Four-Byte Write and Timing Bug Let Researchers Run Code in Windows SmartScreen Enclave
-
Researchers have demonstrated code execution inside a VBS enclave on Windows, a protected memory region designed to remain isolated even if the rest of the system is compromised.
The enclave they targeted belongs to a Windows anti-phishing feature and is responsible for handling passwords. The research was conducted in a lab environment as a proof of concept, and the technique relied on two separate issues: a four-byte write primitive and a timing bug. Together, these flaws allowed the team to run their own code inside the sealed enclave.
Key points:
- Target: a VBS enclave tied to a Windows anti-phishing component that manages credentials
- Technique: a four-byte write combined with a timing bug
- Result: attacker-controlled code execution within the enclave
- Context: lab-based proof of concept, not a confirmed in-the-wild attack
Source: The Hacker News
Does your organization rely on VBS enclaves for credential or secret protection, and are you reviewing your threat model in light of this research?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login