DSInternalsVideos
-
Passkeys Are Phishing-Resistant. Until Malware Skips the Browser
I joined Merill Fernando on Entra.Chat to discuss some of my findings on Passkey security:
The conversation covers several themes from my recent Black Hat USA 26 talk about Pass-the-Passkey attacks, including how real-world Passkey implementations can fail when attackers bypass the browser and target the surrounding authentication flow.
-
KDS Root Keys: All Secrets Finally Revealed
Recording of my TROOPERS26 talk, KDS Root Keys: All Secrets Finally Revealed:
The talk dives into online and offline attacks against virtually every use case of KDS Root Keys, including:- Decryption of volumes with BitLocker SID Protector enabled.
- Exporting RSA private keys from group-protected PFX files.
- Extracting DNSSEC signing keys (ZSK and KSK) from Active Directory.
- Recovering ASP.NET Core database connection strings.
- Bulk export of Windows LAPS and DSRM passwords.
- Generation of gMSA and dMSA passwords offline.
The talk also covers a newly discovered universal attack against DPAPI-NG SID protectors, allowing any application-encrypted secret to be unlocked without application-specific decryptors.
-
Okta For Good and Bad – Hybrid Attack Paths Crossing Okta Organizations
Recording of my SO-CON 2026 talk, co-presented with Lance Cain:
Security specialists and end users appreciate the convenience of single sign-on (SSO) technologies like Okta. Unfortunately, attackers do too. We will explore how compromised human or machine identities can lead to hybrid attack paths that begin in Active Directory, move through Okta, and reach critical assets such as Git repositories, CI/CD pipelines, cloud storage, or enterprise password managers. We will also demonstrate how adversaries can deliver payloads to macOS devices by leveraging Okta and third-party MDMs.
-
A Look Inside a Pass-the-PRT Attack
Like an NT hash (AKA NTLM hash AKA MD4 hash) and a Kerberos ticket, a Primary Refresh Token (PRT) can be passed in an attack. Mimikatz author Benjamin Delpy and Dirk-jan Mollema have both released detailed research and code showing how attackers could Pass-the-PRT to perform the lateral movement to the cloud.
I have recorded a short demo of the Pass-the-PRT Attack:
-
Exploiting Windows Hello for Business
Here is the recording of my Black Hat Europe 2019 Briefings session about Exploiting Windows Hello for Business:
-
Offline Attacks on Active Directory