Over the Edge: Silently Owning Windows 10's Secure Browser
summary
Windows 10’s default-on memory deduplication yields a measurable write slowdown that is turned into a one-bit local side channel to recover 64-bit ASLR pointers; an alignment primitive leaks JIT code addresses and a novel birthday attack reduces heap-pointer search from impractical terabytes to feasible memory by pairing many guesses, cutting entropy to ~20 bits. The team builds a pure-JavaScript end-to-end exploit for Microsoft Edge and combines the deduplication primitives with Rowhammer bit flips to obtain reliable arbitrary memory read/write; the demo works on real hardware.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 0:56Attack Explanation
- 2:24Memory Duplication
- 4:21Side Channel Attack
- 5:44Cross Security
- 9:59SLR Pointer
- 11:39Two Primitives
- 17:29Insula
- 21:16In Practice
- 28:27Demo
related talks
44mCutting Edge: Microsoft Browser Security — From People Who Owned It
51mExploiting Hardware Glitches And Side Channels In Perfect Software
50mWrite Once, Pwn Anywhere
35mOn Securing Legacy Software Against Code-Reuse Attacks
25mThe Memory of a Meltdown
53mSilently Breaking ASLR In The Cloud
33mWebKit Everywhere: Secure or Not?
49mChrome Browser Exploitation: from zero to heap sandbox escape