Microsoft announces new 'Hardware-enforced Stack Protection' feature

guest · Mar 25, 2020

Microsoft announces new 'Hardware-enforced Stack Protection' feature
The new "Hardware-enforced Stack Protection" feature is under development and an early preview is available
March 25, 2020
https://www.zdnet.com/article/microsoft-announces-new-hardware-enforced-stack-protection-feature/

Microsoft announced today a new security feature for the Windows operating system.

Named "Hardware-enforced Stack Protection," this feature allows applications to use the local CPU hardware to protect their code while running inside the CPU's memory.
As the feature's name suggests, its primary role is to protect the (memory) stack -- where an app's code is stored during execution.

"Hardware-enforced Stack Protection" works by enforcing strict management of the memory stack through the use of a combination between (1) modern CPU hardware and (2) shadow stacks.
Microsoft says this will prevent malware from hijacking an app's code by exploiting common memory bugs such as stack buffer overflows, dangling pointers, or uninitialized variables -- all known to allow attackers to hijack an app's normal code execution flow. Any modifications that don't match the shadow stacks are ignored, effectively shutting down any exploit attempts.
Click to expand...

AVAILABLE FOR WINDOWS 10 INSIDER FAST RING
Currently, the new "Hardware-enforced Stack Protection" feature is in its early stages and still under active development, according to Hari Pulapaka, manager for the Microsoft Windows Kernel Group.

"In order to receive Hardware-enforced stack protection on your application, there is a new linker flag which sets a bit in the PE header to request protection from the kernel for the executable," Pulapaka explained in a blog post.

Currently, the "Hardware-enforced Stack Protection" feature will only work on chipsets that support Intel's Control-flow Enforcement Technology (CET) instructions, which in turn support the shadow stacks mechanism.
Click to expand...

Microsoft: Understanding Hardware-enforced Stack Protection

We are now exploring security features with deep hardware integration to further raise the bar against attacks. By integrating Windows and its kernel deeply with hardware, we make it difficult and expensive for attackers to mount large scale attacks.
Click to expand...

Rasheed187 · Mar 28, 2020

Seems interesting, I wonder if tools like HMPA and MBAE will be able to make use of this. This new feature will make it quite hard to exploit software.

guest · Apr 3, 2020

Windows 10 security: How the shadow stack will help to keep the hackers at bay
How Windows will use Intel's Control-flow Enforcement Technology to block whole classes of common attacks
April 3, 2020
https://www.techrepublic.com/articl...w-stack-will-help-to-keep-the-hackers-at-bay/

Microsoft and Intel worked together on a design called Control-flow Enforcement Technology (CET) several years ago, which adds the new Shadow Stack Pointer (SSP) register and modifies the standard CPU call and return instructions to store a copy of the return address and compare it to the one in memory -- so most programs won't need any changes for compatibility. If the two addresses don't match, which means the stack has been interfered with, the code will stop running.

"The shadow page table is assigned in a place that most processes or even the kernel cannot access, and this is supported by a new page table attribute that is not even exposed right now and people can't query it either," Pulapaka said. "The idea is that you will not be able to see that it exists, and you will not be able to touch it -- and if you try to touch it, the kernel doesn't allow it to allow any arbitrary process to touch it."
Click to expand...

To avoid compatibility worries with third-party software, CET stack protection will initially be opt-in on Windows.
"We're being a little conservative to avoid breaking apps," Pulapaka said.

Pulapaka expects compatibility problems with CET to be rare, but given the size of the Windows ecosystem some apps may run into problems.
As always, improving protection in one area pushes attackers to switch techniques -- but this is still a big step forward.
Click to expand...

ronjor · Jun 15, 2020

New Security Tech in Intel CPUs Protects Systems Against Malware Attacks

By Eduard Kovacs on June 15, 2020
Intel on Monday unveiled a new security technology for its processors that will help protect systems against attack methods commonly used by malware.
The new Control-Flow Enforcement Technology (CET), which is built into the hardware microarchitecture, will initially be available in the upcoming Tiger Lake mobile processors, but the tech giant plans on including it in desktop and server platforms as well in the future
Click to expand...

Log in or Sign up

Microsoft announces new 'Hardware-enforced Stack Protection' feature

guest Guest

Rasheed187 Registered Member

guest Guest

ronjor Global Moderator

Log in or Sign up

Microsoft announces new 'Hardware-enforced Stack Protection' feature

guest Guest

Rasheed187 Registered Member

guest Guest

ronjor Global Moderator

Useful Searches