Today we are releasing a new white paper that delivers a technical analysis of
security weaknesses discovered in WinpMem, an open-source Windows memory
acquisition driver widely used in digital forensics.
After a concise primer on relevant Windows internals (virtual vs. physical
memory, page tables and PTEs, CR3 context switching, and kernel and user memory
separation), the report examines how both the fundamental design of WinpMem and
specific implementation choices create severe risk.
In the
last blog post,
we discussed the full authentication flow using Windows Hello for Business
(WHfB) with face recognition to authenticate against an Active Directory with
Kerberos and showcased existing and new vulnerabilities. In this blog post, we
dive into the architectural challenges WHfB faces and explore how we can exploit
them.
The majority of the work was conducted in the context of the “Windows Dissected”
project. This project, funded by the BSI (German: “Bundesamt für Sicherheit in
der Informationstechnik” – the German Federal Office for Information Security),
has the goal to perform ” various in-depth security analyses of
security-critical components and functions in Windows.” Over the next years we
will discuss these results here once they are published.
Windows Hello for Business is a key component of Microsoft’s passwordless
authentication strategy. It enables user authentication not only during system
sign-in but also in conjunction with new and advanced features such as Personal
Data Encryption, Administrator Protection, and Recall. Rather than depending on
traditional passwords, Windows Hello leverages a PIN or biometric methods – such
as fingerprint or facial recognition – to unlock cryptographic keys protected by
the Trusted Platform Module (TPM).
This article is about the massive BSOD triggered by CrowdStrike worldwide on July 19. Analysis and information from CrowdStrike or other sources are regularly published, completing what is expressed here. Updates may also be provided in the future.
Friday, July 19, is a day to be remembered in computing history as the day of one of the biggest BSODs (Blue Screens of Death). We have seen air traffic come to a standstill over the USA and people climbing ladders with USB sticks to update giant screens. The impact was still measurable over many days. The question on everyone’s lips is how that all happened. CrowdStrike provided, on a regular basis, an explanation for people to understand what happened. But explanations can be hard to understand, especially for one who would like to read directly within CrowdStrike’s internal wording in their publications and regarding technical driver implementation details. Also, the analysis misses some points we consider relevant for secure software development. This article discusses conclusions from this massive crash, especially the necessity to change our mindset about software. This means we should understand, document, and evaluate independently software provided by vendors to know exactly what we install on our systems and to figure out the risk that may be taken by using the software. The time of naive belief in software magic must end with a third party’s independent review of the software, analysing its reliability, security, and stability. This is an activity we have been doing at ERNW for years, especially for e.g. the German Federal Office for Information Security (BSI)1.
Two weeks ago, I was at the c0c0n conference in
Cochin (India). This conference is quite special for at least two
considerations. At first, this is – to the best of my knowledge – one of the few
conferences which officially brings together hackers, industrials, politics, and
security forces. This is not always obvious for all these different persons to
talk together, may be due to a lack of mutual understanding ?. But for a couple
of days, all of them meet, talk, exchange, and they share mutual needs and
appropriate solutions. And this may explain the second consideration, why c0c0n
is one of the oldest cyber security conferences in India (more than 15 years).
And yes, this is the conference where police forces directly pick you up from
the gates of your plane at airport, sitting you at the back of a police car to
drive you to your hotel with emergency lights ?