diTii.com Digital News Hub

Sign up with your email address to be the first to know about latest news and more.

I agree to have my personal information transfered to MailChimp (more information)


Disabling Mandatory Kernel Mode and Driver Signing In x64 Vista

64-bit Windows Vista kernel protection is divided into two dimensions: PatchGuard and Mandatory Kernel Mode and Driver Signing. Kaspersky has made their perspective on the Kernel Patch  Protection public, calling
it more of a joke than a serious security barrier against rootkits. And the Mandatory Kernel Mode and Driver Signing was not overlooked by the Russian antivirus maker.

Kaspersky revealed that there are a set of documented methods designed to disable signature checking. With x64 Vista, digital signature for any module or driver at kernel level is mandatory. “There are several documented methods for disabling signature checking, among them methods which are designed to simplify the driver development and testing process. This is because the issue of how to develop drivers is real – it’s impossible to ask for a digital signature for every build prior to testing – which is why there are several ways to disable signature checking,” stated Alisa Shevchenko, Virus analyst, Kaspersky Lab.

In this regard, connecting a system debugger, booting into a mode with no drivers control or monitoring and enabling support for test signatures are all valid methods of disabling Mandatory Kernel Mode and Driver Signing. Kaspersky claims that the methods of disabling Mandatory Kernel Mode and Driver Signing are not limited to these three examples and that there is plenty of room for experiments.

“We anticipate a multitude of methods designed to get around kernel mode protection by loading unsigned components. Once again, the verdict is the same: yes, this function protects the operating system against malicious code, but it is not as effective as the developers claim,” Shevchenko concluded.


Microsoft, Windows Vista, How To

Share This Story, Choose Your Platform!

Get Latest News

Subscribe to Digital News Hub

Get our daily newsletter about the latest news in the industry.
First Name
Last Name
Email address
Secure and Spam free...