Ghosthook attack bypasses Windows 10 Patchguard

Discussion in 'other security issues & news' started by Minimalist, Jun 22, 2017.

  1. Minimalist

    Minimalist Registered Member

    Joined:
    Jan 6, 2014
    Posts:
    14,885
    Location:
    Slovenia, EU
    https://threatpost.com/ghosthook-attack-bypasses-windows-10-patchguard
     
  2. itman

    itman Registered Member

    Joined:
    Jun 22, 2010
    Posts:
    8,593
    Location:
    U.S.A.
    Should we expect anything else from Microsoft?:(:isay:
     
  3. EASTER

    EASTER Registered Member

    Joined:
    Jul 28, 2007
    Posts:
    11,126
    Location:
    U.S.A. (South)
    In that article it states a likelihood of it on a future release but am sure those guys who reported on that flaw expect a better response than that.

    This find seems way more of serious concern than what we learned of to date I think.

    Thanks @ronjor for the attention to the duplicate I posted. Many regards
     
  4. Minimalist

    Minimalist Registered Member

    Joined:
    Jan 6, 2014
    Posts:
    14,885
    Location:
    Slovenia, EU
    I agree. When bad guys start using it, malware will be even harder to detect and eradicate. We will again need to start using anti-rootkit tools.
    And similar to HIPS I thought that those times are over.
     
  5. EASTER

    EASTER Registered Member

    Joined:
    Jul 28, 2007
    Posts:
    11,126
    Location:
    U.S.A. (South)
    If it can be of any consolation, at least that VERY SERIOUS flaw was discovered AND reported so that M$ can not only rec0de the darn thing again (remains to be seen if it will be addressed previous/current versions or not) but make more of an effort to examine it closer.

    Ring0 kernel vulnerability flaw is indeed a major game changer if left unchecked.
     
  6. TairikuOkami

    TairikuOkami Registered Member

    Joined:
    Oct 10, 2005
    Posts:
    3,446
    Location:
    Slovakia
    Funny, when AV vendors asked MS to make it easier to bypass Patchguard, MS refused, but I guess Intel pays more. So much for making security a priority.
     
  7. Rasheed187

    Rasheed187 Registered Member

    Joined:
    Jul 10, 2004
    Posts:
    17,606
    Location:
    The Netherlands
    I assume they didn't do this intentionally. And who knows if security tools will also start to make use of it. Not sure if this is a good or bad thing though.

    If I understood correctly, you can only exploit this flaw when you're able to load a driver, so apparently M$ is confident that a malicious driver should never be able to run on Win 10.
     
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.