Windows kernel components can be installed to bypass defense systems

Experts have uncovered a method allowing cybercriminals to bypass Windows security features such as Driver Signature Enforcement (DSE), and thus install rootkits on fully updated systems.

A report from cybersecurity researcher Alon Leviev of SafeBreach claims the attack is possible by downgrading certain Windows kernel components.

By taking over the Windows Update process, crooks can add outdated, vulnerable software components, making a system seem “fully patched” even though it isn’t. Apparently, even full-patched Windows 11 devices can be targeted this way.

Rising sophistication

The researcher claims to have reported this issue to Microsoft, but the software giant didn’t fix it, saying it didn’t break a “security boundary” since an attacker would already need administrator access.

Leviev demonstrated the issue at the Black Hat and DEF CON 2024 events, and shared a tool, Windows Downdate, which allows creating downgrades that reopen old vulnerabilities.

He claimed to have managed to downgrade patched components on Windows 11, bring back the DSE bypass and enable the use of unsigned drivers. As a result, he was able to install rootkits that can turn off security software, hide malicious activity, and more.

In his attack, Leviev replaced a key Windows file called ci.dll with an unpatched version. After replacing the file, the system needs a restart, which makes it look like a normal update. Leviev also demonstrated methods to disable or bypass Virtualization-Based Security (VBS) by modifying specific settings and files, further weakening protections on the system.

Microsoft is now working on a fix, to block outdated system files and prevent downgrade attacks,…