server side

Software and operating system vendors are increasingly focused on enhancing cybersecurity due to the rapid exploitation of outdated software by threat actors. A significant example is the BlackLotus UEFI BootKit malware, which downgraded the Windows Boot Manager to a vulnerable version, allowing attackers to bypass Secure Boot and gain persistent access to systems. This malware can operate on fully patched Windows 11 systems, raising concerns about current security measures. Researchers discovered a critical flaw that allowed control over the Windows Update process, leading to the creation of a tool called Windows Downdate. This tool could downgrade updates and bypass verification steps, allowing the downgrading of critical OS components while the system falsely reported being fully updated. Key security features were also downgraded, exposing previously patched vulnerabilities and transforming them into zero-days. The Windows Update architecture involves an update client and server, with the client typically operating with Administrator privileges. The update process includes client requests, server validation, and execution of actions during system reboot. Investigation revealed that the Trusted Installer was not enforced on a specific registry key, allowing for manipulation of update actions. The attack methodology did not require malicious elevation of Trusted Installer privileges and relied on setting the Trusted Installer service to Auto-Start, modifying the registry, and including the pending.xml identifier without enforcement. The attack was undetectable, allowing the system to appear fully updated despite downgrades. Actions performed during the attack cannot be reversed, and Microsoft has issued two CVEs in response to these vulnerabilities, acknowledging the work of SafeBreach in identifying them.