Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Windows Hello bypassed using infrared image

therecord.media

Post reply on HN
Print view View original

21–30 of 57 posts

Re: Windows Hello bypassed using infrared image

#21

Post by SilverRed »

chmod775 wrote: post #7

If you're using that as your sole authentication mechanism, then you're not encrypting your data with a password. It's already game over. These kinds of things of 'security'* features can't be considered protection for the valuable data on your computer, or the e-commerce account you're currently signed in on. This stuff is for preventing Steven from making a funny Facebook post in your name (he'll find a way anyways…

The problem is that Apple does facial recognition and does it in a semi secure way which builds trust in the technology. Then microsoft and samsung jam in the feature without any of the security considerations and ride off the trust Apple built in it.

It's completely outrageous that MS thought it was acceptable to do facial recognition using a basic webcam.

Re: Windows Hello bypassed using infrared image

#22

Post by tyingq »

gregmac wrote: post #20
tyingq wrote: post #10

Earlier quoted context omitted.

>if a "keyboard" suddenly is presenting itself as storage, that causes a prompt I'm not clear on how you would know it was the keyboard changing identities and not just a new device. Does the USB protocol provide anything where you would know, assuming devices can change Base Class, VID, PID, and so on? For that matter, I don't think it needs to change. It can just emulate a hub and present both.

My point was if the class, VID or PID changes then treat it like a "new" device. If it presents subdevices or is suddenly a hub, those are new devices. You'd have to also detect PID/VID brute force attacks. Short of a cryptographic key (as gruez talked about), a device being able to guess a valid class+PID+VID combo would be bad, so this would have to be treated similar to a password brute-force attack: too many "new…

>My point was if the class, VID or PID changes then treat it like a "new" device

Yes, I understood that. What I'm saying that USB wouldn't give you any context for that. A device changing would be indistinguishable from one being removed and a new one going in. Or future "rubby duckies" could emulate a hub, and add multiple devices, all operating simultaneuously.

Re: Windows Hello bypassed using infrared image

#23

Post by numpad0 »

tyingq wrote: post #10
gregmac wrote: post #2

It seems like it wouldn't be a stretch to make a USB webcam that presented an "animated" infrared image -- would that defeat this fix? What I'd really like is the system to consider every new USB device untrusted, and require specific approval before it's added as a device. This should apply to its capabilities too (eg: if a "keyboard" suddenly is presenting itself as storage, that causes a prompt). Think along the l…

>if a "keyboard" suddenly is presenting itself as storage, that causes a prompt I'm not clear on how you would know it was the keyboard changing identities and not just a new device. Does the USB protocol provide anything where you would know, assuming devices can change Base Class, VID, PID, and so on? For that matter, I don't think it needs to change. It can just emulate a hub and present both.

Current USB host controllers aren’t built in the way they can distinguish between physical removal and electronic self reset.

Maybe if you’re NSA you could roll your own USB xHCI and a USB A receptacle that could characterize and identify individual units down to a machine in China used to assemble it, but that will be lightyears ahead of commercial USB host controllers.

Re: Windows Hello bypassed using infrared image

#25

Post by gregmac »

tyingq wrote: post #22
gregmac wrote: post #20

Earlier quoted context omitted.

My point was if the class, VID or PID changes then treat it like a "new" device. If it presents subdevices or is suddenly a hub, those are new devices. You'd have to also detect PID/VID brute force attacks. Short of a cryptographic key (as gruez talked about), a device being able to guess a valid class+PID+VID combo would be bad, so this would have to be treated similar to a password brute-force attack: too many "new…

>My point was if the class, VID or PID changes then treat it like a "new" device Yes, I understood that. What I'm saying that USB wouldn't give you any context for that. A device changing would be indistinguishable from one being removed and a new one going in. Or future "rubby duckies" could emulate a hub, and add multiple devices, all operating simultaneuously.

I don't see why you need context?

