Security researchers from SafeBreach have found what they say is a Windows downgrade attack
that’s invisible, persistent, irreversible and maybe even more dangerous than last year’s BlackLotus UEFI bootkit. From a report: After seeing the damage that UEFI bootkit could do by bypassing secure boot processes in Windows, SafeBreach’s Alon Leviev became curious whether there were any other fundamental Windows components that could be abused in a similar manner. He hit the jackpot in one of the most unlikely places: The Windows update process.
“I found a way to take over Windows updates to update the system, but with control over all of the actual update contents,” Leviev told us in an interview ahead of his Black Hat USA conference presentation today detailing his findings. Using his technique, having compromised a machine so that he could get in as a normal user, Leviev was able to control which files get updated, which registry keys are changed, which installers get used, and the like. And he was able to do all of it while side-stepping every single integrity verification implemented in the Windows update process. After that, “I was able to downgrade the OS kernel, DLLs, drivers … basically everything that I wanted.” To make matters worse, Leviev said that poking and prodding around the vulnerabilities he found enabled him to attack the entire Windows virtualization stack, including virtualization-based security (VBS) features that are supposed to isolate the kernel and make attacker access less valuable.
Read more of this story at Slashdot.
ย Security researchers from SafeBreach have found what they say is a Windows downgrade attack
that’s invisible, persistent, irreversible and maybe even more dangerous than last year’s BlackLotus UEFI bootkit. From a report: After seeing the damage that UEFI bootkit could do by bypassing secure boot processes in Windows, SafeBreach’s Alon Leviev became curious whether there were any other fundamental Windows components that could be abused in a similar manner. He hit the jackpot in one of the most unlikely places: The Windows update process.
“I found a way to take over Windows updates to update the system, but with control over all of the actual update contents,” Leviev told us in an interview ahead of his Black Hat USA conference presentation today detailing his findings. Using his technique, having compromised a machine so that he could get in as a normal user, Leviev was able to control which files get updated, which registry keys are changed, which installers get used, and the like. And he was able to do all of it while side-stepping every single integrity verification implemented in the Windows update process. After that, “I was able to downgrade the OS kernel, DLLs, drivers … basically everything that I wanted.” To make matters worse, Leviev said that poking and prodding around the vulnerabilities he found enabled him to attack the entire Windows virtualization stack, including virtualization-based security (VBS) features that are supposed to isolate the kernel and make attacker access less valuable.
Read more of this story at Slashdot.ย
