Windows Hello for Business Opens Door to New Attack Vectors

Researchers exploring Windows Hello for Business found an Active Directory backdoor and other attack vectors that could lead to privilege escalation.

Researchers investigating Microsofts Windows Hello for Business have discovered new attack vectors, including a persistent Active Directory backdoor that they say current security tools dont detect.
Windows Hello for Business (WHfB) was introduced in Windows 10 and Windows Server 2016 to bring password-less authentication into Active Directory-based environments and lessen the risk of password theft. Users can authenticate to a Microsoft, Active Directory, or Azure Active Directory account with a credential that is tied to the device and uses a biometric or PIN. WHfB is built on top of common industry standards including Kerberos PKINIT, JWT, WS-Trust, or FIDO2, and it relies on cryptographic mechanisms like TPM key attestation or token binding.
Michael Grafnetter, IT security researcher and trainer for CQURE and GOPAS, was intrigued by WHfB and began to research the tool so he could better understand its internal workings. What he found was a lack of official documentation regarding how the feature works in Windows, making WHfB a black box for most administrators, security auditors, and pentesters, he says.
This is something I was a little bit disappointed in, Gafnetter admits, noting there are other Windows security features lacking technical documentation: how Windows stores passwords, for one, or how passwords are encrypted. This was always like smoke and mirrors, he adds.
To learn more about how WHfB operates, Grafnetter has spent the past year studying the feature and the past two months doing a deep dive. He will present his findings at the upcoming Black Hat Europe show in a briefing entitled
Exploiting Windows Hello for Business
. His research yielded three different attack vectors against WHfB. One has already been fixed; another is currently under review. He hopes it will be complete by the time Black Hat rolls around.
Grafnetter warns of a vector in a security-critical AD attribute called msDS-KeyCredentialLink, which can store data related to Windows Hello, FIDO2, or BitLocker Drive Encryption. It holds references to devices that users register with Active Directory for authentication. If someone registers a notebook or YubiKey with WHfB, data is logged with msDS-KeyCredentialLink.
This is a relatively new attribute, Grafnetter says, and it can potentially be used or misused for persistence by an attacker. If someone gets hold of a domain, they can hide and maintain access to the same domain – even if all the passwords for the account are reset, he explains. Because its new, the attribute and its values are rarely properly audited by security teams.
The problem is, few people understand this feature and dont know to look for issues, even though WHfB is part of AD in Windows Server 2016 and cannot be turned off. While he admits not many administrators or everyday users of these tools and features ask the same deep-dive questions a security researcher does, Grafnetter says he has spoken with Active Directory experts who dont know exactly how the technology works, which really took me by surprise.
Even if companies dont actively use tools like Windows Hello for Business every day, they should audit these attributes and raise an alert if they notice any changes on admin accounts, he notes.
msDS-KeyCredentialLink lacks proper documentation of its behavior and security implications, Grafnetter explains. The AD Schema documentation only says this attribute contains key material and usage information. While this is true, I think that this is simply not enough and that its behavior and security implications deserve to be documented properly, he says. Knowing how this feature works can help discover when its being maliciously used.
Microsoft is on the right track with WHfB, which Grafnetter says really seems to be the future of authentication. Still, the threat of persistence is relevant to many Windows users, and its clear as soon as they begin to audit the values to the msDS-KeyCredentialLink attribute. At Black Hat Europe in London, he plans to release a tool designed to scan corporate environments for these issues and provide needed visibility into Windows Hello for Business usage in Active Directory. Grafnetter developed the tool over the past year to aid him in his research, he notes.
In addition to his briefing on Windows Hello for Business, Grafnetter will be doing a live
demonstration
of DSInternals PowerShell Module at Black Hat Europe 2019.
Related Content:
10 Tips for Building Compliance by Design into Cloud Architecture
12 Tips for Dealing with a Manipulative Security Manager
Attackers Costs Increasing as Businesses Focus on Security
DevSecOps: The Answer to the Cloud Security Skills Gap

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Windows Hello for Business Opens Door to New Attack Vectors