Tillmann Oßwald on Insinuator.net - Bold Statements

Windows Hello for Business – Full Report Has Been Released

Thu, 16 Jul 2026 00:00:00 +0000

Yesterday, the BSI (the German Federal Office for Information Security, or Bundesamt für Sicherheit in der Informationstechnik in German) published the first result document from the “Windows dissected” (ger.: “Windows seziert”) project: our analysis of Windows Hello for Business (WHfB). If you have followed this blog over the past year, you have seen the pieces. The full 170-page report has now been published. And it can be downloaded from the project page.

Windows Early Boot Configuration: The CmControlVector and PspSystemMitigationOptions

Mon, 13 Apr 2026 00:00:00 +0000

While investigating how process mitigation settings are initialized, I encountered the global variable PspSystemMitigationOptions. Tracing how this value is populated led me to the CmControlVector. In this blog post, we take a look at the Windows kernel land configuration manager, especially its global CmControlVector variable. Quick note: the kernel’s configuration manager is not related to Microsoft Intune’s Configuration Manager. In short, the configuration manager is responsible for managing and implementing the registry. However, it is also responsible for setting up parts of the system during early boot.

Windows Hello for Business - Faceplant: Planting Biometric Templates

Fri, 29 Aug 2025 00:00:00 +0000

We are back from Black Hat USA, where we presented our research on Windows Hello for Business (Slides) once more. In the last two blog posts, we have discussed the architecture of WHfB and past attacks, as well as how the database works and how to swap identities in the database.

First, a few words regarding my experience at Black Hat: for me, it was the first time attending the conference and then directly as a speaker. I thoroughly enjoyed Black Hat. It took a while to get used to the size of the conference and the vibe of Las Vegas. What was especially interesting for me was connecting with other researchers. One thing that stood out was meeting with the team from MSRC and putting faces to the team itself. It feels way more personal to know who you’re talking to when you know the people handling your cases. During TROOPERS I typically have the chance to connect with many researchers, mainly from Europe. At Black Hat US, on the other hand, it is possible to connect more with the US scene and meet people you haven’t seen in a long time! Seeing familiar faces again is always nice, as opposed to putting them into your biometric template database. One nice detail was that some international researchers are aware of the research BSI (German: “Bundesamt für Sicherheit in der Informationstechnik” – “German federal office for IT security”) is facilitating. The results of our presentation stem from the “Windows Dissected” project we are performing on behalf of the BSI.

Windows Hello for Business - The Face Swap

Tue, 15 Jul 2025 00:00:00 +0000

In the last blog post, we discussed the full authentication flow using Windows Hello for Business (WHfB) with face recognition to authenticate against an Active Directory with Kerberos and showcased existing and new vulnerabilities. In this blog post, we dive into the architectural challenges WHfB faces and explore how we can exploit them.

The majority of the work was conducted in the context of the “Windows Dissected” project. This project, funded by the BSI (German: “Bundesamt für Sicherheit in der Informationstechnik” – the German Federal Office for Information Security), has the goal to perform ” various in-depth security analyses of security-critical components and functions in Windows.” Over the next years we will discuss these results here once they are published.

Windows Hello for Business – Past and Present Attacks

Fri, 20 Jun 2025 00:00:00 +0000

Windows Hello for Business is a key component of Microsoft’s passwordless authentication strategy. It enables user authentication not only during system sign-in but also in conjunction with new and advanced features such as Personal Data Encryption, Administrator Protection, and Recall. Rather than depending on traditional passwords, Windows Hello leverages a PIN or biometric methods – such as fingerprint or facial recognition – to unlock cryptographic keys protected by the Trusted Platform Module (TPM).

Linux Character Devices: Exploring systemd-run and pkexec

Tue, 14 May 2024 00:00:00 +0000

In this blog post, we quickly look into issues involving character devices. As is typical for Linux, everything is a file, so character devices are referenced as files, such as pseudo terminals (pts) under /dev/pts/. man pty briefly introduces the topic. Essentially, it is used to connect a program, such as a terminal emulator, to a shell. In the end, a pty can read and write like a regular file. A colleague already brought up the topic of ptys and character devices. But more recently a Twitter post and the accompanying advisory piqued my interest.

BSI Publishes Windows 10 SiSyPHuS Reports: Application Compatibility Infrastructure, Microsoft Defender Antivirus ETW Usage and Device Setup Manager Service

Tue, 16 Apr 2024 00:00:00 +0000

The German Federal Office for Information Security (BSI – Bundesamt für Sicherheit in der Informationstechnik) has published several papers ERNW created as part of the long-term SiSyPHuS Win10-Project. This project focuses on system analysis of selected parts of the Windows 10 operating system performed by ERNW.

