5

Windows 7 64 bit and newer versions feature Driver Signature Enforcement, which prevents loading an unsigned driver. Then how can some kernel-mode rootkits infect Windows? I rea

Lets say, some user downloaded and ran some rootkit dropper. What exactly will the rootkit do?

Thanks.

Improve this question

1 Answer 1

Reset to default
2

TL;DR: Privilege escalation or bypassing

Generally, these droppers will exploit bugs in the OS. While it should not be possible for this dropper to write into parts of the kernel, there are ways bugs allow them to do so. For example buffer overflows can be exploited to increase privileges to the point, where you can do almost anything.

Improve this answer
2
  • I think verification is done at firmware? does it mean they need firmware exploit to install kernel module?
    – user50312
    Commented Jan 2, 2019 at 2:58
  • @TimothyLeung I don't actually know how it is checked, but with administrator privileges, you can enable test mode which allows you to run unsigned drivers, so it is a moot point. You don't need a firmware exploit. Source: drivethelife.com/windows-drivers/…
    – Peter Harmann
    Commented Jan 4, 2019 at 4:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .