Microsoft Strikes Back: Patching Zero-Days and Combatting Crimeware Kernel Drivers

Microsoft Patches Four Zero-Days, Finally Takes Action Against Crimeware Kernel Drivers

July 12, 2023

Microsoft released its July 2023 Patch Tuesday updates this week, addressing over 100 vulnerabilities, including four zero-day security holes. These zero-day vulnerabilities had already been exploited by cybercriminals, making it crucial for users to install the patches promptly. While the patches close off these vulnerabilities, it’s essential to recognize that cybercriminals may shift their focus to users who have not yet updated their systems. This emphasizes the importance of patching early and patching often, as leaving oneself exposed to known vulnerabilities can prove detrimental to one’s cybersecurity.

Zero-day Vulnerabilities and Their Impact

Two of the zero-day vulnerabilities addressed in this round of patches are CVE-2023-32049 and CVE-2023-35311, which allow cybercriminals to bypass security protections designed to prevent malware infections and attacks. Exploiting these vulnerabilities gives attackers the ability to present users with malicious web URLs or email content without triggering the usual security warnings. While not as severe as remote code execution (RCE) vulnerabilities that allow attackers to run rogue programs, these security bypass exploits can still be dangerous. By circumventing security warnings that users rely on, cybercriminals can exploit even well-informed individuals, leading to costly mistakes.

The other two zero-day vulnerabilities addressed in this update are elevation of privilege (EoP) exploits. EoP vulnerabilities allow attackers who have already gained access to a network to escalate their privileges to sysadmin level. This gives them unrestricted access to sensitive data and the ability to cause significant damage.

The Issue of Malicious Kernel Drivers

In addition to the zero-day vulnerabilities, Microsoft has also addressed an ongoing security issue related to malicious kernel drivers. Kernel drivers are low-level software components that provide essential functionality to the operating system, including support for hardware, cybersecurity protection, and resource management. While kernel drivers can be beneficial, they also offer significant power to malware creators and cybercriminals, known as rootkits. Rootkits can exploit kernel drivers to remain undetected and perform malicious activities, such as blocking security software or manipulating data within the operating system.

Microsoft has been tightening its control over kernel drivers since Windows Vista, with Secure Boot now requiring all kernel drivers to be officially reviewed and signed by Microsoft. However, an investigation by SophosLabs last December uncovered a significant number of rogue kernel drivers, including 100 drivers that were personally signed by Microsoft. These rogue drivers aimed to disable security software and spy on and manipulate system data. This discovery highlighted the potential vulnerabilities in the Windows vetting process for kernel drivers.

Recommendations and Conclusion

In light of these recent patches and the ongoing threat of zero-day vulnerabilities, it is crucial for users to prioritize prompt patching. Delaying updates exposes users to known vulnerabilities that cybercriminals may exploit. Users should regularly check for updates in their device settings and reboot their computers after installing patches to ensure their systems are secure.

Furthermore, this situation raises broader questions about the reliability of the Windows vetting process for kernel drivers. Despite measures to ensure the security of kernel drivers, the discovery of malicious drivers personally signed by Microsoft raises concerns about the effectiveness of the current review system. As technology advances and cybercriminals become more sophisticated, it is imperative that software companies continually reassess and enhance their security protocols.

Ultimately, for users, staying vigilant and implementing security best practices is crucial in today’s threat landscape. Regularly updating software, using strong and unique passwords, enabling two-factor authentication, and being cautious of suspicious emails and websites are essential habits for safeguarding one’s digital life. Additionally, employing comprehensive security solutions that provide real-time threat detection and prevention can provide an additional layer of protection against evolving cyber threats.

As cybercriminals continuously adapt their tactics, the collective efforts of individuals, software companies, and cybersecurity experts are necessary to stay one step ahead and ensure a safer online environment.