A newly revealed technique demonstrates how malware in a compromised Windows user session can exploit the Windows Hello for Business (WHFB) system's cryptographic keys, allowing attackers to gain cloud access without requiring the victim’s password, PIN, or biometrics This article explores key windows cryptographic. . It typically stores the user’s private key within their Trusted Platform Module (TPM), making it difficult to export or steal.
However, researcher Dirk-Jan Mollema discovered that an existing process running during an active session can access this key through Windows cryptographic interfaces without prompting for a new PIN or biometric check. Instead, malware with access to an unlocked user session could prompt Windows to carry out cryptographic signing operations using the protected key.
Windows Hello Key Abuse Targets Azure Active Directory PRTs are crucial Microsoft Entra ID components that facilitate single sign-on across various services and applications, offering long-lasting access. However, recent research reveals an alternative method: treating the Windows Hello for Business key as a FIDO2 passkey through WebAuthn authentication. This typically occurs during legitimate private browsing sessions or without single sign-on support, though it's less common in enterprise environments.
Organizations must also scrutinize unexplained device registrations, newly implemented authentication methods, suspicious token activity, and unusual sign-ins following an endpoint compromise. Enhance your Security Operations Center (SOC) by integrating ANY.RUN with it now for accelerated threat detection and swift investigations.
