Exploiting Windows device drivers
When Windows boots, it performs a series of operations before presenting an interface for users to interact with. During this process, the system loads tiny programs called drivers; these programs provide basic functions that allow the operating system to interact with different devices attached to the machine, such as the mouse, display, hard drive, printer, and USB. One method of exploiting Windows is to replace these driver files with their own driver, which introduces malicious code. Attackers can perform this operation in one of three ways:
- Once they have exploited a system, they can use their access to install the malicious program.
- Once they have exploited a system, they can use their access to download and overwrite the specific driver or file.
- The attacker can compromise the vendor and inject their code into their deployment structure.
While each of these attacks is a way to get malicious drivers onto a machine, the...
