0

I am a cybersecurity professional who is interested in researching the field of injectables.

Does a device exist, or can be made, that if plugged into a computer would instantly start attacking the computer to tear down password barriers and encryptions?

Essentially before the hypothetical device is plugged in you would have a normal password-protected computer and then once the device is plugged into the computer you are able to access the computer as if you have the passwords. You would have access to all accounts and all files once the device is plugged in.

Alternatively the device could also instantly start attacking the computer to the point of being able to inject malicious code into the computer.

3

1 Answer 1

3

For loose values of "hack a system", sure. See the BadUSB research on modifying normal USB devices, or the commercially-available USB Rubber Ducky for purpose-built hardware. In fact, Hak5 has a bunch of products in this space, some of which can carry out attacks other than the one explained in the next paragraph.

Note that in both cases, the typical attack is straightforward but not very exciting: the USB device presents itself as a keyboard (often in addition to storage, via an integrated USB hub) and injects keystrokes. A simple example on Windows might look like Win+R to open the Run dialog, followed by a command to download and execute a program from the Internet, followed by Enter and then a sequence of additional arrow keys and Enter signals to do things like immediately approve running a downloaded program, approve UAC elevation, and so on. Similar attacks will easily work on other operating systems. However, the attack does need to be customized to the target OS, and won't work if, for example, the victim plugs it in when there's no use logged in (it would instead spit a bunch of stuff into the Password field!).

There are more sophisticated attacks that might also be possible, especially with USB-C. For example, a USB device can pretend to be a network adapter, and claim to have faster routes to various other subnets of interest than the real adapter does; the PC would then route its network traffic through the USB device (which might forward it back to the real adapter, or transmit it through a built-in WiFi or cellular interface), enabling man-in-the-middle attacks. That attack doesn't require the user do anything at all beyond plug the USB device in and leave it in - in particular, it's not sensitive to when it's plugged in, or on what OS - but it may require a more sophisticated attack device. With USB-C, a device could fake being a monitor in order to capture the user's screen, potentially while also faking a keyboard to put the computer in display-mirroring mode; this is more likely to be perceptible to the victim (e.g. if entering mirror mode causes the screen resolution to change or UI to appear) and definitely requires some advanced hardware, but could otherwise be an attack that needs nothing except getting plugged in for excellent spying access (that could in theory be forwarded to an attacker somewhere else).

These are not a comprehensive list of potential attacks or avenues for compromise. Nor does this answer necessarily consider any recent research. This answer is intended to get you started, not to make you an expert; if you want more information, you should look up these topics yourself, and return if you have additional more-specific questions.

Finally, it must be mentioned that "attacking the computer to tear down password barriers and encryptions" is not usually possible. USB attack devices can't do anything that a non-malicious USB device couldn't do, and since OS security and encryption software are obviously going to have "the computer has USB ports" in its threat model, it would be extremely foolish for the developers of that software to enable bypassing the security by connecting a USB device. However, there are some potential avenues for attack that you might consider. Most relevantly, Thunderbolt devices (which use USB-C connectors for TB3 and TB4) have PCIe access, and thus direct memory access (DMA). While there are both hardware and software restrictions to mitigate the risk of DMA access (see e.g. Windows 11's kernel DMA protection or the older Bitlocker DMA protections linked from that page, which blocks dangerous DMA activity when the OS is locked), there's also the risk of flaws in these protections. Thunderspy is a class of Thunderbolt DMA attacks that attempt to bypass the hardware protections of Thunderbolt at least up through version 3 (though software or firmware protections, such as disabling DMA interfaces on external ports, might still be effective).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .