How safe is locking the screen?

Question

So, both windows and linux have a pretty useful feature that allows you to leave everything running on the PC while also keeping invaders away by locking the screen. My question is:
Say I leave my laptop with the screen locked while I go get a donnut, and then it gets stolen. Assuming the thief has access to whatever software he needs, how easy/hard would it be for him to access my (currently logged-in) account?

Now let me be clear. I'm not asking if he can access the data on the harddrive. I know he can, and that issue would go under data encryption, which is not my question here. I'm focusing on how hard would it be to get around the "Insert Password" screen, and have full access to my account.

I'm looking for answers regarding both OS's; but, if needed, assume Ubuntu.

Thank you.

Answer 1

The answer is probably "safe enough" and I would be more concerned about being without my laptop and having to buy a new one than having my data stolen.

Both operating systems are waiting for the password to be typed in and, as far as I know, there is no way of automating this process. You are therefore back to the normal safe password practices - so don't have the password written on a post-it note attached to the laptop's screen.

Also consider who is going to steal the laptop. Are you some mega-important government employee with extremely important information that a foreign government would pay millions for and use a team of highly trained spies to get, or is your laptop going to be stolen by some kid looking for a bit of beer (or other intoxicating substance) money?

Once someone sees the password prompt I would imagine that the chances are that they will just install a pirated copy of Windows over the top of your stuff anyway - that would be far easier and quicker than going to the trouble of cracking the password.

Answer 2

Anyone with access to the computer can crack the password file, but it gets even scarier than that. If the thief is familiar with the cold boot attack, even data that's encrypted on-disk is not safe, because the contents of RAM can be read (including any in-memory decryption keys)--even after the RAM is physically removed from the machine and installed in a different computer.

Theoretically, the thief could get a memory dump and image your hard drive, then load both into another identical machine and see what you were working on behind the locked screen--and you wouldn't even know because your computer would still be at your desk.

But, as Neal mentioned, you're probably safe, because most people with physical access to your computer either don't have the know-how or aren't that interested in what's on your computer.

Answer 3

I believe if i plug in my wireless receiver for my KB/Mouse, it automatically loads the drivers to make my KB/Mouse work, even while my screen is locked. So theoretically, someone can plug in an USB device that emulates typing on the keyboard and try a brute force attack on such a device. But then it just relies on the security of your password.

Answer 4

If the hard drive can be accessed, that means password file/stores can be accessed. At the very least an attacker could brute force it using the password file and a cracker. Perhaps others can provide information on OS specific vulnerabilities in this scenario.

Answer 5

In terms of getting into your account, it's really no different than logging out/shutting down. The only difference is that in order to brute force their way in, they only need your password, rather than a username + password combo, so that makes it technically easier to break into.

Answer 6

As far as I know, there is no way to get around the locked screens in Ubuntu or Windows 7.

However, all they would have to do is shut down the computer, take out the hard drive and connect it to their computer, replace the password file, put the hard drive back in, turn on the computer, and log in with the new password (or use a live CD to do the same). No brute forcing would even be necessary.

For getting access to the session at the time of locking, I don't think that is easily possible.

Answer 7

On Linux at least, if an attacker were able to get shell access on the computer, either under your user account or the root account, (s)he could kill the screensaver process, which would unlock the desktop. Of course, that still requires the attacker to guess your login credentials somehow, so it doesn't really reduce security that much. Just don't leave yourself logged in on virtual terminals. (Of course, if an attacker could exploit some software bug to get that shell access without actually logging in, you know what happens...)

Answer 8

If he is running Windows XP then yes, if he has a firewire port an attacker can get direct access to this system while it remains on the desk without requiring any login account or password. I understand this was fixed in a late service pack and that Win 7 is not vulnerable, however I can't confirm that.

Basically firewire was designed to have direct memory access, and security wasn't really considered :-)

When an attacker steals the laptop itself, you are pretty much at the mercy of the attacker. If you work for a corporate, and they are a common thief looking for quick money it may be worth their while selling the laptop to a criminal group, who may be motivated to break in. This is likely to be simple, and as the machine is already on, you don't have the protection of any full disk encryption you may have installed.

So it comes down to the attacker's motivation.

My advice - kryptonite locks (to slow them down), physical security (locks, security at front desk) or if you don't have those, just take the laptop with you.

Answer 9

The attacker can review the source code for your various input device drivers and exploit any bugs by connecting a device. For example, there may be a certain sequence of bits that will cause a buffer overrun in the parallel port driver, then the attacker could hook up to that port and send those bits, followed by bits to kill your screensaver. This isn't likely or easy, but it's possible.

Or they could just connect a device to ps/2 or usb to send passwords. like Roy says. This won't work for an attack on a windows pc joined to a domain, because he'll have to reboot the computer after locking the account out (if the domain has that policy). But for Ubuntu it would be possible under the default configuration.