Microsoft's new KDP tech blocks malware by making parts of the Windows kernel read-only

guest · Jul 8, 2020

Microsoft's new KDP tech blocks malware by making parts of the Windows kernel read-only
New KDP security feature is currently being tested with Windows 10 Insider builds
July 8, 2020
https://www.zdnet.com/article/micro...making-parts-of-the-windows-kernel-read-only/

Microsoft has published today the first technical details about a new security feature that will soon be part of Windows 10.

Named Kernel Data Protection (KDP), Microsoft says this feature will block malware or malicious threat actors from modifying (corrupting) the operating system's memory.
According to Microsoft, KDP works by giving developers access to programmatic APIs that will allow them to designate parts of the Windows kernel as read-only sections.

"For example, we've seen attackers use signed but vulnerable drivers to attack policy data structures and install a malicious, unsigned driver," Microsoft's Base Kernel Team said today. "KDP mitigates such attacks by ensuring that policy data structures cannot be tampered with."
Click to expand...

KDP works by taking the kernel memory mark as read-only and moving it inside a VBS "virtual secure mode," where it can't be tampered with, even by the operating system itself.

Microsoft says that VBS support is the only requirement to use KDP with an application on Windows 10.
Any computer that supports VBS will also support KDP inherently.
Click to expand...

Microsoft: Introducing Kernel Data Protection, a new platform security technology for preventing data corruption

Attackers, confronted by security technologies that prevent memory corruption, like Code Integrity (CI) and Control Flow Guard (CFG), are expectedly shifting their techniques towards data corruption. Attackers use data corruption techniques to target system security policy, escalate privileges, tamper with security attestation, modify “initialize once” data structures, among others.

Kernel Data Protection (KDP) is a new technology that prevents data corruption attacks by protecting parts of the Windows kernel and drivers through virtualization-based security (VBS).
Click to expand...

Rasheed187 · Jul 11, 2020

Sounds good to me, this will tackle the problem with rogue drivers.

Log in or Sign up

Microsoft's new KDP tech blocks malware by making parts of the Windows kernel read-only

guest Guest

Rasheed187 Registered Member

Log in or Sign up

Microsoft's new KDP tech blocks malware by making parts of the Windows kernel read-only

guest Guest

Rasheed187 Registered Member

Useful Searches