The enclave they targeted belongs to a Windows anti-phishing feature and is responsible for handling passwords. The research was conducted in a lab environment as a proof of concept, and the technique relied on two separate issues: a four-byte write primitive and a timing bug. Together, these flaws allowed the team to run their own code inside the sealed enclave.

Key points:

• Target: a VBS enclave tied to a Windows anti-phishing component that manages credentials
• Technique: a four-byte write combined with a timing bug
• Result: attacker-controlled code execution within the enclave
• Context: lab-based proof of concept, not a confirmed in-the-wild attack

Source: The Hacker News

Does your organization rely on VBS enclaves for credential or secret protection, and are you reviewing your threat model in light of this research?