Attacking Windows Hello for Business: Is It What We Were Promised?

Haddad, Joseph; Pitropakis, Nikolaos; Chrysoulas, Christos; Lemoudden, Mouad; Buchanan, William J.

Abstract

Traditional password authentication methods have raised many issues in the past, including insecure practices, so it comes as no surprise that the evolution of authentication should arrive in the form of password-less solutions. This research aims to explore the problems that password authentication and password policies present and aims to deploy Windows Hello for Business (WHFB) on-premises. This includes creating three virtual machines (VMs) and evaluating WHFB as a password-less solution and showing how an attacker with privileged access may retrieve the end user’s domain password from the computer’s memory using Mimikatz and describing the possible results. The conducted research tests are in the form of two attack methods. This was feasible by the creation of three VMs operating in the following way. The first VM will act as a domain controller (DC) and certificate authority server (CA server). The second VM will act as an Active Directory Federation Service (ADFS). The third VM will act as the end-user device. The test findings research summarized that password-less authentication is far more secure than the traditional authentication method; this is evidenced throughout the author’s tests. Within the first test, it was possible to retrieve the password from an enrolled device for WHFB while it was still in the second phase of the deployment. The second test was a brute-force attack on the PIN of WHFB; since WHFB has measures to prevent such attacks, the attack was unsuccessful. However, even though the retrieval of the password was successful, there are several obstacles to achieving this outcome. It was concluded that many organizations still use password authentication as their primary authentication method for accessing devices and applications. Larger organizations such as Microsoft and Google support the adoption of password-less authentication for end-users, and the current usage of password-less authentication shared by both organizations is encouraged. This usually leads organizations to adopt this new solution for their IT infrastructure. This is because it has been used and tested by millions of people and has proven to be safe. This supports the findings of increased usage and the need for password-less authentication by today’s users.

Citation

Haddad, J., Pitropakis, N., Chrysoulas, C., Lemoudden, M., & Buchanan, W. J. (2023). Attacking Windows Hello for Business: Is It What We Were Promised?. Cryptography, 7(1), Article 9. https://doi.org/10.3390/cryptography7010009

• Journal Article Type: Article
• Acceptance Date: Feb 10, 2023
• Online Publication Date: Feb 14, 2023
• Publication Date: 2023
• Deposit Date: Feb 20, 2023
• Publicly Available Date: Feb 20, 2023
• Journal: Cryptography
• Print ISSN: 2410-387X
• Publisher: MDPI
• Peer Reviewed: Peer Reviewed
• Volume: 7
• Issue: 1
• Article Number: 9
• DOI: https://doi.org/10.3390/cryptography7010009
• Keywords: authentication, password-less authentication, windows hello, passwords, PIN