Survey on the possibility of Windows 10 live login bypass / Inquérito sobre a possibilidade de desvio de login ao vivo no Windows 10
DOI:
https://doi.org/10.34117/bjdv8n3-159Keywords:
computer forensics, windows forensics, live analysis.Abstract
There are many scenarios where, during a law-enforcement or incident response situation,
it is of interest to obtain live session data stored in volatile memory (RAM) in Windows 10 machines, which may be locked by a login screen prompt. This work attempts to survey the bibliography for methods and tools that could, in theory or in practice, bypass said security mechanism and possibly aid digital forensic investigators and law-enforcement get the full picture of a case.
References
Interpol (2019) Global Guidelines for Digital Forensics Laboratories
https://www.interpol.int/content/download/13501/file/INTERPOL_DFL_
GlobalGuidelinesDigitalForensicsLaboratory.pdf
Microsoft Corporation (2021) Account lockout threshold
https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/
account-lockout-threshold
Microsoft Corporation (2021) Windows Logon Scenarios
https://docs.microsoft.com/en-us/windows-server/security/windows-authentication/
windows-logon-scenarios
Microsoft Corporation (2021) MSV1_0 Authentication Package
https://docs.microsoft.com/en-us/windows/win32/secauthn/msv1-0-authentication-package
Microsoft Corporation (2021) Kerberos SSP/AP
https://docs.microsoft.com/en-us/windows/win32/secauthn/kerberos-ssp-ap
Microsoft Corporation (2021) Kernel DMA Protection https://docs.microsoft.com/en-
us/windows/security/information-protection/kernel-dma-protection-for-thunderbolt
Microsoft Corporation (2021) Virtualization-based Security (VBS)https://docs.microsoft.
com/en-us/windows-hardware/design/device-experiences/oem-vbs
Microsoft Corporation (2021) Active Directory Accounts https://docs.microsoft.
com/en-us/windows/security/identity-protection/access-control/
active-directory-accounts#sec-krbtgt
Hak5 (2021) Lan Turtle https://hak5.org/products/lan-turtle
DemmSec (YouTube) Hack a locked computer using the LAN Turtle https://www.youtube.
com/watch?v=M0qZXLPOlvM
IJntema, Tim and Walet, Christian and Smit, Koen and van der Velde, Dave. (2018) Analysing
the Rogue Device Phenomena: An Explorative View on Threats and Potential Solutions. Euro-
pean Conference on Management, Leadership & Governance pgs 98-104. Academic Conferences
International Limited
Hack5 (2021) Stealing Credentials from a locked PC with
the LAN Turtle https://docs.hak5.org/hc/en-us/articles/
-Stealing-Credentials-from-a-locked-PC-with-the-LAN-Turtle
Thunderbolt Docking Stations Not Initializing at the Login Screen When
on a Domain https://www.dell.com/support/kbdoc/en-us/000134656/
thunderbolt-docking-stations-not-initializing-at-the-login-screen-when-on-a-domain?
lwp=rt
Aumaitre, Damien, and Christophe Devine. ”Subverting windows 7 x64 kernel
with dma attacks.” HITBSecConf Amsterdam (2010). https://conference.hitb.
org/hitbsecconf2010ams/materials/D2T2%20-%20Devine%20&%20Aumaitre%20-%
Subverting%20Windows%207%20x64%20Kernel%20with%20DMA%20Attacks.pdf
Boileau, Adam. ”Hit by a Bus: Physical Access Attacks with Firewire” https://papers.put.
as/papers/macosx/2006/ab_firewire_rux2k6-final.pdf
PiotrBani.Kon-BootforWindowsOfficialGUIDEhttps://kon-boot.com/docs/windows_
guide/
Gruhn, M., & Müller, T. (2013, September). On the practicability of cold boot attacks. In 2013
International Conference on Availability, Reliability and Security (pp. 390-397). IEEE
Bauer, Johannes, Michael Gruhn, and Felix C. Freiling. ”Lest we forget: Cold-boot attacks on
scrambled DDR3 memory.” Digital Investigation 16 (2016): S65-S74.
Yitbarek, Salessawi Ferede, et al. ”Cold boot attacks are still hot: Security analysis of memory
scramblers in modern processors.” 2017 IEEE International Symposium on High Performance
Computer Architecture (HPCA). IEEE, 2017.
Yitbarek, S. F. (2018). Hardware Mechanisms for Efficient Memory System Security (Doctoral
dissertation).
The MITRE Corporation. CVE-2017-11842 (2017) https://cve.mitre.org/cgi-bin/
cvename.cgi?name=CVE-2017-11842
The MITRE Corporation. CVE-2017-11850 (2017) https://cve.mitre.org/cgi-bin/
cvename.cgi?name=CVE-2017-11850
CVE Details. CVE-2003-0533 https://www.cvedetails.com/cve/CVE-2003-0533/
National Vulnerability Database. NVD CVE-2017-0144 https://nvd.nist.gov/vuln/
detail/CVE-2017-0144
