Analysis of the Attack Surface of Windows 10 Virtualization-Based Security
summary
Breaks down Windows 10 virtualization based security (VBS) internals, shows two live exploits (one bypassing a VBS feature, one critical firmware compromise), and measures attack surface: credential guard stores encrypted blobs that an attacker on the same machine can reuse for single‑sign‑on, SMM vulnerabilities let firmware run code that subverts the hypervisor and read protected memory, and transient writable+executable physical pages and missing TPM/VTD/secure boot guarantees enable practical attacks and runtime hypervisor hooking.
AI-written summary · about
chapters (14)
- 0:00Intro
- 1:45VBS architecture
- 3:44Credential Guard architecture
- 5:28CG RPC interface
- 12:59CG scenario 2
- 16:00VBS-enforced code integrity
- 21:08Kernel HVCI bypass, MS16-066
- 23:33Necessary support
- 24:43Root partition privileges
- 27:44Problem 1-unfiltered MMCFG • MMCFG is a region of physical address space, access
- 30:13Overlap VTd bars
- 33:40S4 sleep
- 39:09SMM abuse example
- 45:42Questions?
related talks
50mExploiting the Hyper-V IDE Emulator to Escape the Virtual Machine
38mClose Encounters of the Advanced Persistent Kind: Leveraging Rootkits for Post-Exploitation
55mLessons Learned from Eight Years of Breaking Hypervisors
18mThe Latest in Windows Security for Developers
56mA Retrospective Case Study of VMware Guest-to-Host Escape Vulnerabilities
50mAutomated Discovery Of Logical Priv. Esc. Bugs In Win10
43mDefeating Windows Anti-Exploit & Security Features with WHQL Kernel Drivers
56mWindows Kernel Graphics Driver Attack Surface