Microsoft says it addressed a difficulty stopping its weak driver blocklist from being synced to programs operating older Home windows variations.
This blocklist is designed to dam risk actors from dropping respectable however weak drivers on targets’ programs in Carry Your Personal Susceptible Driver (BYOVD) assaults on HVCI-enabled Home windows machines or these operating Home windows in S Mode.
The flawed drivers are then exploited to escalate privileges within the Home windows kernel and execute malicious code, disabling safety options and taking management of the system.
It is a well-known and common assault approach amongst risk actors of all ability ranges, from ransomware gangs to state-sponsored hacking teams.
Though Microsoft has been promoting its driver blocklist as able to hardening Home windows programs in opposition to weak third-party drivers, ANALYGENCE safety analyst Will Dormann discovered that wasn’t the case.
As Dormann found, not like Home windows 11 units, even up-to-date Home windows 10 and Home windows Server programs had been being supplied with an outdated record of weak drivers from December 2019, exposing clients who thought they had been protected to BYOVD assaults.
Microsoft reluctantly acknowledged his findings and promised to deal with this subject and replace its deceptive on-line assist docs.
Thanks for all of the suggestions. We’ve up to date the web docs and added a obtain with directions to use the binary model straight. We’re additionally fixing the problems with our servicing course of which has prevented units from receiving updates to the coverage.
— Jeffrey Sutherland (@j3ffr3y1974) October 6, 2022
Driver blocklist sync lastly fastened
Greater than a month after Dormann revealed that the record of weak drivers wasn’t saved updated on Home windows 10 and a few Home windows Server programs, Microsoft has now lastly addressed this subject.
“The weak driver record is commonly up to date, nonetheless we acquired suggestions there was a spot in synchronization throughout OS variations,” a Microsoft spokesperson instructed BleepingComputer.
“We’ve corrected this and it is going to be serviced in upcoming and future Home windows Updates. The documentation web page might be up to date as new updates are launched.”
Redmond has addressed the motive force blocklist sync subject with the October 2022 preview launch, which can even make sure that the blocklist on older OS variations would be the identical because the up-to-date one on Home windows 11 21H2 and later.
Beginning with October 2022’s preview launch, the blocklist can be enabled by default on all units. Nonetheless, clients can flip it off utilizing the Home windows Safety app, by turning off HVCI (reminiscence integrity), or disabling Home windows in S Mode.
“Blocking drivers may cause units or software program to malfunction. In uncommon instances, it results in a cease error,” Microsoft warned on Tuesday. “There isn’t any assure that the blocklist will block each driver that has weaknesses.”
