The Firewire DMA hack Inception allows for the password checking subroutines on a local Windows box to be overwritten, allowing any password to be entered for a locked computer. My question is about the impacts of this on a networked system.

When logging in to an Active Directory controlled system, the system is given a token that it can use to gain access to network resources for the user without the user having to re-enter their password. Is this token kept when locking the system or reacquired when unlocking?

I am trying to better understand the possible risks of an Inception derived attack on a corporate network. If it only allows access to the local system, it is significantly less of a risk factor than if it is also able to gain access to network resources associated with the user.

2 Answers 2


Honestly, I don't know. What you could do is log in to a computer requiring a network connection to log on (no offline profiles), make some test connections to show that the token is working. Then lock the computer remove the network connection and log back on. Turn off your domain controller, and If you cant get onto any network shares then the computer had to re authenticate to the controller.

  • Hmm, that does seem to be a good test case, unfortunately I don't have a lab handy I can test it in atm. :( I'll give you a +1 for a good suggestion of how to test it though.) Jun 11, 2013 at 3:38

AFAIK the token is never destroyed as the session is still present, but that doesn't mean the token doesn't get stale. The token gets refreshed on an unlock.

  • I suppose more directly, my question is that if the lock functionality is broken so that it returns true for any password, is the network token still viable or is it broken just like if you were to hack the local password file. Jun 10, 2013 at 20:54
  • I don't have a test lab set up to run Inception, but the trivial case to test this is can you run a new network process or create a new connection once you run inception. Reviewing the literature on MS access tokens ( msdn.microsoft.com/en-us/library/windows/desktop/… ) my suspicion is that even if the network tokens went bad, they're really just impersonation tokens, so they'd just be renewed using the primary token for the user. Jun 10, 2013 at 23:40
  • @BrandonFranklin - right, but since locking the computer requires re-entry of the password, it may or may not get a new token (similar to how some security permission updates work on a lock/unlock). Jun 11, 2013 at 1:51
  • If you run it in the lab, let us know. I'm curious. The particulars of access token refresh are poorly documented, even in the sysinternals stuff. Jun 11, 2013 at 2:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .