LinkGuard: A Lightweight State-Aware Runtime Guard Against Link Following Attacks in Windows File System

LinkGuard: A Lightweight State-Aware Runtime Guard Against Link Following Attacks in Windows File System

Speakers: Bocheng Xiang

Conference: NDSS Symposium

YouTube: https://www.youtube.com/watch?v=EnlVIDmN9Do

Overview

This talk presents LinkGuard, the first dedicated runtime protection framework against link following attacks on Windows. Link following vulnerabilities -- where privileged programs are tricked into following attacker-created symbolic links, directory junctions, or object manager symlinks to access protected files -- represent a massive and persistent attack surface with over 1,000 CVEs assigned as of August 2025. Despite this scale, no systematic defense existed for Windows specifically.

The researchers from Fudan University first conducted a large-scale empirical study of 152 CVEs and six categories of real-world defenses, identifying fundamental limitations in existing approaches. Based on two key observations -- that link following attacks have a cross-subject signature (attacker creates link, victim follows it) and follow well-defined state transitions -- they built LinkGuard using cross-subject chain graphs and parallel finite state machines. The system mitigates 68 out of 70 real-world vulnerabilities with only 1% overhead in macrobenchmarks and 3.4% in real-world application workloads.

Background

▶ Watch: 1,000+ CVEs: the scale of Windows link following attacks (0:00)

Link following attacks are a systematic and long-standing vulnerability class on Windows. Recent research has highlighted their prevalence: "File Hijacking Vulnerability: The Elephant in the Room" (NDSS 2024), "Picking the Poke: Automatically Detecting and Exploiting Link Following Vulnerabilities" (USENIX 2025), and "Windows PlayInja: Uncovering Design Weaknesses in Windows File System Security" (CCS 2025).

These attacks exploit Windows indirection mechanisms like directory junctions (creatable with mklink /j), object manager symbolic links, and other link types. In a single-step attack, the attacker prepares a link chain in a writable location pointing to a protected target; when a privileged program performs a file operation, it follows the chain without validation. In a multi-step attack, the attacker uses oplock (opportunistic lock) to suspend a victim's file operation, modifies the link chain to point to a protected target, then releases the oplock so the operation resumes following the malicious chain.

Despite the scale of the problem, existing defenses are fragmented. Most approaches were designed for Unix-like systems and do not transfer to Windows due to architectural differences. Windows-specific defenses like Microsoft's Redirection Guard only work on Windows 11 and later, and Microsoft has acknowledged it cannot apply the mechanism to all their own applications due to internal constraints.

Key Findings

▶ Watch: Empirical study: 152 CVEs and six defense categories (4:00)

152 CVEs analyzed, six defense categories identified: The empirical study categorized real-world mitigations into file ACL hardening (44% of cases), file path validation (26%), redirection guard, program privilege reduction, secure path bindings, and file name randomization.

Three recurring defense limitations: (1) High modeling and engineering overhead -- developers must manually identify all security-sensitive operations; (2) Limited compatibility across Windows versions and applications; (3) Incomplete protection -- defenses can be bypassed when attackers control part of the path or exploit multi-step chains.

Cross-subject signature is universal: Every link following attack consists of two indispensable operations by different security principals: the attacker constructs a link chain, and the victim program follows it. This cross-subject interaction is the definitive attack signature.

State-driven detection works: Link following attacks follow well-defined state transition patterns, enabling detection through lightweight finite state machines rather than expensive systemwide monitoring.

68 out of 70 vulnerabilities mitigated: LinkGuard achieves 100% detection of single-step attacks (26/26) and 95.45% detection of multi-step attacks (42/44). The two missed cases involve USB-based attacks outside the monitoring scope.

Minimal overhead: 1% in macrobenchmarks, 3.4% in real-world workloads (Apache, MySQL, WinSCP, 7-Zip), 10.8% average across individual file operations, and ~30ms average latency increase.

