Security researcher Alon Leviev from SafeBreach demonstrated a method to bypass Windows security features by downgrading critical system components like Driver Signature Enforcement (DSE). This exploit could allow attackers to load unauthorized drivers, potentially deploying rootkits on even fully patched Windows systems. The technique involves manipulating the Windows Update process to install outdated, vulnerable software components, which the operating system then treats as fully patched.

⟶CVSS Scores: The vulnerabilities exploited in this downgrade attack are 𝐂𝐕𝐄-𝟐𝟎𝟐𝟒-𝟑𝟖𝟐𝟎𝟐 (𝐂𝐕𝐒𝐒 𝟕.𝟑) and 𝐂𝐕𝐄-𝟐𝟎𝟐𝟒-𝟐𝟏𝟑𝟎𝟐 (𝐂𝐕𝐒𝐒 𝟔.𝟕). These scores reflect significant security impacts, given the risks associated with privilege escalation and system compromise.

⟶ Research and Tool Release: Leviev’s tool, 𝑊𝑖𝑛𝑑𝑜𝑤𝑠 𝐷𝑜𝑤𝑛𝑑𝑎𝑡𝑒, enables attackers to create custom downgrade configurations, exposing up-to-date systems to vulnerabilities that have been previously patched, specifically targeting components like 𝐜𝐢.𝐝𝐥𝐥. This manipulation effectively undoes critical updates, exploiting weak spots in Windows’ integrity checks and making the “fully patched” status misleading.

⟶Bypassing VBS: Virtualization-based Security (VBS), a core Windows security feature, can also be weakened through this downgrade attack. With modified registry keys and partial VBS configurations, attackers can downgrade essential files, like 𝐜𝐢.𝐝𝐥𝐥, bypassing the secure kernel integrity check. As well as replacing one of the VBS files, such as 𝐒𝐞𝐜𝐮𝐫𝐞𝐊𝐞𝐫𝐧𝐞𝐥.𝐞𝐱𝐞, with invalid files, preventing VBS from loading.

⟶Microsoft’s Response: Although Microsoft has acknowledged the risks associated with these downgrade tactics, it hasn’t classified the vulnerability as crossing a security boundary( because this exploit requires administrator privileges), meaning it is not yet fully patched. Microsoft states that it is working on a comprehensive fix, which will involve revoking certain unpatched files across affected systems, though a release date for this update is not yet confirmed.