Problem
us-16-Weston-Windows-10-Mitigation-Improvements us-16-Weston-Windows-10-Mitigation-Improvements
Success Story: 0day exploit in Internet Explorer New Internet Explorer Security Feature 4/23/2014 - 5/1/2014 CVE-2014-1776 6/8/2014 Use-After-Free hardening v1 5/1/2014 - 5/13/2014 2/12/2014 - 3/11/2014 CVE-2014-1815 CVE-2014-0322 2/19/2014 - 3/11/2014 7/6/2014 CVE-2014-0324 Use-After-Free hardening v2 11/7/2014 CFG Windows 8.1 Shipped (Optional Update) 2/11/2015 CFG for Windows 8.1 Shipped (Default) 8/3/2014 Out-of-Date Java Blocking 7/5/2015 Type Protector Shipped 8/18/2015 CVE-2015-2502 10/1/2015 MemGC IE 11 Year Patched RCE CVE Zero Day RCE CVE 2013 116 8 2014 226 4 2015 188 1 4/1/2014 7/1/2014 10/1/2014 1/1/2015 4/1/2015 7/1/2015 10/1/2015 1/1/2014 1/1/2016 • A focus on mitigations for disruption of invariant techniques used in exploits (ROP, Heap Spraying, UAF) • In 2015 only 6 days with a zero day Internet Explorer RCE exploit in-the-wild (down from 45, 135) • Vulnerability volume has increased but number of zero day exploits has decreased
Assume Breach Prevent Breach Threat model Code review Security testing Security development lifecycle (SDL) • Detection, Containment, Response, and Recover Redteams Assume Breach War game exercises Central security monitors Live site penetration test Hypothesis: We can use the assume breach approach to model exploitation and drive mitigations
- Page 3 and 4: • S Problem: Preventative Securit
- Page 5 and 6: Internal Data Sources External Data
- Page 7: Percentage of Use Analysis: 90 80 7
- Page 11 and 12: REDTEAM: Model real-world attacks
- Page 15: Internet Explorer, Edge, & Chakra S
- Page 18 and 19: 1. Allocate object p = new COptionE
- Page 20: No legacy document modes No legacy
- Page 24 and 25: Place array length at a predictable
- Page 26 and 27: Return addresses are not protected
- Page 28: Execute arbitrary native code Code
- Page 31 and 32: Non-paged pool System Page tables c
- Page 34: Win32 Process Store App AppContaine
- Page 38 and 39: Legend 2/4/2014 CVE-2014-0497 Explo
Success Story:<br />
0day exploit in Internet Explorer<br />
New Internet Explorer Security Feature<br />
4/23/2014 - 5/1/2014<br />
CVE-2014-1776<br />
6/8/2014<br />
Use-After-Free hardening v1<br />
5/1/2014 - 5/13/2014<br />
2/12/2014 - 3/11/2014<br />
CVE-2014-1815<br />
CVE-2014-0322 2/19/2014 - 3/11/2014<br />
7/6/2014<br />
CVE-2014-0324<br />
Use-After-Free hardening v2<br />
11/7/2014<br />
CFG Windows 8.1 Shipped (Optional Update) 2/11/2015<br />
CFG for Windows 8.1 Shipped (Default)<br />
8/3/2014<br />
Out-of-Date Java Blocking<br />
7/5/2015<br />
Type Protector Shipped<br />
8/18/2015<br />
CVE-2015-2502<br />
10/1/2015<br />
MemGC IE 11<br />
Year<br />
Patched<br />
RCE CVE<br />
Zero Day<br />
RCE CVE<br />
2013 116 8<br />
2014 226 4<br />
2015 188 1<br />
4/1/2014 7/1/2014 10/1/2014 1/1/2015 4/1/2015 7/1/2015 10/1/2015<br />
1/1/2014 1/1/2016<br />
• A focus on mitigations for disruption of invariant techniques used in exploits (ROP, Heap Spraying, UAF)<br />
• In 2015 only 6 days with a zero day Internet Explorer RCE exploit in-the-wild (down from 45, 135)<br />
• Vulnerability volume has increased but number of zero day exploits has decreased
Change language