Collected research
Let's Make Windows Defender Angry: Antivirus can be an oracle!
AVOracle turns antivirus into a side channel: when a file holds both attacker-controlled data and a secret, a JScript or HTML payload split around the secret makes Windows Defender flag the file only for the right guess, leaking the secret byte by byte. Because Defender also blanks the matched bytes, the same trick deletes log entries and corrupts structured files.
Record
- Researcher
- Ryo Ichikawa
- Published by
- Speaker Deck
- Date
- Format
- Slides
- Topic
- Other
In the archive
Related sources
Tags
This page is the archive's own catalogue record. The research is the work of Ryo Ichikawa, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .