who would understand the co-incidence :) – Lightness Races with Monica Jun 15 '18 at 13:14
  • 2
    France is high risk? Since when? – DeepS1X Jun 18 '18 at 4:09
  • 2
    @DeepS1X One example I found from searching "france industrial espionage". See also this, and this article which points France out as particularly aggressive. Or this. I mean, it's well known. – forest Jun 18 '18 at 4:41
29

I think you're also missing that there's other malicious things to be done beyond hacking. There are USB devices that can literally fry a computer. So even if they don't gain access or install dangerous software, a "few seconds" could cause thousands of dollars in damage, not to mention downtime to repair the affected systems.

  • 23
    On that note, you don't even need such fancy items like a 'USB stick'. If you're going for physical damage, you could do quite a bit in a few seconds with a hammer and some determination. :P – Salmononius2 Jun 11 '18 at 14:08
  • 15
    @Salmononius2 While that's true 1. It's a lot harder to hide a hammer 2. There's no plausible deniability ("It just stopped working!") 3. For a laptop, maybe, but most server/desktop cases would take more than a "few seconds" to get through without something substantial like a sledgehammer. – Machavity Jun 11 '18 at 14:20
  • 4
    The question is about "further access" not all risks. – schroeder Jun 11 '18 at 14:58
  • 3
    Then this would be better as a comment to offer a tangential consideration. We try to answer the questions directly. – schroeder Jun 11 '18 at 15:55
  • 3
    @MarkAmery That's a good way to get charged as a terrorist, not to mention get the FBI on your ass right away. It's a lot safer to simply zap someone's computer, since all they can do is complain to the cops who won't do anything simply because the value of the damaged property is so low. It's for the same reasons that stealthy assassins don't run up screaming to their victims with a battle axe. – forest Jun 15 '18 at 20:46
27

I can think of one way to prolong the physical access.

from google image search "smallest usb drive"

USB drives can be so tiny that the entire electronic portion fits under the contacts, and the tab is just so you can pull it out. You may modify one by cutting the tab off to fit stealthily inside a slot, so that the owner might not notice something's there right away. And by the time they do, who knows when or where someone may have inserted it? How often do you check your USB ports? :p

Also, many laptops have that plastic placeholder SD card to keep the lint and dust out. Do you check that often too?


And thirdly, with this stealthy approach, you may be able to manufacture a USB cable which includes a controller which acts as a normal charge/data cable but can become a man-in-the-middle for any connected devices. Or use an already existing "USB flash drive in a cable" accessory like this one:

https://www.amazon.com/Lexar-JumpDrive-128GB-Flash-Drive/dp/B012PKX1V2

  • 3
    SD cards cannot really do anything malicious. They are only seen as mass storage devices. – forest Jun 12 '18 at 3:49
  • 11
    @forest Well, some systems do automounting, which can allow for some amount of shenanigans - It's eg. easy to bring down a Linux box if you can get it to mount something you control; It's plausible for a vulnerability to exist that lets you do something more useful than just crash a system. (Sure, it requires an actual vulnerability, unlike USB where you can just pretend to be eg. a keyboard, but that doesn't make it inherently safe) – Aleksi Torhamo Jun 12 '18 at 11:09
  • 5
    @AleksiTorhamo That's quite true, and filesystem vulns are a dime a dozen, but it requires risking burning a 0day, which people are not always all that willing to do. – forest Jun 12 '18 at 11:37
  • 7
    @forest: If your security depends on an assumption that SD cards are only mass storage, game over: en.wikipedia.org/wiki/Secure_Digital#SDIO_cards – Ben Voigt Jun 13 '18 at 1:46
  • 3
    @forest Yes on certain devices. The bigger issue with using it as an attachment Vector is that it needs hardware support in the SD controller, which is not widespread. – Austin Hemmelgarn Jun 13 '18 at 14:07
4

If someone was prepared to compromise computers quickly, it would be quite easy to accomplish this:

  1. Create custom exploit payloads for most common operating systems (Windows / Linux / Mac OS X). Something very basic like a remote shell that communicates through HTTP client would be sufficient. Being custom-built, it is unlikely that antivirus programs would detect it, though you can always check beforehand and modify as needed.

  2. Prepare commands that will download your exploit and run it. Something like wget ...; chmod +x ...; ./.... Have some innocent looking webpage where these commands are easily copyable, e.g. hidden in some small text box.

  3. Ask to use the victim's web browser for a moment. Navigate to your page, copy the command to clipboard, quickly press Alt-F2 or Win-R to bring up the Run dialog, Ctrl-V to paste your commands and Enter to run them, Win-Down to minimize the command prompt.

Done well, the three key combinations take less than a second of time, after which the exploit has time to download itself in the background. Sure, this only gains you user-level privileges, but most important data is handled by the user anyway. For example passwords can be stolen without admin privileges.

On mobile phones, the same method doesn't work as they usually don't allow installing code from unknown sources by default. On PC's, at best you have some slowdowns like firewalls asking for confirmation.

1

A number of devices can be exceedingly dangerous in moments (seen from a physical or security perspective).

For example, firewire provides direct access to RAM, so a malicious FireWire device could be plugged in and grab(or change) specific RAM contents in moments, if enabled. Other devices may also enable/employ DMA for malicious purposes via external ports, now or in future.

Many attacks exist with USB. As well as in-line devices, keyloggers, and electrical disruptors already mentioned, there are devices that masquerade as other devices (a device that looks like a flash drive but contains a virtual keyboard, code that autoruns on the host, or additional devices such as hidden WiFi that bridges airgaps and allows other attacks.

In-line intercepts exist for monitor cables, allowing a third party to see the monitor's display.

Severe attacks could include dumping ram containing sensitive content (including OS or ring-0 protected encryption keys according to research), flashing ordinary as well as firmware based rootkits, breaching hypervisors (especially if autorun on the host), and anything else that can be done within a couple of seconds by malware that has complete access to a system.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.