Cyber Security News

New Windows Downgrade Attack Let Hackers Downgrade Patched Systems To Exploits

The researcher discovered a vulnerability in the Windows Update process that allowed them to downgrade critical system components, including DLLs, drivers, and the NT kernel.

This enabled the attacker to bypass security measures like Secure Boot and expose previously patched vulnerabilities

There are many ways to disable VBS, including Credential Guard and HVCI, even with UEFI locks, demonstrating the potential for significant security risks on fully patched Windows systems.

The “ItsNotASecurityBoundary” DSE bypass exploits a False File Immutability (FFI) vulnerability.

An attacker can modify files marked as immutable by leveraging a double-read condition in the page fault handler. 

Protecting Your Networks & Endpoints With UnderDefense MDR – Request Free Demo

This flaw, specifically applied to a security catalog, allows the attacker to replace a verified catalog with a malicious one during a TOCTOU race condition.

This enables the system to accept an unsigned kernel driver with a valid authenticationode, bypassing security measures and potentially compromising the system. 

Reverting the Patch

The patch to be reverted is located in ci.dll, and the unpatched version 10.0.22621.1376 is targeted for downgrade. While this approach works on fully patched Windows 11 23h2 machines, the presence of Virtualization-Based Security (VBS) poses a challenge. 

VBS can significantly hinder the downgrade process, especially when enabled with UEFI lock and the “Mandatory” flag.

Understanding the different VBS enablement modes and their security implications is crucial for determining the feasibility of a successful downgrade attack. 

When disabled via registry modifications, it can be exploited by downgrading critical system files and leveraging vulnerabilities like “ItsNotASecurityBoundary”. However, UEFI Lock adds an extra layer of protection by storing VBS configuration in UEFI firmware. 

registry is overwritten with the variable’s configuration.

While this prevents remote modification, local attacks can still bypass it by invalidating core VBS components like SecureKernel.exe, which allows attackers to disable VBS and exploit vulnerabilities even with UEFI Lock enabled.

VBS can be secured with the UEFI lock and the “Mandatory” flag. The lock prevents unauthorized modifications to VBS configuration, while the flag ensures system failure if VBS files are corrupted. 

Both settings can be enabled via registry, but the lock must be removed first if already configured. The “Mandatory” flag, recently documented, is not automatically set with the lock and should be used with caution.

The downgrading of first-party components, which includes the operating system kernel, has been identified as a new threat vector for Windows systems, according to recent research by SafeBreach

By exploiting vulnerabilities in older, less secure versions of these components, attackers can bypass modern security measures and regain unauthorized access to the system, known as a downgrade attack and poses a significant risk as it can revive previously patched vulnerabilities. 

Endpoint security solutions must be able to detect and prevent attacks of this nature, even if they do not involve the conventional methods of privilege escalation.

Run private, Real-time Malware Analysis in both Windows & Linux VMs. Get a 14-day free trial with ANY.RUN!

Aman Mishra

Recent Posts

RomCom Hackers Exploits Windows & Firefox Zero-Day in Advanced Cyberattacks

In a new wave of cyberattacks, the Russia-aligned hacking group "RomCom" has been found exploiting…

8 hours ago

Chinese APT Hackers Using Multiple Tools And Vulnerabilities To Attack Telecom Orgs

Earth Estries, a Chinese APT group, has been actively targeting critical sectors like telecommunications and…

10 hours ago

200,000 WordPress Sites Exposed to Cyber Attack, Following Plugin Vulnerability

A critical security vulnerability has been discovered in the popular WordPress plugin Anti-Spam by CleanTalk, which…

15 hours ago

Beware Of SpyLoan Apps Exploits Social Engineering To Steal User Data

SpyLoan apps, a type of PUP, are rapidly increasing, exploiting social engineering to deceive users…

17 hours ago

Researchers Detailed Tools Used By Hacktivists Fueling Ransomware Attacks

CyberVolk, a politically motivated hacktivist group, has leveraged readily available ransomware builders like AzzaSec, Diamond,…

17 hours ago

Blue Yonder Ransomware Attack Impacts Starbucks & Multiple Supermarkets

A ransomware attack on Blue Yonder, a leading supply chain management software provider, has created…

19 hours ago