Pass-the-Passkey: What Michael Grafnetter's Black Hat Research Means for Entra Admins
Summary
Meryl interviews Michael Grafnetter, a Principal Security Researcher at SpecOps, about his Black Hat research on "Pass the Pass Key" vulnerabilities. Grafnetter demonstrates how attackers can exploit Windows event logs to replay digital signatures and bypass phishing resistance by using malware to trigger passkey prompts. He also highlights risks associated with synced passkeys and browser hooking, emphasizing that while passkeys are superior to passwords, device hygiene and privileged access workstations remain critical for security.
Topics discussed
Intro and Michael Grafnetter's background in AD research
Passkey history: From Windows Hello to FIDO2 standards
Vulnerability: Digital signatures logged in Windows Event Logs
Demo: Replay attack and malware-initiated phishing
Defender strategies: PAWs and mitigating device compromise
Risks of synced passkeys and password manager exports
Browser hooking attacks and RDP passkey redirection risks
Conclusion: Passkeys remain superior to passwords
Listen ad-free on Castria