Hacker News Reader

Normally you can't run code in kernel as Administrator. You can only install signed driver. So if you BYOVD (bring your own vulnerable driver) you load signed driver then run your code in kernel.

Typically they are used to remove security software (EDR like CrowdStrike or antivirus) that would stop you deploying your ransomware.

Normally security monitoring tools have mechanisms to stop even and admin uninstalling them without a software specific password, a vulnerable kernel driver would allow you to bypass that.

I think the problem is with a known bad driver blocklist not working like it should. It's something that should prevent installation even if the user clicks yes.

Not a computer security expert, but it sounded like the vulnerable drivers provided a shortcut to certain objectives. So although there might be a way to accomplish something as root, it was easier or more undetectable to do it through the vulnerable drivers.

As Raymond would say, you're already on the other side of the airtight hatchway. This is a non-story.