How We Added Web Authn to a Browser-Based RDP Client
Summary: Palo Alto Networks' Unit 42 built WebAuthn redirection into a browser-based RDP client, the first implementation outside Windows, after finding that no browser API can pass a pre-computed clientDataHash to an authenticator and that the MS-RDPEWA spec was missing commands and field definitions. The team reverse-engineered mstsc.exe with IDA Pro and Frida to learn that Windows' webauthn.dll routes hash-only requests through an undocumented private plugin path, since older Windows servers (Windows 10, Server 2019/2022, Windows 11 through 24H2) send only the 32-byte hash while newer v9 servers also send clientDataJSON.
Why it matters: Microsoft's own macOS, iOS, Android and Linux RDP clients still do not support WebAuthn redirection, so most enterprise environments running older Windows servers depend on undocumented behavior that only Microsoft's Windows client implements.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026