3 ms·

I don't know much about more modern Windows, but I'm fairly certain that on XP and earlier anything that ran on behalf of the administrator (the only user on mo

I don't know much about more modern Windows, but I'm fairly certain that on XP and earlier anything that ran on behalf of the administrator (the only user on most home installations) could trivially load arbitrary code into the kernel. I'm not sure how UAC affects this on Vista and newer.

muricula 5y ago
These days you need to have your kernel driver signed by Microsoft or edit your boot config options to put the machine in an insecure state mostly useful for testing. To get it signed you need to pass a basic test suite which MS provides (and can be gamed). https://docs.microsoft.com/en-us/windows-hardware/drivers/install/driver-signing https://docs.microsoft.com/en-us/windows-hardware/drivers/in...
- mananaysiempre 5y ago
  > These days you need to have your kernel driver signed by Microsoft However, this is required only for a “proper” kernel driver specifically; kernel code execution can still be accomplished without any signing at all using /dev/kmem-like mechanisms, which Microsoft explicitly does not consider a bug[1]. > or edit your boot config options to put the machine in an insecure state mostly useful for testing. Or fiddle with undocumented registry settings (used, among other things, to support upgrades from Windows 7 installations with unsigned drivers) and suppress signing checks for your driver even outside of testing mode[2]. > To get it signed you need to pass a basic test suite which MS provides [...]. You also need to register a business entity and cough up upwards of 300 USD/yr for a Microsoft-approved EV code signing cert[3] before that, which is the biggest hurdle for me at least. I have to say, even if this new Microsoft is not the same as old Microsoft, it sure looks very similar from some angles. [1] https://github.com/ionescu007/r0ak#is-this-a-bugvulnerability-in-windows https://github.com/ionescu007/r0ak#is-this-a-bugvulnerabilit... [2] https://geoffchappell.com/notes/security/whqlsettings/index.htm https://geoffchappell.com/notes/security/whqlsettings/index.... [3] https://docs.microsoft.com/en-us/windows-hardware/drivers/dashboard/get-a-code-signing-certificate https://docs.microsoft.com/en-us/windows-hardware/drivers/da...
  - philistine 5y ago
    The new Microsoft is limited to their cloud offerings. The Windows division, when looking from the outside, is still the same.

muricula 5y ago

These days you need to have your kernel driver signed by Microsoft or edit your boot config options to put the machine in an insecure state mostly useful for testing. To get it signed you need to pass a basic test suite which MS provides (and can be gamed). https://docs.microsoft.com/en-us/windows-hardware/drivers/install/driver-signing https://docs.microsoft.com/en-us/windows-hardware/drivers/in...

mananaysiempre 5y ago
> These days you need to have your kernel driver signed by Microsoft However, this is required only for a “proper” kernel driver specifically; kernel code execution can still be accomplished without any signing at all using /dev/kmem-like mechanisms, which Microsoft explicitly does not consider a bug[1]. > or edit your boot config options to put the machine in an insecure state mostly useful for testing. Or fiddle with undocumented registry settings (used, among other things, to support upgrades from Windows 7 installations with unsigned drivers) and suppress signing checks for your driver even outside of testing mode[2]. > To get it signed you need to pass a basic test suite which MS provides [...]. You also need to register a business entity and cough up upwards of 300 USD/yr for a Microsoft-approved EV code signing cert[3] before that, which is the biggest hurdle for me at least. I have to say, even if this new Microsoft is not the same as old Microsoft, it sure looks very similar from some angles. [1] https://github.com/ionescu007/r0ak#is-this-a-bugvulnerability-in-windows https://github.com/ionescu007/r0ak#is-this-a-bugvulnerabilit... [2] https://geoffchappell.com/notes/security/whqlsettings/index.htm https://geoffchappell.com/notes/security/whqlsettings/index.... [3] https://docs.microsoft.com/en-us/windows-hardware/drivers/dashboard/get-a-code-signing-certificate https://docs.microsoft.com/en-us/windows-hardware/drivers/da...
- philistine 5y ago
  The new Microsoft is limited to their cloud offerings. The Windows division, when looking from the outside, is still the same.