by Jesper Kråkhede, Sweden
Posted in Business, Methodology, Security Architecture on Dec 14th, 2020
In my previous post I wrote about attackers using old vulnerable drivers to switch off security products. Let me continue on the same theme from a patching perspective. Most companies are fairly good at patching Windows by now. Some are good at patching applications. Very few patch drivers and firmware. They come from a long […]
Posted in Computer Forensics, Security Architecture, Technology on Nov 30th, 2020
Earlier this year security researchers described a ransomware attack with an interesting twist. Before encrypting anything, the attackers installed an old, legitimately signed hardware driver from a well-known manufacturer. The driver had a known vulnerability, and the attackers used it to load their own malicious driver into the Windows kernel. From there they could kill […]