Windows Hello bypassed using infrared image
therecord.media
Windows Hello bypassed using infrared image
1–10 of 57 posts
Re: Windows Hello bypassed using infrared image
#2It seems like it wouldn't be a stretch to make a USB webcam that presented an "animated" infrared image -- would that defeat this fix?
What I'd really like is the system to consider every new USB device untrusted, and require specific approval before it's added as a device. This should apply to its capabilities too (eg: if a "keyboard" suddenly is presenting itself as storage, that causes a prompt). Think along the lines of "Acme WebCam XYZ wants to add a Camera and Microphone. Allow?"
And while the computer is locked this should absolutely be impossible.
I went looking for some commercial stuff, and there seems to be products aimed at businesses -- but seems these are centrally-managed, work by whitelisting specific devices ahead of time, and are more focused on data exfiltration than preventing a rogue keyboard, badusb or rubber ducky. Is there something that does this?
Re: Windows Hello bypassed using infrared image
#3It seems like it wouldn't be a stretch to make a USB webcam that presented an "animated" infrared image -- would that defeat this fix? What I'd really like is the system to consider every new USB device untrusted, and require specific approval before it's added as a device. This should apply to its capabilities too (eg: if a "keyboard" suddenly is presenting itself as storage, that causes a prompt). Think along the l…
Seems like a recipe for severe headaches and cursing when devices fail while you're logged out and now you can't log in by just connecting a new keyboard.
Re: Windows Hello bypassed using infrared image
#4cool
Re: Windows Hello bypassed using infrared image
#5It seems like it wouldn't be a stretch to make a USB webcam that presented an "animated" infrared image -- would that defeat this fix? What I'd really like is the system to consider every new USB device untrusted, and require specific approval before it's added as a device. This should apply to its capabilities too (eg: if a "keyboard" suddenly is presenting itself as storage, that causes a prompt). Think along the l…
Seems like a recipe for severe headaches and cursing when devices fail while you're logged out and now you can't log in by just connecting a new keyboard.
"Please press this key sequence, then type your password, on the newly attached keyboard to enable it for use."
Re: Windows Hello bypassed using infrared image
#6It seems like it wouldn't be a stretch to make a USB webcam that presented an "animated" infrared image -- would that defeat this fix? What I'd really like is the system to consider every new USB device untrusted, and require specific approval before it's added as a device. This should apply to its capabilities too (eg: if a "keyboard" suddenly is presenting itself as storage, that causes a prompt). Think along the l…
Now I'm curious if there's some device that presents itself as a keyboard, types some Powershell script and "copies" files off of the computer using numlock/capslock/scrolllock signals.
Re: Windows Hello bypassed using infrared image
#7If you're using that as your sole authentication mechanism, then you're not encrypting your data with a password. It's already game over.
These kinds of things of 'security'* features can't be considered protection for the valuable data on your computer, or the e-commerce account you're currently signed in on.
This stuff is for preventing Steven from making a funny Facebook post in your name (he'll find a way anyways).
*roughly the same level of 'security' a "beware fluffy the furry menace" sign on your garden fence provides.
Re: Windows Hello bypassed using infrared image
#8It seems like it wouldn't be a stretch to make a USB webcam that presented an "animated" infrared image -- would that defeat this fix? What I'd really like is the system to consider every new USB device untrusted, and require specific approval before it's added as a device. This should apply to its capabilities too (eg: if a "keyboard" suddenly is presenting itself as storage, that causes a prompt). Think along the l…
Now I'm curious if there's some device that presents itself as a keyboard, types some Powershell script and "copies" files off of the computer using numlock/capslock/scrolllock signals.
That's a USB Rubber Ducky
Re: Windows Hello bypassed using infrared image
#9Earlier quoted context omitted.
Now I'm curious if there's some device that presents itself as a keyboard, types some Powershell script and "copies" files off of the computer using numlock/capslock/scrolllock signals.
That's a USB Rubber Ducky
Hah.
Never played with one, but I just assumed it was a macro playback engine, not surprising, I suppose it would do more.
Re: Windows Hello bypassed using infrared image
#10It seems like it wouldn't be a stretch to make a USB webcam that presented an "animated" infrared image -- would that defeat this fix? What I'd really like is the system to consider every new USB device untrusted, and require specific approval before it's added as a device. This should apply to its capabilities too (eg: if a "keyboard" suddenly is presenting itself as storage, that causes a prompt). Think along the l…
>if a "keyboard" suddenly is presenting itself as storage, that causes a prompt
I'm not clear on how you would know it was the keyboard changing identities and not just a new device. Does the USB protocol provide anything where you would know, assuming devices can change Base Class, VID, PID, and so on?
For that matter, I don't think it needs to change. It can just emulate a hub and present both.