3 ms·
To execute a rootkit, it would need to create a process in memory. Windows Defender would scan it and probably catch it in the act.
by mycall 9y ago
To execute a rootkit, it would need to create a process in memory. Windows Defender would scan it and probably catch it in the act.
- kbenson 9y agoThe dongle actually doesn't have to install anything, just to know a bit about kernel memory structures or how to locate interesting portions of memory. Full read access means you're pretty much screwed if the entity has bad intentions. No root kit needed.
- darpa_escapee 9y agoWindows Defender or the OS can't do much to prevent a Thunderbolt device from directly accessing memory and doing whatever it wants.