Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud

11/18/2019
05:30 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
100%
0%

Windows Hello for Business Opens Door to New Attack Vectors

Researchers exploring Windows Hello for Business found an Active Directory backdoor and other attack vectors that could lead to privilege escalation.

Researchers investigating Microsoft's Windows Hello for Business have discovered new attack vectors, including a persistent Active Directory backdoor that they say current security tools don't detect.

Windows Hello for Business (WHfB) was introduced in Windows 10 and Windows Server 2016 to bring password-less authentication into Active Directory-based environments and lessen the risk of password theft. Users can authenticate to a Microsoft, Active Directory, or Azure Active Directory account with a credential that is tied to the device and uses a biometric or PIN. WHfB is built on top of common industry standards including Kerberos PKINIT, JWT, WS-Trust, or FIDO2, and it relies on cryptographic mechanisms like TPM key attestation or token binding.

Michael Grafnetter, IT security researcher and trainer for CQURE and GOPAS, was intrigued by WHfB and began to research the tool so he could better understand its internal workings. What he found was a lack of official documentation regarding how the feature works in Windows, making WHfB a "black box" for most administrators, security auditors, and pentesters, he says.

"This is something I was a little bit disappointed in," Gafnetter admits, noting there are other Windows security features lacking technical documentation: how Windows stores passwords, for one, or how passwords are encrypted. "This was always like smoke and mirrors," he adds.

To learn more about how WHfB operates, Grafnetter has spent the past year studying the feature and the past two months doing a deep dive. He will present his findings at the upcoming Black Hat Europe show in a briefing entitled "Exploiting Windows Hello for Business." His research yielded three different attack vectors against WHfB. One has already been fixed; another is currently under review. He hopes it will be complete by the time Black Hat rolls around.

Grafnetter warns of a vector in a security-critical AD attribute called msDS-KeyCredentialLink, which can store data related to Windows Hello, FIDO2, or BitLocker Drive Encryption. It holds references to devices that users register with Active Directory for authentication. If someone registers a notebook or YubiKey with WHfB, data is logged with msDS-KeyCredentialLink.

This is a relatively new attribute, Grafnetter says, and it can potentially be used or misused for persistence by an attacker. If someone gets hold of a domain, they can hide and maintain access to the same domain – even if all the passwords for the account are reset, he explains. Because it's new, the attribute and its values are rarely properly audited by security teams.

The problem is, few people understand this feature and don't know to look for issues, even though WHfB is part of AD in Windows Server 2016 and cannot be turned off. While he admits not many administrators or everyday users of these tools and features ask the same deep-dive questions a security researcher does, Grafnetter says he has spoken with Active Directory experts who don't know exactly how the technology works, "which really took me by surprise."

Even if companies don't actively use tools like Windows Hello for Business every day, they should audit these attributes and raise an alert if they notice any changes on admin accounts, he notes.

msDS-KeyCredentialLink lacks proper documentation of its behavior and security implications, Grafnetter explains. The AD Schema documentation only says "this attribute contains key material and usage information." While this is true, "I think that this is simply not enough and that its behavior and security implications deserve to be documented properly," he says. Knowing how this feature works can help discover when it's being maliciously used.

Microsoft is on the right track with WHfB, which Grafnetter says "really seems to be the future of authentication." Still, the threat of persistence is relevant to many Windows users, and it's clear as soon as they begin to audit the values to the msDS-KeyCredentialLink attribute. At Black Hat Europe in London, he plans to release a tool designed to scan corporate environments for these issues and provide needed visibility into Windows Hello for Business usage in Active Directory. Grafnetter developed the tool over the past year to aid him in his research, he notes.

In addition to his briefing on Windows Hello for Business, Grafnetter will be doing a live demonstration of DSInternals PowerShell Module at Black Hat Europe 2019.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/17/2020
APT Groups Set Sights on Linux Targets: Inside the Trend
Kelly Sheridan, Staff Editor, Dark Reading,  9/11/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-5605
PUBLISHED: 2020-09-18
Directory traversal vulnerability in WHR-G54S firmware 1.43 and earlier allows an attacker to access sensitive information such as setting values via unspecified vectors.
CVE-2020-5606
PUBLISHED: 2020-09-18
Cross-site scripting vulnerability in WHR-G54S firmware 1.43 and earlier allows remote attackers to inject arbitrary script via a specially crafted page.
CVE-2020-5628
PUBLISHED: 2020-09-18
UNIQLO App for Android versions 7.3.3 and earlier allows remote attackers to lead a user to access an arbitrary website via the vulnerable App. As a result, if the access destination is a malicious website, the user may fall victim to the social engineering attack.
CVE-2020-5629
PUBLISHED: 2020-09-18
UNIQLO App for Android versions 7.3.3 and earlier allows remote attackers to lead a user to access an arbitrary website via a malicious App created by the third party. As a result, if the access destination is a malicious website, the user may fall victim to the social engineering attack.
CVE-2020-25756
PUBLISHED: 2020-09-18
** DISPUTED ** A buffer overflow vulnerability exists in the mg_get_http_header function in Cesanta Mongoose 6.18 due to a lack of bounds checking. A crafted HTTP header can exploit this bug. NOTE: a committer has stated "this will not happen in practice."