Running Rootkits Like a Nation-State Hacker: Subverting Driver Signing Enforcement
Omri Misgav investigates Bring Your Own Vulnerable Driver (BYOVD) attacks, subverting Windows Driver Signature Enforcement to deploy stealthy kernel rootkits.
Summary
The Defense Model of Windows Kernel Code Integrity
On 64-bit Windows systems, Driver Signature Enforcement (DSE) mandates that all kernel-mode code be digitally signed with an extended validation certificate approved by Microsoft.
The BYOVD Technique: Weaponizing Signed Vulnerable Drivers
Omri Misgav analyzes how threat actors leverage legitimately signed but vulnerable commercial drivers to gain arbitrary kernel read/write primitives.
Disabling DSE and Unhooking Kernel Callbacks
Misgav demonstrates patching kernel variables (`g_CiOptions`), blinding EDR kernel callbacks, and executing unsigned nation-state rootkit payloads in Ring 0.
Defensive Solutions: Vulnerable Driver Blocklists & HVCI
The presentation details implementing Hypervisor-Protected Code Integrity (HVCI) and automated vulnerable driver blocklisting to protect enterprise endpoints.
Related talks
Main Stage·39 min
Bill Demirkapi
Bill Demirkapi demystifies writing modern Windows kernel rootkits, demonstrating novel kernel hooking techniques to manipulate user-mode network stacks.
Main Stage·31 min
Bill Demirkapi
Bill Demirkapi answers community questions regarding modern Windows kernel development, PatchGuard interactions, and network driver hooks.
Main Stage·42 min
Tomer Bar · Eran Segal
SafeBreach researchers analyze five years of Windows CVE patterns to predict recurring vulnerability classes and discover new zero-day local privilege escalations.