> A device changing would be indistinguishable from one being removed and a new one going in. Or future "rubby duckies" could emulate a hub, and add multiple devices, all operating simultaneuously.

In all of these cases, the system should show a prompt asking the user for authorization. Hopefully in a way that makes it clear if they didn't just physically attach a new keyboard, they should be extremely suspicious about what's currently connected to their USB ports.

Re: Windows Hello bypassed using infrared image

#26

Post by tyingq »

gregmac wrote: post #25
tyingq wrote: post #22

Earlier quoted context omitted.

>My point was if the class, VID or PID changes then treat it like a "new" device Yes, I understood that. What I'm saying that USB wouldn't give you any context for that. A device changing would be indistinguishable from one being removed and a new one going in. Or future "rubby duckies" could emulate a hub, and add multiple devices, all operating simultaneuously.

I don't see why you need context? > A device changing would be indistinguishable from one being removed and a new one going in. Or future "rubby duckies" could emulate a hub, and add multiple devices, all operating simultaneuously. In all of these cases, the system should show a prompt asking the user for authorization. Hopefully in a way that makes it clear if they didn't just physically attach a new keyboard, they…

Yes, you could prompt for every USB device detection. You would have to do that on boot too, though, which would probably give users security notice fatigue. There's basically no persistence, serial numbers, etc.

Re: Windows Hello bypassed using infrared image

#27

Post by ivegotnoaccount »

nitrogen wrote: post #5
noobermin wrote: post #3

Earlier quoted context omitted.

Seems like a recipe for severe headaches and cursing when devices fail while you're logged out and now you can't log in by just connecting a new keyboard.

"Please press this key sequence, then type your password, on the newly attached keyboard to enable it for use."

Then you will (probably) get malwares that open a window in fullscreen that imitates that prompt and sends data to a server.

You probably could add some kind of fingerprint that allow identifying the legit prompts, but since it is not done with login screens...

Re: Windows Hello bypassed using infrared image

#28

Post by nitrogen »

ivegotnoaccount wrote: post #27
nitrogen wrote: post #5

Earlier quoted context omitted.

"Please press this key sequence, then type your password, on the newly attached keyboard to enable it for use."

Then you will (probably) get malwares that open a window in fullscreen that imitates that prompt and sends data to a server. You probably could add some kind of fingerprint that allow identifying the legit prompts, but since it is not done with login screens...

This is why Windows used to ask for Ctrl-alt-del before login. And if you have malware already on your system, it's already too late.

Re: Windows Hello bypassed using infrared image

#29

Post by f1refly »

SilverRed wrote: post #21
chmod775 wrote: post #7

If you're using that as your sole authentication mechanism, then you're not encrypting your data with a password. It's already game over. These kinds of things of 'security'* features can't be considered protection for the valuable data on your computer, or the e-commerce account you're currently signed in on. This stuff is for preventing Steven from making a funny Facebook post in your name (he'll find a way anyways…

The problem is that Apple does facial recognition and does it in a semi secure way which builds trust in the technology. Then microsoft and samsung jam in the feature without any of the security considerations and ride off the trust Apple built in it. It's completely outrageous that MS thought it was acceptable to do facial recognition using a basic webcam.

Maybe it's just completely outrageous that people still think Microsoft or Samsung care about them in any way?

Re: Windows Hello bypassed using infrared image

#30

Post by schmorptron »

banana_giraffe wrote: post #6
gregmac wrote: post #2

It seems like it wouldn't be a stretch to make a USB webcam that presented an "animated" infrared image -- would that defeat this fix? What I'd really like is the system to consider every new USB device untrusted, and require specific approval before it's added as a device. This should apply to its capabilities too (eg: if a "keyboard" suddenly is presenting itself as storage, that causes a prompt). Think along the l…

Now I'm curious if there's some device that presents itself as a keyboard, types some Powershell script and "copies" files off of the computer using numlock/capslock/scrolllock signals.

Yes! Look into BadUSB, there's some really cool, but also scary, stuff out there.
Post reply on HN