Microsoft Left Users Vulnerable for Years Due to Outdated Drivers: Report

Microsoft didn’t safeguard Windows PC customers from malicious drivers since 2019, based on a report. Computers use drivers to speak with exterior units reminiscent of onerous disks, cameras, printers, and smartphones. Each driver is required to be digitally signed to make sure that it’s secure to be used. If, nevertheless, an present digitally signed driver has a safety flaw, it might be simply exploited by hackers. This has reportedly precipitated individuals to be uncovered to a kind of cyberattack referred to as Bring Your Own Vulnerable Driver (BYOVD) that grants hackers direct entry to the PCs operating on Windows, by exploiting recognized flaws in driver software program.

Microsoft makes use of hypervisor-protected code integrity (HVCI) as a safety measure in opposition to such assaults. Citing senior vulnerability analyst Will Dormann, ArsTechnica reports that this safety device didn’t correctly shield customers in opposition to being contaminated via compromised drivers.

Last month, Dormann posted a Twitter thread on how he was capable of obtain a malicious driver on a Microsoft HVCI-enabled system, which ought to have been blocked. He claims that the blocklist had not been up to date since 2019, implying that customers weren’t protected by Microsoft from these drivers for years.

Earlier this month, Microsoft mission supervisor Jeffery Sutherland replied to Dormann’s tweets and revealed further protectional measures the corporate had lately undertaken to mitigate the difficulty. “We have updated the online docs and added a download with instructions to apply the binary version directly,” Sutherland tweeted.

Microsoft informed ArsTechnica that it provides malicious drivers to a blocklist, that receives common updates. “The vulnerable driver list is regularly updated, however we received feedback there has been a gap in synchronization across OS versions. We have corrected this and it will be serviced in upcoming and future Windows Updates. The documentation page will be updated as new updates are released,” the corporate mentioned.

Meanwhile many circumstances of BYOVD assaults have made it to the headlines in current instances. Recently, cybercriminals exploited a vulnerability within the anti-cheat driver for the sport Genshin Impact. Last yr, North Korean hacking group Lazarus used a BYOVD assault on an aerospace worker within the Netherlands.