0

To protect against BadUSB key stroke injection attacks, it seems logical to require a password to access a command line with admin privileges. This can be done by modifying the "Value Data" of the following Registry Key to be 1:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin

As documented: "This option prompts the Consent Admin to enter his or her user name and password (or another valid admin) when an operation requires elevation of privilege. This operation occurs on the secure desktop"

This will prevent any unauthorised system modifications via the command line.

However, the Registry Editor itself doesn't require any password to access it, and a BadUSB attack could just assume that the protection measure above had been done, and therefore modify the key to the default 4 so that a password would not be required to access a command line with admin privileges.

So is there a way to protect the Registry Editor by requiring a password to open it?

Improve this question
5
  • 1
    Remove current account from local adminstrators group simply.
    – Akina
    Dec 3, 2019 at 19:02
  • To expand @Akina point - a standard user can't change the value as it is in HKEY_LOCAL_MACHINE. They can however change things in HKEY_CURRENT_USER
    – lx07
    Dec 3, 2019 at 19:13
  • Or you may alter access permissions on HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System for your account and deny keys values edit. But in such case you should edit permissions when you need to alter something, or execute regedit under another admin account.
    – Akina
    Dec 3, 2019 at 19:18
  • Thanks for the quick responses. Would there be a preferred or best practice approach to mitigate this possible attack?
    – Broadsworde
    Dec 3, 2019 at 19:28
  • You can just make windows UAC always require password
    – jhon
    Nov 29, 2022 at 20:41

1 Answer 1

Reset to default
1

You can modify the permissions of the file C:\WINDOWS\System32\regedt32.exe to only allow execute permission to administrators or other group that isn't the current user.

A fake USB keyboard can do a lot of damage through a lot of other means than the GUI registry editor, as in Windows there's many ways to accomplish everything. For example, there's there reg.exe command line utility, then you probably can do numerous things with rundll32.exe which you can't disable as it's used by Windows components and programs.

You ought to address this concern through limiting the system's response to removeable devices. I haven't looked into it in depth but perhaps Microsoft Defender ATP can help. Ideally you are authorizing one USB keyboard and mouse and refusing any other.

Something simple--but overkill for most--if your system has old-style PS/2 ports and you don't need USB devices (you may be wanting to disable removeable drives and cameras as well), simply disable the USB ports or disable the root hub devices from Device Manager.

Improve this answer
2
  • Thanks @LawrenceC, the Microsoft Defender ATP looks like the sort of thing I should be looking at. As should we all I guess, until a general solution is found to the firmware attack-vector.
    – Broadsworde
    Dec 3, 2019 at 19:54
  • Unfortunately, the maxim "If your system is not physically secured, it is insecure" is true. While this raises the ante significantly and is worth doing, someone could theoretically still find out the PID, VID, and serial number of your chosen keyboard, clone it, and create a malicious device. Of course that's very unlikely unless you are specifically and heavily targeted, but still possible.
    – LawrenceC
    Dec 3, 2019 at 20:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .