Virtualization Based Insecurity: Weaponizing VBS Enclaves
Exposes architectural security flaws in Windows Virtualization-Based Security (VBS) enclaves, demonstrating how attackers weaponize isolated trust levels.
Summary
Windows Virtualization-Based Security (VBS)
Microsoft VBS leverages hypervisor hardware virtualization to partition memory into isolated Virtual Trust Levels (VTLs), protecting sensitive security services (such as Credential Guard and isolated enclaves) from compromised operating system kernels.
Auditing VBS Enclave Communication Interfaces
Ori David analyzes the inter-VTL communication interfaces, hypercalls, and shared memory buffers connecting the standard Windows kernel (VTL 0) to secure enclaves (VTL 1).
Weaponizing Enclaves for Stealth and Evasion
Exploiting boundary synchronization bugs and shared memory pointer validation flaws allows attackers to manipulate enclave execution, bypass hypervisor isolation, and execute stealthy persistence mechanisms outside kernel visibility.
Hardening Hypervisor Trust Boundaries
Securing VBS environments requires Microsoft to enforce strict memory bounds checking across all VTL transition interfaces and continuously audit hypervisor trap handlers.
Related talks
Main Stage·39 min
Jiaqing Huang · Hao Zheng · Yue Liu
Attack surface exploration of device virtualization within VMware VMKernel and exploitation of eight newly discovered vulnerabilities.
Main Stage·34 min
Yuval Gordon
Discloses critical design flaws in delegated Managed Service Accounts (dMSAs) in Windows Server 2025, enabling unprivileged domain users to become Domain Admins.
Main Stage·39 min
Mehdi Elyassa
Explores new offensive attack paths and privilege escalation techniques targeting Microsoft System Center Configuration Manager (MECM/SCCM) in enterprise networks.