Re:DPAPI security flaw in Windows 10
by a-dub on Tuesday June 18, 2019 @03:23AM
(#20210415)
so basically, if you have "root", you can get at another user's secret store through some esoteric weird means under some weird windows post update auto reboot auto logon whatever... which means absolutely nothing because if you have "root" you can do a billion other things to get at the same secret store anyway... i don't see the point of this.
[ Parent
| on HN ]
This is for when an attacker has physical access,
as in they can just pull the information from the drive (by mounting the drive to another OS, i.e. from USB), without any restriction from the Windows OS
Absolutely a few years ago I was asked to break into some systems (nt) for one of the UK's cinema chains - this was with express permission and the OK from very senior management on our side I should say.
As I had physical access I could boot off floppy and extract the secrets and break them using brute force - I use our art directors then top of the line mac pro.
So I never did get to set up my own cracking farm using the dozen or so suns we had not sure the secret Squirrels would have liked the competition.