Technical Deep Dive

▶ Watch: LinkGuard architecture: dynamic subject filtering and CSCG (10:00)

LinkGuard operates in two stages:

Stage 1 -- Dynamic Subject Filtering: Instead of monitoring the entire system, LinkGuard selectively tracks file operations related to link chain creation and link following at runtime. Through lightweight link chain analysis, it dynamically identifies the involved subjects: the attacker-controlled process and the victim process. Subject definition is context-aware:

• Successful operations: subject is defined by the thread's execution token (the actual security principal)
• Failed operations (permission denied): subject is derived from the file and permission context of the failure

Stage 2 -- Real-Time Attack Detection: File operations are correlated into a Cross-Subject Chain Graph (CSCG) -- a directed graph modeling temporal ordering and file dependencies across different subjects. Each node represents a link-related file operation; edges encode both temporal ordering and file dependencies. The CSCG captures how attacker-controlled operations and victim file accesses are causally connected.

FSM-Based Rule Matching: Multiple finite state machines run in parallel over the CSCG, each representing a specific attack pattern. As operations arrive, the system traverses the CSCG and advances corresponding FSM states. When a sequence of cross-subject operations reaches an attackable terminal state, LinkGuard immediately intercepts the operation.

Path P1 in the graph corresponds to single-step attacks (immediate link following), while path P2 spans multiple intermediate operations (multi-step attacks with oplocks). Both are detected within the same framework, and new attack patterns can be added by defining additional FSM rules.

Performance optimization: Selective monitoring (only tracking link-related operations across subjects rather than all file operations) and lightweight FSM matching control runtime costs. The system evaluates six standard file operations (open, read, write, create, move, delete) with an average 10.8% increase, stable across Windows versions.

Demo / Proof of Concept

▶ Watch: FSM-based parallel attack pattern matching (14:00)

The researchers evaluated LinkGuard against 70 real-world link following vulnerabilities spanning both single-step and multi-step attack patterns. Results:

• 26/26 single-step attacks detected (100%)
• 42/44 multi-step attacks detected (95.45%)
• Two missed cases involved USB-driver-based attacks where symbolic links were created on external drives, outside LinkGuard's file operation monitoring scope

Performance was evaluated across real-world application workloads including Apache, MySQL, WinSCP, and 7-Zip, with average overhead of only 3.4%.

Defensive Implications

▶ Watch: Q&A: Microsoft Redirection Guard limitations and compatibility (20:00)

LinkGuard fills a critical gap in Windows security infrastructure. With over 1,000 CVEs and no comprehensive defense, link following attacks represent one of the largest unaddressed attack surfaces on Windows.

For Windows administrators: LinkGuard provides runtime protection that doesn't require modifying individual applications or waiting for vendor patches. The cross-subject detection model means it can protect legacy applications that don't implement their own link following defenses.

For software vendors: The empirical study of 152 CVEs and six defense categories provides a practical reference for understanding the limitations of current mitigation approaches. The finding that file ACL hardening (44% of cases) and file path validation (26%) are the most common but often insufficient defenses should inform development practices.

Microsoft's Redirection Guard limitation: The discussion revealed that Microsoft's official mitigation only works on Windows 11+, and Microsoft itself cannot apply it to all their own applications due to internal constraints. This validates the need for a complementary runtime protection mechanism like LinkGuard.

Extensibility: New attack patterns can be incorporated by adding FSM rules to the CSCG matching engine, making LinkGuard adaptable as the attack landscape evolves.

Limitation: USB-based attacks where link chains originate on external drives fall outside the monitoring scope, representing the two missed cases in evaluation.

Key Takeaways

• Over 1,000 CVEs have been assigned to Windows link following vulnerabilities, yet no comprehensive defense existed before LinkGuard
• Empirical study of 152 CVEs identified six defense categories, with file ACL hardening (44%) and path validation (26%) being most common but often insufficient
• LinkGuard detects attacks through cross-subject chain graphs and parallel finite state machines, achieving 97.1% overall mitigation (68/70 vulnerabilities)
• Performance overhead is minimal: 1% macrobenchmark, 3.4% real-world application workloads
• Microsoft's Redirection Guard only works on Windows 11+ and cannot be applied universally even by Microsoft
• The framework is extensible -- new attack patterns can be added as FSM rules without architectural changes

About the Speaker(s)

Bocheng Xiang is a researcher at Fudan University. The work represents the first systematic study and runtime defense framework specifically targeting Windows link following attacks, building on the growing body of research (NDSS 2024, USENIX 2025, CCS 2025) that has characterized this vulnerability class.