TDL4 rootkit can pwn any security product

It depends on the nature of the attack. If there's a binary payload running before the kernel exploit, then a HIPS will block it. If the kernel exploit runs first and then executes the payload, no.

Mind, if we're talking about a Java based exploit, it's probably just executing a binary payload (as opposed to hijacking the JVM to run a kernel exploit, which I'm going to guess is nontrivial). I've yet to see an ITW malware dropper that does anything else...

 

That´s weird, thanks for checking. Also weird that they still haven´t publicized some more details, perhaps because it´s too dangerous to share?

In other news: Invincea strikes back! Check out this report, where it pounces on Bromium, it was really a bit painful.

http://www.invincea.com/2014/05/tech-throwdown-micro-virtualization/