Windows kernel components can be installed to bypass defense systems

A woman sitting in a chair looking at a Windows 11 laptop
(Image credit: Microsoft)

Experts have uncovered a method allowing cybercriminals to bypass Windows security features such as Driver Signature Enforcement (DSE), and thus install rootkits on fully updated systems.

A report from cybersecurity researcher Alon Leviev of SafeBreach claims the attack is possible by downgrading certain Windows kernel components.

By taking over the Windows Update process, crooks can add outdated, vulnerable software components, making a system seem “fully patched” even though it isn’t. Apparently, even full-patched Windows 11 devices can be targeted this way.

Rising sophistication

The researcher claims to have reported this issue to Microsoft, but the software giant didn’t fix it, saying it didn’t break a “security boundary” since an attacker would already need administrator access.

Leviev demonstrated the issue at the Black Hat and DEF CON 2024 events, and shared a tool, Windows Downdate, which allows creating downgrades that reopen old vulnerabilities.

He claimed to have managed to downgrade patched components on Windows 11, bring back the DSE bypass and enable the use of unsigned drivers. As a result, he was able to install rootkits that can turn off security software, hide malicious activity, and more.

In his attack, Leviev replaced a key Windows file called ci.dll with an unpatched version. After replacing the file, the system needs a restart, which makes it look like a normal update. Leviev also demonstrated methods to disable or bypass Virtualization-Based Security (VBS) by modifying specific settings and files, further weakening protections on the system.

Microsoft is now working on a fix, to block outdated system files and prevent downgrade attacks, however, the release date is not yet set, as protecting against these issues apparently requires careful testing to prevent system disruptions.

Until then, Leviev advises organizations to monitor for downgrade attacks.

Via BleepingComputer

More from TechRadar Pro

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

Read more
Representational image of a cybercriminal
Microsoft discovers five potentially damaging attacks against its own software
A concept image of someone typing on a computer. A red flashing danger sign is above the keyboard and nymbers and symbols also in glowing red surround it.
New UEFI Secure Boot flaw exposes systems to bootkits
A computer being guarded by cybersecurity.
Huge cyberattack found hitting vulnerable Microsoft-signed legacy drivers to get past security
A person at a laptop with a cybersecure lock symbol floating above it.
Parallels Desktop has some worrying security flaws for Mac users
Security
Microsoft reveals more on a potentially major Apple macOS security flaw
A digital representation of a lock
Security experts are being targeted with fake malware discoveries
Latest in Security
Isometric demonstrating multi-factor authentication using a mobile device.
NCSC gets influencers to sing the praises of 2FA
A stylized depiction of a padlocked WiFi symbol sitting in the centre of an interlocking vault.
Dangerous new CoffeeLoader malware executes on your GPU to get past security tools
China
Notorious Chinese hackers FamousSparrow allegedly target US financial firms
A digital representation of a lock
NYU website defaced as hacker leaks info on a million students
NHS
NHS IT supplier hit with major fine following ransomware attack
Businessman holding a magnifier and searching for a hacker within a business team.
Cloud streaming hoster StreamElements confirms data breach following attack
Latest in News
cheap Nintendo Switch game deals sales
Nintendo didn't anticipate that Mario Kart 8 Deluxe was 'going to be the juggernaut' for the Nintendo Switch when it was ported to the console, according to former employees
Three angles of the Apple MacBook Air 15-inch M4 laptop above a desk
Apple MacBook Air 15-inch (M4) review roundup – should you buy Apple's new lightweight laptop?
Witchbrook
Witchbrook, the life-sim I've been waiting years for, finally has a release window and it's sooner than you think
Amazon Echo Smart Speaker
Amazon is experimenting with renaming Echo speakers to Alexa speakers, and it's about time
Shigeru Miyamoto presents Nintendo Today app
Nintendo Today smartphone app is out now on iOS and Android devices – and here's what it does
Nintendo Virtual Game Card
Nintendo reveals the new Virtual Game Card feature, an easier way to manage your digital Switch games