Just Pocket Change? Examining the Cost of “Nickel and Dime” Exploit Mitigations

HVCI, CET, Arbitrary Code Guard, Control Flow Guard. These words and acronyms, among others, strike a chord with most vulnerability researchers. Many of these mitigations have been seen in the community as the end of certain binary exploitation techniques. We know, however, that life has continued for vulnerability researchers — although there is now a significant cost associated with exploits.

Although these “large” exploit mitigations, which came with heavy investment from Microsoft, are notorious — this talk aims to address …

arbitrary code binary binary exploitation cet change code community control cost end exploit exploitation flow guard life mitigations nickel researchers strike techniques vulnerability