New Windows Driver Signature bypass allows kernel rootkit installs

A new vulnerability has been discovered that allows attackers to bypass Windows Driver Signature Enforcement (DSE) and install kernel rootkits on fully patched systems. This is achieved by manipulating the Windows Update process to downgrade critical kernel components, such as the 'ci.dll' file, which is responsible for enforcing driver signatures. The researcher Alon Leviev demonstrated this exploit at security conferences, revealing that even updated systems can be made susceptible to previously patched vulnerabilities. Microsoft has acknowledged the issue but claims it does not cross a defined security boundary. Leviev's tool, Windows Downdate, enables the creation of custom downgrades, effectively rendering the term "fully patched" meaningless. The attack exploits a "race window" condition during the update process, allowing outdated components to load while the system believes it is using the latest versions. Additionally, the research highlights potential methods to disable Microsoft's Virtualization-based Security (VBS), which is designed to protect critical system resources. Leviev emphasizes the need for enhanced endpoint security measures to monitor downgrade procedures, as these attacks can occur even without crossing major security boundaries.

- A new method allows attackers to bypass Windows Driver Signature Enforcement.

- The exploit can downgrade kernel components, making patched systems vulnerable.

- The Windows Downdate tool facilitates the creation of custom downgrades.

- The attack exploits a timing issue during the Windows Update process.

- Enhanced endpoint security is necessary to monitor and prevent downgrade attacks.