Subj : Windows kernel components can be installed to bypass defense syst
To   : All
From : TechnologyDaily
Date : Mon Oct 28 2024 17:15:04

Windows kernel components can be installed to bypass defense systems

Date:
Mon, 28 Oct 2024 17:09:00 +0000

Description:
Experts reveal a way to "downgrade" a fully updated Windows 11 device, and 
thus reintroduce vulnerabilities.

FULL STORY
======================================================================

Experts have uncovered a method allowing cybercriminals to bypass Windows 
security features such as Driver Signature Enforcement (DSE), and thus 
install rootkits on fully updated systems. 

A report from cybersecurity researcher Alon Leviev of SafeBreach claims the 
attack is possible by downgrading certain Windows kernel components. 

By taking over the Windows Update process, crooks can add outdated, 
vulnerable software components, making a system seem fully patched even 
though it isnt. Apparently, even full-patched Windows 11 devices can be 
targeted this way. Rising sophistication 

The researcher claims to have reported this issue to Microsoft, but the 
software giant didnt fix it, saying it didnt break a security boundary since 
an attacker would already need administrator access. 

Leviev demonstrated the issue at the Black Hat and DEF CON 2024 events, and 
shared a tool, Windows Downdate, which allows creating downgrades that reopen 
old vulnerabilities. 

He claimed to have managed to downgrade patched components on Windows 11, 
bring back the DSE bypass and enable the use of unsigned drivers. As a 
result, he was able to install rootkits that can turn off security software, 
hide malicious activity, and more. 

In his attack, Leviev replaced a key Windows file called ci.dll with an 
unpatched version. After replacing the file, the system needs a restart, 
which makes it look like a normal update. Leviev also demonstrated methods to 
disable or bypass Virtualization-Based Security (VBS) by modifying specific 
settings and files, further weakening protections on the system. 

Microsoft is now working on a fix, to block outdated system files and prevent 
downgrade attacks, however, the release date is not yet set, as protecting 
against these issues apparently requires careful testing to prevent system 
disruptions. 

Until then, Leviev advises organizations to monitor for downgrade attacks. 

 Via BleepingComputer More from TechRadar Pro Email threats are becoming more 
dangerous than ever  so keep an eye on your inbox Here's a list of the best 
firewalls today These are the best endpoint protection tools right now



======================================================================
Link to news story:
https://www.techradar.com/pro/security/windows-kernel-components-can-be-instal
led-to-bypass-defense-systems


--- Mystic BBS v1.12 A47 (Linux/64)
 * Origin: tqwNet Technology News (1337:1/100)

.