Windows Update Downgrade Attack Rolls Back Updates

Revealing Windows Update Downgrade Attack: Threats and Protection

At the recent Black Hat conference, SafeBreach researchers disclosed a new Windows update downgrade attack (also known as version rollback attack), which attracted widespread attention. This attack can roll back updated software to older versions, causing serious damage to system components, software, and files.

Attack principle and impact

Attackers can manipulate Windows Update to downgrade DLLs, drivers, and even critical operating system components such as NT kernels. This invalidates all installed security patches, bypassing security features and increasing system permissions. SafeBreach practice shows that after this attack, the system cannot recognize new security updates and errors are reported as the latest version, and the infection cannot be detected by the recovery and scanning tools. In short, this attack can lead to serious data breaches and other consequences. For more technical details, please refer to the SafeBreach report: Windows Downgrade Attacks via Windows Update.

Microsoft has released vulnerability information

Microsoft has not released an update that completely fixes this vulnerability, but has released two CVEs (CVE-2024-38202 and CVE-2024-21302) to reduce the risk. You can visit the relevant website and take corresponding measures according to the instructions.

Related suggestions include configuring the audit object access settings, auditing users with backup and restore operation permissions, and implementing access control lists.

Daily protective measures

To prevent such attacks, we recommend that you:

• Avoid downloading applications or software from unreliable sources.
• Use network security measures such as Windows firewall to monitor and filter network traffic.
• Do not access suspicious links or compressed files at will.
• Even if there is a downgrade attack, the system should be kept updated, which helps prevent virus and malware intrusions and improves system performance.
• Regularly back up important files to external hard drives. It is recommended to use professional backup software such as MiniTool ShadowMaker.

Data recovery suggestions

Computer attacks often cause data loss. If you need to recover deleted or lost data on your Windows computer, you can use MiniTool Power Data Recovery. This is a safe and reliable data recovery software that can recover various files without damaging the original data. The software is available in a free version and supports free downloads, disk scanning, file preview and 1GB of free data recovery.

Summarize

This article briefly introduces Windows update downgrade attacks, including its principles, impacts, and some common security protection measures. I hope this information can help you better protect your computer's security.

The above is the detailed content of Windows Update Downgrade Attack Rolls Back Updates. For more information, please follow other related articles on the PHP Chinese website!