Modern Identity Hacking: Have Hackers Really Adjusted to Constant Remote?
summary
Demoed exploits show MFA and modern auth failing in practice: a compromised endpoint with Meterpreter and a SOCKS proxy lets an attacker pivot over VPN (works even with certs/MFA) and scan internal services; Evilginx performs phishing + session token capture to bypass MFA; creating a self‑signed cert and writing it into Active Directory msDS-KeyCredentialLink yields Windows Hello for Business persistence, Kekeo requests TGTs/PTT and extracts NTLM hashes. Backing stats: 65% of IT can't manage personal devices, 44% see higher helpdesk load.
AI-written summary · about
chapters (9)
- 0:00Start
- 0:39International Workplace Group reports that
- 4:08Remate Work: Requirements
- 5:50Remote Work: Cybersecurity Concerns
- 7:22Remote work by the numbers
- 19:48Zero Trust Principles
- 22:14Evolution of security perimeters
- 34:25Windows Hello for Business - modern authN
- 36:03To-Do: Long Term Mitigations
related talks
48mHacking Exposed: Next-Generation Tactics, Techniques, and Procedures
47mBreaking the Next Factor – Live Multi-Factor Authentication (MFA) Hacking
49mThe Death of Conventional MFA: How AiTM Attacks Are Changing the Game
38mAnatomy of the Attack: The Rise and Fall of MFA
58mHacking in 2016 - How is our systems broken?
31mAdvanced Persistent Teenagers: Understanding the Lapsus$ Playbook
48mLateral Movement in the Age of Hybrid Cloud
45mApplying Past Lessons for Intel-Driven Identity Threat Detection