Hello and welcome to the Friday, July 17, 20206 edition of the Sands Inherst Storm Center's Stormcast.

My name is Johannes Ulrich, recorded today from Washington, D.C.

And this episode is brought you by the S sans.edu graduate certificate program in Purple Team

Operations. And thanks to listener Gephardt for pointing me to a study published by the German

Federal Information Security Office that did in detail dissect Windows Hello for business.

It's part of a larger effort of the office to better understand and document some of the

internals of Windows. In this particular study, they spent 169 pages looking at all the details and some of the potential security shortcomings of Windows Hello for Business.

They're focusing on the business part of it because, well, that's of course where people are more interested in all of these details.

Couple interesting findings here.

So first of all, the different security modes that you have available in Windows

Hello, the enhanced sign-in security or ESS is quite important as it turns out as

it ensures that some of the biometric data is actually protected by the

TPM and not just stored as an encrypted file on the file system. Also surprising to me is that

the biometric use of this feature actually does not give you additional entropy in how keys are being generated for Windows Hello compared to just a simple pin.

They do, however, point out that there are a number of advantages of doing biometrics over a pin.

One being that, well, a pin is easily lost without the user

knowing that it was lost. While in order to use the biometrics, the attacker would have to

steal the device, which is much easier to discover than a stolen pin. So that's, I think, some important lessons here.

They're also pointing out, I think that's not surprising to me,

that if you have multiple users on the device, that your risk increases.

And then in doing some of the reverse analysis,

they actually are uncovering some of the sort of not well documented features in Windows Hello and how they exactly work and how all of these different bits and pieces of this larger ecosystem are exactly fitting together.

...