Windows Hello for Business Opens Door to New Attack Vectors

Researchers investigating Microsoft's Windows Hello for Business have discovered new attack vectors, including a persistent Active Directory backdoor that they say current security tools don't detect.

Windows Hello for Business (WHfB) was introduced in Windows 10 and Windows Server 2016 to bring password-less authentication into Active Directory-based environments and lessen the risk of password theft. Users can authenticate to a Microsoft, Active Directory, or Azure Active Directory account with a credential that is tied to the device and uses a biometric or PIN. WHfB is built on top of common industry standards including Kerberos PKINIT, JWT, WS-Trust, or FIDO2, and it relies on cryptographic mechanisms like TPM key attestation or token binding.

Michael Grafnetter, IT security researcher and trainer for CQURE and GOPAS, was intrigued by WHfB and began to research the tool so he could better understand its internal workings. What he found was a lack of official documentation regarding how the feature works in Windows, making WHfB a "black box" for most administrators, security auditors, and pentesters, he says.

"This is something I was a little bit disappointed in," Gafnetter admits, noting there are other Windows security features lacking technical documentation: how Windows stores passwords, for one, or how passwords are encrypted. "This was always like smoke and mirrors," he adds.

To learn more about how WHfB operates, Grafnetter has spent the past year studying the feature and the past two months doing a deep dive. He will present his findings at the upcoming Black Hat Europe show in a briefing entitled "Exploiting Windows Hello for Business." His research yielded three different attack vectors against WHfB. One has already been fixed; another is currently under review. He hopes it will be complete by the time Black Hat rolls around.

Grafnetter warns of a vector in a security-critical AD attribute called msDS-KeyCredentialLink, which can store data related to Windows Hello, FIDO2, or BitLocker Drive Encryption. It holds references to devices that users register with Active Directory for authentication. If someone registers a notebook or YubiKey with WHfB, data is logged with msDS-KeyCredentialLink.

This is a relatively new attribute, Grafnetter says, and it can potentially be used or misused for persistence by an attacker. If someone gets hold of a domain, they can hide and maintain access to the same domain – even if all the passwords for the account are reset, he explains. Because it's new, the attribute and its values are rarely properly audited by security teams.

The problem is, few people understand this feature and don't know to look for issues, even though WHfB is part of AD in Windows Server 2016 and cannot be turned off. While he admits not many administrators or everyday users of these tools and features ask the same deep-dive questions a security researcher does, Grafnetter says he has spoken with Active Directory experts who don't know exactly how the technology works, "which really took me by surprise."

Even if companies don't actively use tools like Windows Hello for Business every day, they should audit these attributes and raise an alert if they notice any changes on admin accounts, he notes.

msDS-KeyCredentialLink lacks proper documentation of its behavior and security implications, Grafnetter explains. The AD Schema documentation only says "this attribute contains key material and usage information." While this is true, "I think that this is simply not enough and that its behavior and security implications deserve to be documented properly," he says. Knowing how this feature works can help discover when it's being maliciously used.

Microsoft is on the right track with WHfB, which Grafnetter says "really seems to be the future of authentication." Still, the threat of persistence is relevant to many Windows users, and it's clear as soon as they begin to audit the values to the msDS-KeyCredentialLink attribute. At Black Hat Europe in London, he plans to release a tool designed to scan corporate environments for these issues and provide needed visibility into Windows Hello for Business usage in Active Directory. Grafnetter developed the tool over the past year to aid him in his research, he notes.

In addition to his briefing on Windows Hello for Business, Grafnetter will be doing a live demonstration of DSInternals PowerShell Module at Black Hat Europe 2019.

Related Content: