As cited
Copy frozen at (site build).
Forget vulnerable drivers - Admin is all you need
No summary had been written when this copy was frozen.
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
Forget vulnerable drivers - Admin is all you need
A security researcher disclosed two zero-day vulnerabilities (admin-to-PPL and admin-to-kernel) reported to Microsoft Security Response Center (MSRC) in September 2022 that remain unpatched over 11 months later. The researcher released proof-of-concept tools including PPLFault, GodFault, and a driverless version of EDRSandBlast to demonstrate that admin-level attackers can bypass endpoint detection and response (EDR) and antivirus protections without needing vulnerable drivers, contradicting Microsoft's deployment of a Vulnerable Driver Blocklist. MSRC declined to patch these vulnerabilities, classifying the admin-to-kernel boundary as not a security boundary despite Microsoft's simultaneous efforts to defend it through Driver Signing Enforcement, Secure Boot, and the blocklist.
Why it matters: Windows administrators and security teams must assume that admins with malicious intent or compromised admin credentials can disable EDR and antivirus protections via these unpatched vulnerabilities, and vendors should implement the researcher's NoFault mitigation driver until Microsoft patches the underlying kernel vulnerability.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
Forget vulnerable drivers - Admin is all you need
A security researcher disclosed two zero-day vulnerabilities (admin-to-PPL and admin-to-kernel) reported to Microsoft Security Response Center (MSRC) in September 2022 that remain unpatched over 11 months later. The researcher released proof-of-concept tools including PPLFault, GodFault, and a driverless version of EDRSandBlast to demonstrate that admin-level attackers can bypass endpoint detection and response (EDR) and antivirus protections without needing vulnerable drivers, contradicting Microsoft's deployment of a Vulnerable Driver Blocklist. MSRC declined to patch these vulnerabilities, classifying the admin-to-kernel boundary as not a security boundary despite Microsoft's simultaneous efforts to defend it through Driver Signing Enforcement, Secure Boot, and the blocklist.
Why it matters: Windows administrators and security teams must assume that admins with malicious intent or compromised admin credentials can disable EDR and antivirus protections via these unpatched vulnerabilities, and vendors should implement the researcher's NoFault mitigation driver until Microsoft patches the underlying kernel vulnerability.
- Source published
- First seen by Cybersecurity Tracker