Microsoft Reportedly Left Users Vulnerable for Years Due to Out-of-Date Driver List: All Details

[Pelican Press 0]

This is the hidden content, please

• Sign In
• or
• Sign Up

This is the hidden content, please

• Sign In
• or
• Sign Up

Reportedly Left Users Vulnerable for Years Due to Out-of-Date Driver List: All Details

This is the hidden content, please

• Sign In
• or
• Sign Up

******* to safeguard Windows PC users from malicious drivers since 2019, according to a report. Computers use drivers to communicate with external devices such as hard disks, cameras, printers, and smartphones. Each driver is required to be digitally signed to ensure that it is safe for use. If, however, an existing digitally signed driver has a security flaw, it could be easily exploited by hackers. This has reportedly caused people to be exposed to a type of cyberattack called Bring Your Own Vulnerable Driver (BYOVD) that grants hackers direct access to the PCs running on Windows, by exploiting known flaws in driver software.

This is the hidden content, please

• Sign In
• or
• Sign Up

uses hypervisor-protected code integrity (HVCI) as a security measure against such attacks. Citing senior vulnerability analyst Will Dormann, ArsTechnica

This is the hidden content, please

• Sign In
• or
• Sign Up

that this security tool did not properly protect users against being infected through compromised drivers.

Last month, Dormann posted a

This is the hidden content, please

• Sign In
• or
• Sign Up

thread on how he was able to download a malicious driver on a

This is the hidden content, please

• Sign In
• or
• Sign Up

HVCI-enabled device, which should have been blocked. He claims that the blocklist had not been updated since 2019, implying that users were not protected by

This is the hidden content, please

• Sign In
• or
• Sign Up

from these drivers for years.

What’s concerning is that regardless of how many Windows Updates happen, the code integrity policy on a Win10 machine is at least 2 years old.
That is, while HVCI-enabled systems will get the benefit of automatic driver blocking, the list never updates, so will be quite old!

This is the hidden content, please

• Sign In
• or
• Sign Up

— Will Dormann (@wdormann)

This is the hidden content, please

• Sign In
• or
• Sign Up

Earlier this month,

This is the hidden content, please

• Sign In
• or
• Sign Up

project manager Jeffery Sutherland replied to Dormann’s tweets and revealed additional protectional measures the company had recently undertaken to mitigate the issue. “We have updated the online docs and added a download with instructions to apply the binary version directly,” Sutherland tweeted.

Thanks for all the feedback. We have updated the online docs and added a download with instructions to apply the binary version directly. We’re also fixing the issues with our servicing process which has prevented devices from receiving updates to the policy.

— Jeffrey Sutherland (@j3ffr3y1974)

This is the hidden content, please

• Sign In
• or
• Sign Up

This is the hidden content, please

• Sign In
• or
• Sign Up

told ArsTechnica that it adds malicious drivers to a blocklist, that receives regular updates. “The vulnerable driver list is regularly updated, however we received feedback there has been a gap in synchronization across OS versions. We have corrected this and it will be serviced in upcoming and future Windows Updates. The documentation page will be updated as new updates are released,” the company said.

Meanwhile many cases of BYOVD attacks have made it to the headlines in recent times. Recently, cybercriminals

This is the hidden content, please

• Sign In
• or
• Sign Up

a vulnerability in the anti-cheat driver for the game Genshin Impact. Last year, North Korean hacking group Lazarus

This is the hidden content, please

• Sign In
• or
• Sign Up

a BYOVD ******* on an aerospace employee in the Netherlands.

---

Affiliate links may be automatically generated – see our ethics statement for details.

This is the hidden content, please

• Sign In
• or
• Sign Up

#

This is the hidden content, please

• Sign In
• or
• Sign Up

#Reportedly #Left #Users #Vulnerable #Years #Due #OutofDate #Driver #List #Details

This is the hidden content, please

• Sign In
• or
• Sign Up

This is the hidden content, please

• Sign In
• or
• Sign Up