Phishing Windows Hello for Business - Exploiting Authentication Vulnerabilities

Discover a critical security vulnerability in Windows Hello for Business (WHfB) through this Black Hat conference presentation that exposes how attackers can bypass its phishing-resistant authentication mechanism. Learn about the technical process of intercepting and modifying POST requests to Microsoft's authentication services, including the manipulation of parameters like User-Agent and isFidoSupported to force authentication downgrades. Explore the modified EvilGinx framework that automates and scales this attack vector, while understanding crucial mitigation strategies focused on conditional access policies and authentication strength enforcement. Gain valuable insights into WHfB's security architecture and the importance of implementing enhanced security measures to protect against such authentication downgrades.