Skip to main content

New answers tagged

7 votes

Does CrowdStrike Falcon get validated by the Windows kernel as being crash-free?

CrowdStrike Falcon uses a Windows kernel-mode driver, and unlike the automated validation of eBPF programs on Linux, Windows kernel-mode drivers do not undergo the same type of in-depth validation to ...
security_paranoid's user avatar
2 votes
Accepted

How safe are my app's keys inside the TPM against other apps trying to impersonate mine?

TPM keys can be protected either with a shared secret (like a password known to both the application and the TPM) or through an arbitrarily complex Enhanced Authorization policy. In practice, however, ...
Ja1024's user avatar
  • 12.5k
1 vote

How safe are my app's keys inside the TPM against other apps trying to impersonate mine?

Using a TPM to store application keys can definitely enhance security, but you have to be really careful. What I mean is: if your system isn’t set up ‘right’, the TPM method can be catastrophic for ...
security_paranoid's user avatar
7 votes

Use of TPM to encrypt data of my application in practice

There are two different ways of using a TPM chip to encrypt application data. Both have different security properties. First, a TPM chip can be used as a cheap, low-end hardware security module (HSM). ...
Ja1024's user avatar
  • 12.5k
2 votes

Use of TPM to encrypt data of my application in practice

TPMs are good for system security by providing a hardware-based approach to secure cryptographic operations, such as generating, storing, and managing cryptographic keys. I have recently written an ...
security_paranoid's user avatar
2 votes

How can Bitlocker do this?

The most likely state is that, in order to actually enable the new TPM, you'll need to supply the existing PIN and Keyfile. Otherwise, when you "resume protection" (erase the "key ...
CBHacking's user avatar
  • 49.7k
2 votes

What is the correct way to remove bitlocker secrets from a TPM when returning a device for warranty?

"Booting to other OS" = Creating a failure to secure boot. Yes, this works. You can also just go to UEFI setup and disable secure boot (enable compatibility mode or whatever its called) and ...
mmja's user avatar
  • 93
1 vote

What can prevent Mimikatz from accessing LSA?

One thing that can cause this (being unable to access LSASS regardless of privilege level) is Windows' "Memory Integrity", also known as "Hypervisor-Protected Code Integrity" or ...
CBHacking's user avatar
  • 49.7k

Top 50 recent answers are included