Ghosthook attack bypasses Windows 10 Patchguard

Discussion in 'other security issues & news' started by Minimalist, Jun 22, 2017.

  1. Minimalist

    Minimalist Registered Member

    https://threatpost.com/ghosthook-attack-bypasses-windows-10-patchguard
     
  2. itman

    itman Registered Member

    Should we expect anything else from Microsoft?:(:isay:
     
  3. EASTER

    EASTER Registered Member

    In that article it states a likelihood of it on a future release but am sure those guys who reported on that flaw expect a better response than that.

    This find seems way more of serious concern than what we learned of to date I think.

    Thanks @ronjor for the attention to the duplicate I posted. Many regards
     
  4. Minimalist

    Minimalist Registered Member

    I agree. When bad guys start using it, malware will be even harder to detect and eradicate. We will again need to start using anti-rootkit tools.
    And similar to HIPS I thought that those times are over.
     
  5. EASTER

    EASTER Registered Member

    If it can be of any consolation, at least that VERY SERIOUS flaw was discovered AND reported so that M$ can not only rec0de the darn thing again (remains to be seen if it will be addressed previous/current versions or not) but make more of an effort to examine it closer.

    Ring0 kernel vulnerability flaw is indeed a major game changer if left unchecked.
     
  6. TairikuOkami

    TairikuOkami Registered Member

    Funny, when AV vendors asked MS to make it easier to bypass Patchguard, MS refused, but I guess Intel pays more. So much for making security a priority.
     
  7. Rasheed187

    Rasheed187 Registered Member

    I assume they didn't do this intentionally. And who knows if security tools will also start to make use of it. Not sure if this is a good or bad thing though.

    If I understood correctly, you can only exploit this flaw when you're able to load a driver, so apparently M$ is confident that a malicious driver should never be able to run on Win 10.
     
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice