Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud

11/18/2019
05:30 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
100%
0%

Windows Hello for Business Opens Door to New Attack Vectors

Researchers exploring Windows Hello for Business found an Active Directory backdoor and other attack vectors that could lead to privilege escalation.

Researchers investigating Microsoft's Windows Hello for Business have discovered new attack vectors, including a persistent Active Directory backdoor that they say current security tools don't detect.

Windows Hello for Business (WHfB) was introduced in Windows 10 and Windows Server 2016 to bring password-less authentication into Active Directory-based environments and lessen the risk of password theft. Users can authenticate to a Microsoft, Active Directory, or Azure Active Directory account with a credential that is tied to the device and uses a biometric or PIN. WHfB is built on top of common industry standards including Kerberos PKINIT, JWT, WS-Trust, or FIDO2, and it relies on cryptographic mechanisms like TPM key attestation or token binding.

Michael Grafnetter, IT security researcher and trainer for CQURE and GOPAS, was intrigued by WHfB and began to research the tool so he could better understand its internal workings. What he found was a lack of official documentation regarding how the feature works in Windows, making WHfB a "black box" for most administrators, security auditors, and pentesters, he says.

"This is something I was a little bit disappointed in," Gafnetter admits, noting there are other Windows security features lacking technical documentation: how Windows stores passwords, for one, or how passwords are encrypted. "This was always like smoke and mirrors," he adds.

To learn more about how WHfB operates, Grafnetter has spent the past year studying the feature and the past two months doing a deep dive. He will present his findings at the upcoming Black Hat Europe show in a briefing entitled "Exploiting Windows Hello for Business." His research yielded three different attack vectors against WHfB. One has already been fixed; another is currently under review. He hopes it will be complete by the time Black Hat rolls around.

Grafnetter warns of a vector in a security-critical AD attribute called msDS-KeyCredentialLink, which can store data related to Windows Hello, FIDO2, or BitLocker Drive Encryption. It holds references to devices that users register with Active Directory for authentication. If someone registers a notebook or YubiKey with WHfB, data is logged with msDS-KeyCredentialLink.

This is a relatively new attribute, Grafnetter says, and it can potentially be used or misused for persistence by an attacker. If someone gets hold of a domain, they can hide and maintain access to the same domain – even if all the passwords for the account are reset, he explains. Because it's new, the attribute and its values are rarely properly audited by security teams.

The problem is, few people understand this feature and don't know to look for issues, even though WHfB is part of AD in Windows Server 2016 and cannot be turned off. While he admits not many administrators or everyday users of these tools and features ask the same deep-dive questions a security researcher does, Grafnetter says he has spoken with Active Directory experts who don't know exactly how the technology works, "which really took me by surprise."

Even if companies don't actively use tools like Windows Hello for Business every day, they should audit these attributes and raise an alert if they notice any changes on admin accounts, he notes.

msDS-KeyCredentialLink lacks proper documentation of its behavior and security implications, Grafnetter explains. The AD Schema documentation only says "this attribute contains key material and usage information." While this is true, "I think that this is simply not enough and that its behavior and security implications deserve to be documented properly," he says. Knowing how this feature works can help discover when it's being maliciously used.

Microsoft is on the right track with WHfB, which Grafnetter says "really seems to be the future of authentication." Still, the threat of persistence is relevant to many Windows users, and it's clear as soon as they begin to audit the values to the msDS-KeyCredentialLink attribute. At Black Hat Europe in London, he plans to release a tool designed to scan corporate environments for these issues and provide needed visibility into Windows Hello for Business usage in Active Directory. Grafnetter developed the tool over the past year to aid him in his research, he notes.

In addition to his briefing on Windows Hello for Business, Grafnetter will be doing a live demonstration of DSInternals PowerShell Module at Black Hat Europe 2019.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
Commentary
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
Edge-DRsplash-11-edge-ask-the-experts
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
News
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-31618
PUBLISHED: 2021-06-15
Apache HTTP Server protocol handler for the HTTP/2 protocol checks received request headers against the size limitations as configured for the server and used for the HTTP/1 protocol as well. On violation of these restrictions and HTTP response is sent to the client with a status code indicating why...
CVE-2021-20027
PUBLISHED: 2021-06-14
A buffer overflow vulnerability in SonicOS allows a remote attacker to cause a Denial of Service (DoS) by sending a specially crafted request. This vulnerability affects SonicOS Gen5, Gen6, Gen7 platforms, and SonicOSv virtual firewalls.
CVE-2021-32684
PUBLISHED: 2021-06-14
magento-scripts contains scripts and configuration used by Create Magento App, a zero-configuration tool-chain which allows one to deploy Magento 2. In versions 1.5.1 and 1.5.2, after changing the function from synchronous to asynchronous there wasn't implemented handler in the start, stop, exec, an...
CVE-2021-34693
PUBLISHED: 2021-06-14
net/can/bcm.c in the Linux kernel through 5.12.10 allows local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized.
CVE-2021-27887
PUBLISHED: 2021-06-14
Cross-site Scripting (XSS) vulnerability in the main dashboard of Ellipse APM versions allows an authenticated user or integrated application to inject malicious data into the application that can then be executed in a victim’s browser. This issue affects: Hitachi ABB Power Grids ...