A recent finding by researcher Dirk-jan Mollema has unveiled a potential security flaw in Windows systems, where malware, once active in a signed-in session, can exploit Windows Hello for Business keys to gain access to Microsoft Entra ID. This vulnerability allows attackers to achieve persistent access without needing administrator privileges, highlighting a significant concern in endpoint security.
Understanding the Exploit
The vulnerability, demonstrated by Mollema, involves malware using the victim’s Windows Hello for Business key to authenticate with Microsoft Entra ID. This method does not require extracting private keys, recovering PINs, or triggering biometric prompts. Instead, the system’s ticketing behavior maintains private-key operations accessible during interactive sessions.
This approach allows malicious code to request Windows to sign authentication data, effectively enabling unauthorized access. The attack requires the malware to execute within an active session, leveraging how Windows Hello for Business operates. Importantly, no current reports of active exploitation or specific victim cases have been documented.
Implications for Cloud Access and Device Registration
By exploiting this vulnerability, attackers can secure prolonged cloud access, register new devices under their control, and even obtain a Primary Refresh Token (PRT). This token can be continuously renewed, granting ongoing cloud service access for up to 90 days, provided the user remains active.
Mollema further demonstrated that the technique bypasses prior requirements by treating Windows Hello for Business keys as FIDO2 passkeys through WebAuthn. This new method allows an attacker to generate the necessary signed assertions on a compromised endpoint, facilitating unauthorized access to Microsoft cloud services.
Security Measures and Recommendations
To mitigate this potential threat, Mollema advises monitoring for unexpected device registrations and scrutinizing Windows Hello for Business sign-ins that lack a device ID. Such patterns could indicate unauthorized access attempts. Despite the absence of a CVE or official advisory from Microsoft, staying vigilant and employing robust security policies is crucial.
Microsoft’s documentation acknowledges the ticketing behavior, but the lack of immediate corrective action underscores the need for organizations to implement supplementary security measures. Detection of suspicious activity and adherence to strict Conditional Access policies can serve as effective deterrents against such exploits.
The research, including PowerShell proof-of-concept scripts, is available for cybersecurity professionals aiming to understand and counteract this vulnerability. It is essential to address these concerns promptly to safeguard against potential exploits and ensure robust protection of sensitive data.
