Comment by cyberax
1 day ago
This is for the _ActiveDirectory_. If your machine is joined into a domain, the keys will be stored in the AD.
This does not apply to standalone devices. MS doesn't have a magic way to reach into your laptop and pluck the keys.
> MS doesn't have a magic way to reach into your laptop and pluck the keys.
Of course they do! They can just create a Windows Update that does it. They have full administrative access to every single PC running Windows in this way.
People really pay too little attention to this attack avenue.
It's both extremely convenient and very unlikely to be detected; especially given that most current systems are associated to an account.
I'd be surprised if it's not widely used by law enforcement, when it's not possible to hack a device in more obvious ways.
Please check theupdateframework.io if you have a say in an update system.
Isn't it the same with many Linux distros?
Updates are using root to run?
3 replies →
I actually misremembered what theupdateframework.io is, I thought it provided more protections...
Furthermore it seems like it's specific to Azure AD, and I'm guessing it probably only has effect if you enable to option to back up the keys to AD in the first place, which is not mandatory
I'd be curious to see a conclusive piece of documentation about this, though
Regular AD also has this feature, you can store the encryption keys in the domain controller. I don't think it's turned on by default, but you can do that with a group policy update.