German cybersecurity researchers have uncovered a critical flaw in Microsoft’s Windows Hello for Business system that could allow attackers with local administrator privileges to bypass biometric authentication protections. The vulnerability, dubbed “Windows Hell No,” was presented by Dr. Baptiste David and Tillmann Oßwald of ERNW Research at the Black Hat USA 2025 conference in Las Vegas.
The researchers demonstrated how an attacker with administrative access could tamper with Windows Hello’s biometric database to inject fraudulent facial scans or fingerprint templates. This allows unauthorized logins to enterprise networks, including those secured with Microsoft’s Entra ID (formerly Azure Active Directory) or traditional on-premises Active Directory deployments.
Biometric Database Lacks Entropy Protection
The flaw exploits a lack of external entropy in the biometric data protection process. According to the researchers, Microsoft’s data encryption – believed to use the Windows Data Protection API (DPAPI) – can be bypassed by a local administrator, who can then decrypt and overwrite the biometric templates stored on the device. These overwritten templates can be used to impersonate legitimate users across enterprise identity systems.
This vulnerability builds on earlier concerns raised by CVE-2025-26644, a spoofing flaw disclosed in April, that also targeted weaknesses in biometric template storage. In response to that incident, Microsoft updated Windows Hello in April to require both an infrared (IR) and visible-light color image for facial recognition, effectively disabling face unlock in dark environments. The patch aimed to raise the bar for spoofing attacks using static images or infrared-only face models.
Limited Hardware Support for Mitigation
To mitigate attacks like “Windows Hell No,” Microsoft has recommended adopting Enhanced Sign-in Security (ESS), which runs biometric verification in a virtual secure mode managed by the hypervisor. However, the researchers noted that ESS adoption is limited due to hardware requirements. For instance, some recent devices such as the Lenovo ThinkPad X1 Fold have been found to lack ESS-compatible camera support, despite being marketed for business use.
Security experts urge organizations to take immediate steps to reduce their exposure. These include restricting local administrator access, auditing devices for ESS compatibility, enabling multi-factor authentication, and watching for further guidance from Microsoft. By hardening endpoint security and reducing the attack surface, enterprises can limit the risk posed by compromised biometric templates.
Sources: Thinkst Thoughts, Lenovo Support, The Verge
–
By Ali Nassar-Smith
