[dayglored]

> If they already own your DC you're screwed anyway.

I think the point is that no vulnerability should be "excused away". Flaws -- regardless of where and what they are -- should get identified, analyzed, and fixed.

I'm sure you're not actually saying that there's no value to fixing the vuln, right?

[tacticalogic]

I think the point is that no vulnerability should be "excused away". Flaws -- regardless of where and what they are -- should get identified, analyzed, and fixed. >

What would you say to someone who breathlessly announced they had found a fundamental flaw in the Linux OS that gave you complete control of the machine, but only if you're logged in as Root?

[tacticalogic]

I'm sure you're not actually saying that there's no value to fixing the vuln, right?

The "fix" is to install Credential Guard.

Windows stores passwords for service accounts and interactive logins in memory. Programs like MimiKatz running under local admin authority can read them. The "vulnerability" this researcher claims to have found has been known about and discussed by Microsoft and various people in the security community for quite some time.

[SunTzuWu]

Agreed.