New Windows Downgrade Attack Let Hackers Downgrade Patched Systems To Exploits

The researcher discovered a vulnerability in the Windows Update process that allowed them to downgrade critical system components, including DLLs, drivers, and the NT kernel.

This enabled the attacker to bypass security measures like Secure Boot and expose previously patched vulnerabilities. 

There are many ways to disable VBS, including Credential Guard and HVCI, even with UEFI locks, demonstrating the potential for significant security risks on fully patched Windows systems.

The “ItsNotASecurityBoundary” DSE bypass exploits a False File Immutability (FFI) vulnerability.

An attacker can modify files marked as immutable by leveraging a double-read condition in the page fault handler. 

Protecting Your Networks & Endpoints With UnderDefense MDR – Request Free Demo

This flaw, specifically applied to a security catalog, allows the attacker to replace a verified catalog with a malicious one during a TOCTOU race condition.

This enables the system to accept an unsigned kernel driver with a valid authenticationode, bypassing security measures and potentially compromising the system. 

The patch to be reverted is located in ci.dll, and the unpatched version 10.0.22621.1376 is targeted for downgrade. While this approach works on fully patched Windows 11 23h2 machines, the presence of Virtualization-Based Security (VBS) poses a challenge. 

VBS can significantly hinder the downgrade process, especially when enabled with UEFI lock and the “Mandatory” flag.

Understanding the different VBS enablement modes and their security implications is crucial for determining the feasibility of a successful downgrade attack. 

When disabled via registry modifications, it can be exploited by downgrading critical system files and leveraging vulnerabilities like “ItsNotASecurityBoundary”. However, UEFI Lock adds an extra layer of protection by storing VBS configuration in UEFI firmware. 

While this prevents remote modification, local attacks can still bypass it by invalidating core VBS components like SecureKernel.exe, which allows attackers to disable VBS and exploit vulnerabilities even with UEFI Lock enabled.

VBS can be secured with the UEFI lock and the “Mandatory” flag. The lock prevents unauthorized modifications to VBS configuration, while the flag ensures system failure if VBS files are corrupted. 

Both settings can be enabled via registry, but the lock must be removed first if already configured. The “Mandatory” flag, recently documented, is not automatically set with the lock and should be used with caution.

The downgrading of first-party components, which includes the operating system kernel, has been identified as a new threat vector for Windows systems, according to recent research by SafeBreach. 

By exploiting vulnerabilities in older, less secure versions of these components, attackers can bypass modern security measures and regain unauthorized access to the system, known as a downgrade attack and poses a significant risk as it can revive previously patched vulnerabilities. 

Endpoint security solutions must be able to detect and prevent attacks of this nature, even if they do not involve the conventional methods of privilege escalation.

Run private, Real-time Malware Analysis in both Windows & Linux VMs. Get a 14-day free trial with ANY.RUN!