You need physical access or someone stupid enough to try using a USB drive they found, but this would dramatical speed up a attack.
Unless you found a computer someone forgot to lock before walking away, I don’t think this would work at my company. Brute force logins are not possible, and data cannot be transferred to external hard drives, thumb drives, etc.
Still, it is a very cool device.
Via email from Rolf.
It would work on most locked computers.
How does your company stop you from putting data on USB drives?
The DOD usually does this by disabling *all* USB devices except for an explicit white list. (often reporting the insertion of unapproved drives) This method *will* stop the above device, and all *other* new devices (not on the whitelist).
They also use controlled access “smart” cards, as a “second factor” to log in, so yeah, hard to brute force (not impossible). Without something like that, brute force *is* possible, unless you lock the system down after too many failed attempts, but then, how do you get back in to your own computer?
“Data Loss Prevention” (DLP) software will block the transfer and lock your machine.
No passwords. Login requires a biometric or a smart card with a PIN.
None of those restraints apply to people who are adminstrators of their own computers.
Almost no one is allowed to be administrator of their computer.
Most people would be amazed at how poor the cybersecurity is at most companies and large organizations. The problem is that efficient and effective cybersecurity makes the day to day operations of an organization sluggish and inefficient. Speed of function and security do NOT go together when it comes to corporate workstations. Network admins are forced to try and seek a balance between user friendly and useful PC’s and the need for security.