Windows 对企业来说绝对不行.pdf

1、#BHUSA BlackHatEventsWindows Hell No for BusinessWindows Hell No for BusinessDr Baptiste David Tillmann Owaldbdavidernw.de tosswaldernw.de“Windows Dissected”Funded by the German Federal Office for IT Security,carried out by ERNW“Various in-depth security analyses of security-critical components and

2、functions in Windows”Started in 2024,planned to end in spring 2026 Various work packages including Windows Hello for Business eXtended Control Flow Guard state of the art and limitations Code Integrity caching and known bypasses Group Policy Objects processing flow20252Who am I?Tillmann Osswald ERNW

3、 Enno Rey Netzwerke GmbH Security researcher and Windows System Analyst Since 2015 Make the world a safer place Master degree in IT security from the University of Applied Sciences Darmstadt.Reverse engineering Windows components.20253Who am I?Dr David Baptiste I am and I work in ERNW Enno Rey Netzw

4、erke GmbH Computer security service in Heidelberg,Germany“Make the World a Safer Place!”Did many conferences Black Hat USA,DefCon,EICAR,Recon,And also,one called TROOPERS I like good food and good wine 20254Windows Hello for BusinessAs a whole20255Say Hello to Windows Hello20256What is Windows Hello

5、 for Business?Windows Hello for Business is Microsofts passwordless flagship Windows Recall,Passkey,.Build on two key principals Identification -Windows Hello Authentication-for Business20257Windows Hello for Business Enrollment20258Windows Hello for Business Enrollment20258User ID KeyWindows Hello

6、for Business Enrollment20258Public KeyPrivate KeyUser ID KeyWindows Hello for Business Enrollment20258Azure AD Domain ServicesPublic KeyPrivate KeyUser ID KeyWindows Hello for Business Enrollment20258Azure AD Domain ServicesPublic KeyPrivate KeyUser ID KeyHas TPM?TPM storageSoftwareWindows Hello for