DEF CON 32 - Windows Downdate: Downgrade Attacks Using Windows Updates - Alon Leviev

Downgrade attacks on Windows can bypass critical security features like Secure Boot and Virtualization-Based Security (VBS), enabling full privilege escalation from administrator to kernel level. 1:51

Key Takeaways:
• Windows Update’s update folder integrity checks are flawed, allowing attackers to embed downgrading actions in update files; this enables undetectable, persistent, and irreversible downgrades 3:58–4:49.
• By exploiting a vulnerability in the Windows Update action list path, attackers can modify update actions to downgrade critical components like kernel drivers, leading to kernel code execution 10:00–12:53.
• The hypervisor in VBS can be downgraded via Windows Update, bypassing all security boundaries and compromising the entire virtualization stack 27:00–29:00.
• A flaw in the Windows.old folder allows unprivileged users to replace system backups, enabling downgrades during OS restoration 31:00–31:11.

Downgrade attacks render "fully patched" systems meaningless, exposing thousands of old vulnerabilities to exploitation. 34:50

Sources:

• 1:51 Description of downgrade attack as a method to bypass Secure Boot and exploit known vulnerabilities.
• 3:58–4:49 Analysis of Windows Update’s integrity checks and the exploit of the action list path.
• 10:00–12:53 Demonstration of downgrading a kernel driver and achieving kernel code execution.
• 27:00–29:00 Proof of hypervisor downgrade, b