Hello and welcome to the Friday, December 13th, 2024 edition of the Sansonet Stormsanders Stormcast. My name is Johannes Ulrich and I'm recording from Washington, D.C.

First, start with a little bit sort of a cleanup item after Patch Tuesday and that's, well, the Windows 10 end of life and what that means

for Windows 11 and how to upgrade systems. There's one issue where Microsoft has gone a little bit

forth and back on what hardware is exactly required in order to run Windows 11, and that forth and back on what hardware is exactly required in order to run Windows 11.

And that forth and back led to some problems where people were able to upgrade to Windows 11 when that hardware was considered sufficient.

But later, as the hardware was no longer considered sufficient, some patches may actually

not apply. Hardware item here that causing a lot of confusion is TPM version 2.0. Microsoft

and Windows 11 originally came out, sort of double down on its use of TPM version 2.0, the trusted computing

module in order to support a lot of the advanced cryptographic security features that

Windows 11 offers. Later, they did allow installing Windows 11 on some systems without TPM 2.0, but that has now been reversed.

You need TPM 2.0 in order to run Windows 11, so patches only install on systems with TPM 2.0.

I'll link to an article by Forbes that explains something at Fort and

back and also two posts by Microsoft that does explain its latest stance on TPM 2.0.

And the Oasis security research team found an interesting vulnerability in Microsoft Azure's

multi-factor authentication implementation that I think is not unique to Microsoft.

Actually, I remember a few years back, Facebook having a similar issue.

The problem is that just like for normal passwords, you do need some kind of rate limit and

lockout in order to restrict how many attempts an attacker can use in order to prove

force the multifactor authentication password.

In this case, the usual time-based six-digit key.

Not only did Microsoft not establish rate limit, so it was possible to essentially try as

often as you want until you manage to prude-force the second factor, but they also were

...