Skeggs says that instead of searching the entire disk for documents that may contain passwords, an attacker or malware strain can easily grab the WaitList.dat and search for passwords using simple PowerShell commands.Ĭyber attacks and malware are one of the biggest threats on the internet. For example, if an attacker has access to a system or has infected that system with malware, and he needs to collect passwords that have not been stored inside browser databases or password manager vaults, WaitList.dat provides an alternative method of recovering a large number of passwords in one quick swoop. Skeggs wrote a blog post about the WaitList.dat file back in 2016, but his discovery got little coverage, mostly because his initial analysis focused on the DFIR aspect and not on the privacy concerns that may arise from this file's existence on a computer.īut last month, Skeggs tweeted about an interesting scenario. The technique and the existence of this file have been one of the best-kept secrets in the world of DFIR and infosec experts.
Also: Securing Microsoft's Edge browser with Windows Defender Application Guard TechRepublic
0 kommentar(er)
