0

To protect against BadUSB key stroke injection attacks, it seems logical to require a password to access a command line with admin privileges. This can be done by modifying the "Value Data" of the following Registry Key to be 1:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin

As documented: "This option prompts the Consent Admin to enter his or her user name and password (or another valid admin) when an operation requires elevation of privilege. This operation occurs on the secure desktop"

This will prevent any unauthorised system modifications via the command line.

However, the Registry Editor itself doesn't require any password to access it, and a BadUSB attack could just assume that the protection measure above had been done, and therefore modify the key to the default 4 so that a password would not be required to access a command line with admin privileges.

So is there a way to protect the Registry Editor by requiring a password to open it?

New contributor
Broadsworde is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
  • 1
    Remove current account from local adminstrators group simply. – Akina Dec 3 at 19:02
  • To expand @Akina point - a standard user can't change the value as it is in HKEY_LOCAL_MACHINE. They can however change things in HKEY_CURRENT_USER – lx07 Dec 3 at 19:13
  • Or you may alter access permissions on HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System for your account and deny keys values edit. But in such case you should edit permissions when you need to alter something, or execute regedit under another admin account. – Akina Dec 3 at 19:18
  • Thanks for the quick responses. Would there be a preferred or best practice approach to mitigate this possible attack? – Broadsworde Dec 3 at 19:28
1

You can modify the permissions of the file C:\WINDOWS\System32\regedt32.exe to only allow execute permission to administrators or other group that isn't the current user.

A fake USB keyboard can do a lot of damage through a lot of other means than the GUI registry editor, as in Windows there's many ways to accomplish everything. For example, there's there reg.exe command line utility, then you probably can do numerous things with rundll32.exe which you can't disable as it's used by Windows components and programs.

You ought to address this concern through limiting the system's response to removeable devices. I haven't looked into it in depth but perhaps Microsoft Defender ATP can help. Ideally you are authorizing one USB keyboard and mouse and refusing any other.

Something simple--but overkill for most--if your system has old-style PS/2 ports and you don't need USB devices (you may be wanting to disable removeable drives and cameras as well), simply disable the USB ports or disable the root hub devices from Device Manager.

  • Thanks @LawrenceC, the Microsoft Defender ATP looks like the sort of thing I should be looking at. As should we all I guess, until a general solution is found to the firmware attack-vector. – Broadsworde Dec 3 at 19:54
  • Unfortunately, the maxim "If your system is not physically secured, it is insecure" is true. While this raises the ante significantly and is worth doing, someone could theoretically still find out the PID, VID, and serial number of your chosen keyboard, clone it, and create a malicious device. Of course that's very unlikely unless you are specifically and heavily targeted, but still possible. – LawrenceC Dec 3 at 20:44

Your Answer

Broadsworde is a new contributor. Be nice, and check out our Code of Conduct.

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.