Security researcher Rob Fuller has discovered a unique attack method that can steal credentials from Windows and Mac computers, and possibly Linux as well (it has not been tested yet).
The Fuler attack works on locked computers, where the user is already logged in.
The researcher uses USB-based Ethernet, whose firmware code he modified to run special software that makes the plug-and-play USB device act as a network gateway, DNS and WPAD servers on the computer it is connected to.
The attack is possible because most computers will automatically install any plug-and-play (PnP) USB device.
Fuller wrote on his blog:
“Why does this work? Because USB is Plug-and-Play. This means that even if a system is locked, the device is still installed. However, I believe there are restrictions on the types of devices that are allowed to be installed while the computer is locked on the newer operating systems (Win10/El Capitan), but Ethernet/LAN is definitely on the whitelist.”
When installing the new plug-and-play USB Ethernet adapter, the computer will provide the local credentials required to install the device.
Fuller's modified device includes software that engages with these credentials and stores them in an SQLite database.
The researcher's modified device also includes an LED that lights up when the credentials have been recorded.
The attacker needs physical access to a device to connect the USB Ethernet adapter, but Fuller says the average attack time is 13 seconds.
Fuller couldn't believe this type of attack was possible, so he tested the scenario with Ethernet USB dongles, such as the USB Armory and Hak5 Turtle.
He says the attack was successful on Windows 98 SE, Windows 2000 SP4, Windows XP SP3, Windows 7 SP1, Windows 10, OS X El Capitan, and OS X Mavericks. The researcher plans to test the attack on Linux as well.
[su_youtube url=”https://youtu.be/Oplubg5q7ao” width=”640″ height=”380″]https://www.youtube.com/watch?v=B7o0qA4L4So[/su_youtube]
