Other nomination

Let's Make Windows Defender Angry: Antivirus can be an oracle!

Ryo Ichikawa · Speaker Deck · 29 October 2019

AVOracle turns Windows Defender into a content-dependent side channel by placing attacker-controlled script fragments around a secret and observing whether the resulting file is flagged. It recovers secrets byte by byte and also abuses Defender’s neutralization behavior to erase log regions or corrupt structured files.

Record

Researcher

Ryo Ichikawa

Published by

Speaker Deck

Date

29 October 2019

Format

Slides

In the archive

• Nominated for the 2019 Top 10 Web Hacking Techniques

Related sources

• Talk recording

Tags

• side-channel
• info-leak
• xsleak
• dos
• javascript
• evasion

This page is the archive's own catalogue record. The research is the work of Ryo Ichikawa, first published at the original source. Preserved copies are kept so the citation survives its host.