"Microsoft’s Windows operating system, running on a 64-bit machine provides enhanced security with driver signing of system and low level drivers. This policy, called the kernel mode code signing policy, disallows any unauthorized or malicious driver to be loaded. [1.]
The TDL4 rootkit bypasses driver signing policy on 64-bit machines by changing the boot options of Microsoft boot programs that will allow an unsigned driver to load."
See how its done at the SunbeltBlog: How the TLD4 rootkit gets around driver signing policy on a 64-bit machine.
Additional story at The Register: World's most advanced rootkit penetrates 64-bit Windows.
Clubhouse Tags: Clubhouse, Microsoft, Windows, Security, Vulnerabilities, Information,
Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...
It's another case where admin powers = 0wning the box. There's no way for software to avoid being overwritten unless there's a way to verify the information from the hardware - That's where things like bitlocker with a TPM chip help. Until then, the only recourse is to not get 0wned.
ReplyDelete