5

Windows 7 64 bit and newer versions feature Driver Signature Enforcement, which prevents loading an unsigned driver. Then how can some kernel-mode rootkits infect Windows? I rea

Lets say, some user downloaded and ran some rootkit dropper. What exactly will the rootkit do?

Thanks.

2

TL;DR: Privilege escalation or bypassing

Generally, these droppers will exploit bugs in the OS. While it should not be possible for this dropper to write into parts of the kernel, there are ways bugs allow them to do so. For example buffer overflows can be exploited to increase privileges to the point, where you can do almost anything.

  • I think verification is done at firmware? does it mean they need firmware exploit to install kernel module? – user50312 Jan 2 at 2:58
  • @TimothyLeung I don't actually know how it is checked, but with administrator privileges, you can enable test mode which allows you to run unsigned drivers, so it is a moot point. You don't need a firmware exploit. Source: drivethelife.com/windows-drivers/… – Peter Harmann Jan 4 at 4:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.