RedTeamPT
Joined 6 years ago
Karma
138
Submissions
36
Member since
Nov 2
Recent submissions
Comment · 2 years ago
No, but hardware keylogger require physical access.
Comment · 2 years ago
Actually it is not just an issue with AD design, but the AD design only makes it slightly worse. The underlying issue is that biometrics are not required to retrieve the biometric key from DPAPI and instead of authenticating with Windows Hello, any program could just simply ask DPAPI for the key.
Comment · 2 years ago
Yes, it requires an attacker in a powerful position with local access. However, it does not require special privileges or techniques that may trigger endpoint security (such as keyloggers or memory dumping). The only requirements are reading a JSON file and making a single Windows API call to retrieve the key.
Comment · 2 years ago
Yes, it requires an attacker in a powerful position but it does not require physical access. Any program that runs in the user's session (without any special privileges) could have autonomously retrieved the biometric key and decrypted the vault without user interaction and without Bitwarden running.
Comment · 2 years ago
Not that we are aware of. The security model of Android and iOS also makes it much easier to implement biometric unlock correctly.
Comment · 3 years ago
RedTeam Pentesting GmbH | Penetration Tester | Aachen, Germany | ONSITE | Full-time
Founded in 2004 RedTeam Pentesting helps numerous national and international companies in performing penetration tests for a wide variety of products, networks, websites and applications. By focusing solely on penetration tests RedTeam Pentesting is able to provide high technical skill and impartial advise to our customers. We only conduct hands-on penetration tests, no vulnerability scanners involved.
What we're looking for:
- Analytical thinking and motivation to learn new things
- Experience in offensive IT-security (i.e. Pentests, CTFs, exploit development)
- Knowledge of common networking protocols and topologies
- Ability to work with Linux and Windows
- Scripting/programming skills
- Very good German and good English
- Willingness to relocate to Aachen
- Ideally university degree or comparable education
- Pass a criminal record check
Our website: https://jobs.redteam-pentesting.de
Interested in IT-Security? Join us! https://jobs.redteam-pentesting.de/
Imprint: https://www.redteam-pentesting.de/en/imprint/-imprint