Analysis of the Application Compatibility Infrastructure (ACI): In this work we present an overview of the ACI technology along with a technical analysis of the compatibility protocol which is used first to determine if a compatibility solution needs to be applied, and second, to apply said compatibility solution. Furthermore, threats and mitigation in the context of the technology are presented a long with a monitoring approach. Finally, configuration and logging capabilities are discussed.

Root Cause Analysis of a Heap-Based Buffer Overflow in GNU Readline

Thu, 17 Dec 2020 00:00:00 +0000

In the last blog post, we discussed how fuzzers determine the uniqueness of a crash. In this blog post, we discuss how we can manually triage a crash and determine the root cause. As an example, we use a heap-based buffer overflow I found in GNU readline 8.1 rc2, which has been fixed in the newest release. We use GDB and rr for time-travel debugging to determine the root cause of the bug.

How Fuzzers Decide if a Crash is Unique

Thu, 03 Dec 2020 00:00:00 +0000

This blogpost sheds some light on how fuzzers handle crash deduplication and what a unique crash is for a fuzzer. For this, we take a look at two contrived examples and compare the unique crashes identified by AFL++ and honggfuzz.

Both examples are similar. They read from STDIN, check if the first character of the read data is a digit, then call a vulnerable function. The main difference in test1.c is that the program crashes directly in the vuln function due to a null pointer dereference. In test2.c, a previously allocated buffer is freed; this buffer is again freed at the end of main, resulting in libc identifying the double free and raising a sigabort.

Reversing C++ Without Getting a Heart Attack – DEvirtualize VIrtual Calls With Devi

Thu, 12 Nov 2020 00:00:00 +0000

TLDR: This blogpost presents devi, a tool that can help you devirtualize virtual calls in C++ binaries. It uses Frida to trace the execution of a binary and uncover the call sources and destinations of virtual calls. The collected information can then be viewed in IDA Pro, Binary Ninja, or Ghidra. The plugin adds the respective control-flow edges allowing further analysis (using different plugins) or simply providing more comfort when analyzing C++ binaries.

Vulnerabilities in GNU Readline Fixed

Wed, 07 Oct 2020 00:00:00 +0000

Recently I discovered some vulnerabilities in GNU Readline. These bugs have been fixed in GNU Readline version 8.1.

The case of identifying the vulnerabilities was rather interesting. I wanted to fuzz another program and wrote a quick harness to test if my setup works. This test harness used GNU Readline to read input from stdin and passed the data along to the function under test. I left the fuzzer running while I started to improve the harness (which would also mean getting rid of GNU Readline as it is relatively slow for the use-case at hand). However, AFL showed the first crashes and upon inspection, the vulnerabilities where not in the code I actually wanted to fuzz but in my systems GNU Readline.

Offensivecon 2019

Wed, 20 Feb 2019 00:00:00 +0000

Hi,

Last week I had the pleasure to attend Offensivecon 2019 in Berlin. The conference was organized very well, and I liked the familial atmosphere which allowed to meet lots of different people. Thanks to the organizers, speakers and everyone else involved for this conference! Andreas posted a one tweet tldr of the first day; fuzzing is still the way to go to find bugs, and mitigations make exploitation harder. Here are some short summaries of the talks I enjoyed.

Multiple Vulnerabilities in Nexus Repository Manager

Wed, 14 Nov 2018 00:00:00 +0000

Recently, we identified security issues in the Nexus Repository Manager software developed by Sonatype. The tested versions were OSS 3.12.1-01 and OSS 3.13.1-01.

The following issues could be identified:

Multiple Cross-Site Scripting (CVE-2018-16619)
Missing Access Controls (CVE-2018-16620)
Java Expression Language Injection (CVE-2018-16621)

The vulnerabilities are fixed in version 3.14.0. See the release notes and security advisories for further information.

We identified a Java Expression Language Injection in the role and user creation function. In order to exploit this issue, the attacker needs to be authenticated with high privileges, the standard anonymous user is not sufficient.

Multiple Vulnerabilities in UNIFY OpenScape Desk Phone CP600

Fri, 12 Oct 2018 00:00:00 +0000

We recently identified security issues in the UNIFY OpenScape Desk Phone CP600 HFA software. We disclosed the vulnerabilities to Unify, as a fix is now provided we want to give a brief overview of the vulnerability affecting the web interface.

We were able to identify the following vulnerabilities in the Web interface of the telephone:

Command Injection in Picture Delete function of OpenScape Desk Phone Webportal
Unauthenticated Arbitrary File Access in the OpenScape Desk Phone Webportal
Memory Corruption in the OpenScape Desk Phone Webservice
Missing Hardening of the OpenScape Desk Phone Webservice Binary
Cross Site Request Forgery Missing in the OpenScape Desk Phone Webservice