The Windows Data Protection API (DPAPI)
summary
Concrete claims and demos: DPAPI encrypts secrets with per‑user and per‑machine master keys that live on disk, get cached in LSASS memory, and expire every three months; compromising a host or obtaining a domain controller private key lets attackers decrypt many users’ secrets. Examples use open‑source tooling (SharpDPAPI, Impacket) to extract master keys, derive symmetric keys, and recover browser cookies to hijack sessions. Key mitigations include master keys cached in LSASS, domain controller private key decrypts all users, Chrome device bound cookies coming soon.
AI-written summary · about
chapters (10)
- 0:00Windows DPAPI intro
- 2:11What is DPAPI
- 5:22DPAPI encryption keys
- 9:36DPAPI keys storage
- 15:39DPAPI for users and machines
- 18:49Attacking DPAPI
- 23:46Entropy in DPAPI
- 25:11Browsers and DPAPI cookies
- 28:05DPAPI attack scenario
- 28:50Future of cookie security
related talks
54mDPAPI and DPAPI-NG Decrypting All Users’ Secrets and PFX Passwords
52mDPAPI and DPAPI-NG: Decrypting All Users’ Secrets and PFX Passwords
47mCunning With CNG: Soliciting Secrets From Schannel
18mThe Latest in Windows Security for Developers
01h 02mCQTools: The New Ultimate Hacking Toolkit
48mData Loss Prevention and Azure Information Protection...
54mAdventures in the Underland: The CQForensic Toolkit as a Unique Weapon Against Hackers
01h 59mDeep Dive Workshop – Data Security and Data Protection