Shulou(Shulou.com)11/24 Report--

CTOnews.com July 13, Microsoft released a dynamic SafeOS update separately during this month's Patch Tuesday event to further improve Secure Boot security through the deployment of security mitigation measures.

In addition to improving Secure Boot's DBX, Microsoft has also expanded the Windows Driver.STL revocation list and added a number of malicious drivers. These malicious drivers are reported by security companies such as Cisco Talos,Sophos and Trend Micro.

Microsoft said in the ADV230001 announcement that the maliciously signed WHQL driver caused many problems, and the vulnerability tracking number CVE-2023-32046 CTOnews.com translated the main contents as follows:

Microsoft recently learned that drivers certified by the Microsoft Windows hardware developer Program (MWHDP) are being maliciously used in post-exploitation activities.

In these attacks, the attacker gains administrative privileges on the infected system before using the driver.

After the investigation, Microsoft identified a number of abused developer plan accounts, and no leakage of Microsoft accounts was found during the investigation.

We have suspended our partner's seller account and implemented blocking tests on all reported malicious drivers to help protect buyers from this threat.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.