Researcher Dirk-jan Mollema has uncovered a critical security vulnerability that allows malware to exploit Windows Hello for Business keys, providing unauthorized access to Microsoft Entra ID. This issue permits malware running within a signed-in Windows session to quietly authenticate and gain extended cloud access. It can also register a device under the attacker's control, obtain a Primary Refresh Token (PRT), and add new authentication methods if tenant policies allow. Notably, this technique does not require administrator privileges or the extraction of private keys, PINs, or biometric data, making it particularly stealthy.
The vulnerability hinges on the way Windows Hello for Business operates. Once an attacker executes code within a victim's session, they can exploit Windows ticketing behavior, which allows code to sign authentication data without administrative access. Although there are no reports of active exploitation or identified victims, Mollema advises monitoring for unexpected device registrations as a precautionary measure.
The specific Windows versions or deployment models affected by this vulnerability remain unspecified. The absence of a CVE or advisory from Microsoft underscores the need for vigilance in monitoring this potential threat. The method, initially showcased at DEF CON 32, removes previous constraints by using the Windows Hello for Business key as a FIDO2 passkey through WebAuthn. The five-minute Entra ID challenge bypasses session, user, or tenant restrictions, allowing attackers to leverage a compromised endpoint to produce a signed assertion remotely.
ROADtools, a framework for Entra ID interaction, can use these assertions to request tokens or initiate browser sessions as the victim. Because the token lacks a device ID claim, attackers can register new devices and request PRTs, maintaining access to Microsoft cloud services. Mollema's findings reveal that WebAuthn sign-ins can meet Conditional Access policy requirements, potentially allowing attackers to add passkeys or Windows Hello for Business keys to new devices where policies permit. To mitigate this risk, organizations should focus on detecting unusual Windows Hello for Business sign-ins with missing device IDs.