If i leave my screen locked and someone sticks in a thumbdrive that was manipulated using the bad USB exploit would an attack be possible?
The three most widely known ways that Bad USB affects a computer is:
- A device can emulate a keyboard and issue commands on behalf of the logged-in user, for example to exfiltrate files or install malware. Such malware, in turn, can infect the controller chips of other USB devices connected to the computer.
The device can also spoof a network card and change the computer’s DNS setting to redirect traffic.
A modified thumb drive or external hard disk can – when it detects that the computer is starting up – boot a small virus, which infects the computer’s operating system prior to boot.
If your screen was locked, then discounting a brute force attack against the lock screen only (2) would apply, affecting any currently active or scheduled process that makes outbound connections from your computer. However, if these processes authenticate the remote server by use of TLS/SSL certificates then this threat would be mitigated.
Depends on the hardware group policy settings on the computer and hardware availability.
In many cases you can disable USB plugs on certain areas of the motherboards. Also windows does install drivers for connected active USB ports depending if your logged in or not. If the drive is plugged in and driver loaded by windows then the BAD USB could auto launch and begin running malicious code.
Group policy also sets permissions on if drives can be added or not. This helps prevent items from running. I am not sure what code is executed or at what stage of initialization of the drive but good deterrence is use of GPO and BIOS restrictions.
That is my first hand testing. Not sure what others could say. I can definitely see that if the drive is powered and it is initialized somehow with power code can be executed to inject a driver and run malicious code.