{"uuid": "c3f67c68-d378-432b-a0b3-d5529b89af42", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34466", "type": "seen", "source": "https://t.me/hacking_Attack/16599", "content": "Black Hat Ethical Hacking\nWindows Hello Bypass Fools Biometrics Safeguards in PCs\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Windows Hello Bypass Fools Biometrics Safeguards in PCsPost Views: 36 \nReading Time: 1 Minute\nA vulnerability in Microsoft\u2019s Windows 10 password-free authentication system has been uncovered that could allow an attacker to spoof an image of a person\u2019s face to trick the facial-recognition system and take control of a device.\nA Windows security bug would allow an attacker to fool a USB camera used in the biometric facial-recognition aspect of the system.\nWindows Hello is a feature\u00a0in Windows 10 that allows users to authenticate themselves without a password, using a PIN code or biometric identity\u2014either a fingerprint or facial recognition\u2014to access a device or machine. According to Microsoft, about 85 percent of Windows 10 users use the system.\n\nThe Windows Hello bypass vulnerability, tracked as CVE-2021-34466, requires an attacker to have physical access to a device to exploit it, according to researchers at CyberArk Labs who discovered the flaw in March.\n\nFrom there, they can go on \u201cto manipulate the authentication process by capturing or recreating a photo of the target\u2019s face and subsequently plugging in a custom-made USB device to inject the spoofed images to the authenticating host,\u201d Omer Tsarfati, cybersecurity researcher at CyberArk Labs, wrote in a report\u00a0about the vulnerability published Tuesday.\n\nFurther, exploitation of the bypass can extend beyond Windows Hello systems to \u201cany authentication system that allows a pluggable third-party USB camera to act as biometric sensor,\u201d Tsarfati noted.\nSee Also: Kaseya ransomware supply chain attack: What you need to know Researchers have no evidence that anyone has tried or used the attack in the wild, but someone with motive could potentially use it on a targeted espionage victim, such as \u201ca researcher, scientist, journalist, activist or privileged user with sensitive IP on their device, for example,\u201d according to the analysis.\n\nMicrosoft addressed the vulnerability \u2014 which affects both consumer and business versions of the feature \u2014 in its July Patch Tuesday update. Also, Windows users with Windows Hello Enhanced Sign-in Security \u2014 a new security feature\u00a0in Windows that requires specialized and pre-installed hardware, drivers and firmware \u2014 are protected against the any attacks \u201cwhich tamper with the biometrics pipeline,\u201d according to Microsoft.\n\nHowever, Tsarfati said that the solution may not fully mitigate the issue.\n\n\u201cBased on our preliminary testing of the mitigation, using Enhanced Sign-in Security with compatible hardware limits the attack surface but is dependent on users having specific cameras,\u201d he said. \u201cInherent to system design, implicit trust of input from peripheral devices remains. To mitigate this inherent trust issue more comprehensively, the host should validate the integrity of the biometric authentication device before trusting it.\u201d Biometric Weakest LinkCyberArk researchers posted a video of a proof-of-concept (PoC) for how to exploit the vulnerability, which can be used on both the consumer version, Windows Hello, and an enterprise version of the feature called Windows Hello for Business (WHfB) that businesses use with ActiveDirectory.\n\nThe bypass itself exploits a weakness in the biometric sensor of Windows Hello, which \u201ctransmits information on which the OS \u2026 makes its authentication decision,\u201d he wrote. \u201cTherefore, manipulating this information can lead to a potential bypass to the whole authentication system,\u201d Tsarfati said.\nSee Also: Offensive Security Tool: It Was All A Dream (Windows Print Spooler RCE) [...]", "creation_timestamp": "2026-09-01T20:02:33.555474Z"}