Learn about Zero Trust Architecture
Impenetrable cybersecurity without sacrificing usability
Gain detailed visibility into all your endpoints activities
Harden applications and hardware environments
Immediate and continuous response to incidents
Close the window of time your data could be exposed
Get your Comodo solutions setup, deployed or optimized
Control access to malicious websites
Defend from any internet based threats
Stop email threats before it enters your inbox
Preserve and protect your sensitive data
Keep your website running fast and malware free
Add encryption to your websites
Automated certificate mgmt. platform
Secure private intranet environments
Digital signature solutions for cloud apps
Encrypt emails for senders and recipients
Stay compliant with PCI DSS
Trusted authentication for IoT devices
Francisco Partners a leading technology-focused private equity fund, has acquired a majority stake in Comodo’s certificate authority business. Newly renamed from Comodo CA Limited to Sectigo Limited. Privacy Policies, Trademarks, Patents and Terms & Conditions are available on Sectigo Limited’s web site.
Meet the people behind the direction for Comodo
Get the latest news about Comodo
People are the key to achievement and prosperity
Stay up to date with our on-demand webinars
Worldwide: Sales, Support and General Inquiries
Schedule a live demonstration of our solutions
Need immediate help? Call 1-888-551-1531
Instantly removes viruses to keep your PC virus free
Experience true mobile security on your mobile apple devices
Secure Internet Browser based on Chrome
Chrome browser internet security extension
Submit a ticket to our support team
Share any product bugs or security flaws
Collaborate with research experts on data sets
Valkyrie Threat Intelligence Plugins
Valkyrie Threat Intelligence APIs
This should come as a surprise, a mild or perhaps not-so-mild shock, to those many people who lock their computer screens while temporarily moving away. Well, your system, your data is not secure when you do so. It’s just a USB device that’s needed to steal critical data from your locked system. This might be news for many, as regards PC security.
Security expert Rob Fuller has now explained that it’s very easy to copy an OS account password hash from a locked computer using a special USB device, and that too in a few seconds. This hash can then be cracked or used directly in network attacks. Rob, who has over a decade’s experience covering all aspects of information security, has explained this in detail in a post that he has made on his website www.room362.com.
Rob Fuller has proved this using a flash-drive-size computer device called USB Armory that costs $155, but he has also stated that it can be done using other cheaper devices as well. Says Rob Fuller- “I started off with a USB Armory ($155) but below I’ll show you how to do this with a Hak5 Turtle ($49.99) as well.”
How it works
All that it takes is to plug in a device that masquerades as a USB Ethernet adapter in such a way that it becomes the primary network interface on the locked computer that’s targeted. This is rather easy because firstly, even if a computer is locked, OSs automatically start installing newly connected USB devices, including Ethernet cards, and secondly, the OSs automatically configure such devices as the default gateways.
Says Rob Fuller in his website post- “USB is Plug-and-Play. This means that even if a system is locked out, the device still gets installed. Now, I believe there are restrictions on what types of devices are allowed to install at a locked out state on newer operating systems (Win10/El Capitan), but Ethernet/LAN is definitely on the white list.”
When a new network card gets installed, the Operating System would configure it to automatically detect the network settings. This is done through the DHCP (Dynamic Host Configuration Protocol) and anyone wishing to steal data from a locked computer can have a rogue computer at the other end of the Ethernet cable to act as a DHCP server. When it’s a USB Armory that’s used, it becomes easier because USB Armory works like a computer on a stick, powered via USB and running on Linux. Thus, there is no need to attach a separate rogue machine.
Thus, the attacker happens to gain control of a computer’s network settings using the USB device. He thus also can control the system’s DNS (Domain Name System) responses and is able to configure a rogue internet proxy through the WPAD (Web Proxy Autodiscovery) protocol and more. Thereby he attains an advantageous man-in-the-middle position, which he can utilize to intercept and tamper with the computer’s network traffic.
As Rob Fuller says- “Computers are constantly creating traffic, even if you don’t have any browsers or applications open, and most computers trust their local network…” Thus, it becomes possible for the attacker who makes his entry into the system using the USB device to extract the account name and the hashed password. The capturing of credentials from a locked system in this manner can be done in a short time. Rob Fuller says he needed only about 13 seconds for his test attack.
The stolen password hashes would either be in the in NT LAN Manager (NTLM) version 2 or NTLMv1 format, based on the targeted computer and its configuration. NTLMv2 hashes, though harder to crack, can be cracked if the password is not too complex and the hacker uses a powerful password cracking rig. Moreover, there are some instances where relay attacks against network services can be made possible by using NTLM hashes directly without having to know plaintext passwords.
So, next time you move away leaving your computer locked, remember that someone can very easily get away with your credentials and shatter your concepts regarding PC security.
What is Computer Virus
DDoS Attack Forces Wikipedia Offline
Antivirus for Android
Tags: PC Security
Reading Time: 3 minutes With millions of people using the Internet daily for several different activities ranging from paying bills to buying and selling, the need for a reliable Internet security measure is indeed increasing. This insists on the need for Internet security to be able to protect financial details and everything handled by an organization’s network hardware or…
Reading Time: 3 minutes Sometimes a marketing analogy misleads us about the complex idea it is trying to simplify. A great example of this is equating PC security to the immune system of the human body. Because we accept being unwell with a cold as a fact of life, we assume computer infections are inevitable too. They are not….
Reading Time: 3 minutes Remember when online security meant avoiding those sites on the wrong side of the tracks? No more. Malvertising is booming—not only in the number of attacks, but in sophistication as well. “Malicious advertising” is the illegal effort of spreading malware through legitimate online advertising, which is notoriously difficult to protect against. It’s a silent and…
Sign up to our cyber security newsletter
Comodo Cybersecurity would like to keep in touch with you about cybersecurity issues, as well as products and services available. Please sign up to receive occasional communications. As a cybersecurity company, we take your privacy and security very seriously and have strong safeguards in place to protect your information.
See how your organization scores against cybersecurity threats