Resources

People often ask me "How did you learn how to hack?" The answer: by reading. This page is a collection of the blog posts and other articles that I have accumulated over the years of my journey. Enjoy!

Passkeys are supposed to be a phishing-resistant 2FA method. This post dives into some vulnerabilities in Windows passkey support that made it possible to bypass.

The first issue is that WebAuthn authentication responses were saved in the event logs. At least enough of it that it was possible to recover it (including the YubiKey signature!)

The second bug was an issue with the Entra provider that allowed the same challenge response to be reused. This takes the leaked data from Windows and makes it possible to replay it to log in. The information was only valid for 10 minutes but that's enough to compromise the session still. To fix the issue, Entra started using a counter that is part of the data already. This way, replay attacks are no longer possible.

On the PassKey dialog box on Windows, the author found that the asker of the Passkey process was completely controllable. You could say you were with Microsoft for instance. If the security is around the consent, then UI is super important to consider.

This chain was the worst of all the issues. However, they reported 3 bugs and 20 potential attack techniques, ranging from assertion replay to UI-related issues such as prompt flooding and UI spoofing.