2021 Our Journey Back to the Future of Windows Vulnerabilities
SafeBreach researchers analyze five years of Windows CVE patterns to predict recurring vulnerability classes and discover new zero-day local privilege escalations.
Summary
Analyzing Half a Decade of Windows Vulnerability Data
To identify systemic weaknesses in modern Windows operating systems, SafeBreach researchers Tomer Bar and Eran Segal catalog and classify every reported Windows CVE from 2016 through 2021.
Discovering Recurrent Architectural Flaws
Statistical analysis reveals repeating vulnerability patterns across Windows kernel components, RPC services, and driver installation subsystems despite continuous vendor patching.
Weaponizing Patterns to Discover New Zero-Days
By systematically targeting recurrent flaw archetypes, the researchers uncover novel zero-day privilege escalation bugs in the Windows kernel and core background services.
Predictive Vulnerability Research Frameworks
The authors present predictive research methodologies and defensive validation tools to help enterprise defenders anticipate future vulnerability disclosures.
Related talks
Main Stage·36 min
Ron Ben Yizhak
Ron Ben Yizhak introduces #NoFilter, a novel privilege escalation technique abusing the Windows Filtering Platform to achieve SYSTEM execution without token manipulation.
Main Stage·39 min
Bill Demirkapi
Bill Demirkapi demystifies writing modern Windows kernel rootkits, demonstrating novel kernel hooking techniques to manipulate user-mode network stacks.
Main Stage·31 min
Bill Demirkapi
Bill Demirkapi answers community questions regarding modern Windows kernel development, PatchGuard interactions, and network driver hooks.