They broke Windows Hello

Microsoft touts its unbreakable authentication Windows Hello that uses biometrics or a PIN in Windows. However, Windows Hello does not come without flaws. In 2023, security researchers managed to bypass fingerprint authentication but also in 2007 with a photo in Windows Hello. A year earlier, a bug caused Windows Hello logins to stop working after systems were upgraded to the then-latest version of Windows, version 22H2.

Two security researchers presented another flaw in Windows Hello at the Black Hat conference in Las Vegas. Dr Baptiste David and Tillmann Osswald from ERNW Research showed how someone could break Windows Hello authentication.

See more articles from iGuRu.gr when you search for news on Google.

iGuRu.gr preferred source

The research team demonstrated how a hacker could enter biometric data into a Windows computer to unlock the system. They found a flaw in the CryptProtectData database, which secures authentication information. The flaw requires administrator access.

How to protect your system from attack

Researchers say that Windows users have two options to protect their devices from this particular attack.

Windows Hello Enhanced Sign-In Security (ESS): if ESS is enabled, hacking is not possible. It is enabled by default, provided that the computer meets all requirements (see TPM 2 and new CPUs).
PIN instead of biometrics: Switching to PINs instead of using biometrics is another option, according to the researchers.
Enhanced Login Security protects the face algorithm using VBS. This isolates it from the rest of Windows. System requirements include TPM 2.0, firmware with Secure Devices ACPI table, and biometric sensor drivers that support/are compatible with ESS.

Of course, not all systems support ESS. The researchers told The Register that they purchased Thinkpads less than two years ago and that they didn't support ESS because "they don't have a secure sensor for the camera because they use an AMD chip, not an Intel one."

The problem will be difficult to fix, according to the researchers. It would require a “code rewrite” or some other change, such as using TPM to store biometric data.

blackhat.com

newsbot

Although the press releases will range from very select to rare, I said I'd pass...because sometimes the editors hide.