ThreatHuntersJournal
← Back
OtherThe Hacker News·2 days ago

Microsoft Defender's Own Driver Can Be Weaponized to Delete Security Software at Boot

Check Point Research has disclosed a technique leveraging Microsoft Defender's legitimately signed BTR.sys boot-time remediation driver to perform arbitrary kernel-level file and registry operations across Windows 7 through Windows 11 25H2 without exploiting any software vulnerability. The attack requires no external drivers or patches, instead weaponizing the trusted boot-time removal tool already present on affected systems. This capability allows attackers to delete security software and other protected files during the boot process before standard security mechanisms can intervene.

Read full article at The Hacker News ↗

Related Articles

OtherSchneier on Security·1 day ago

Friday Squid Blogging: Neon Flying Squid

The neon flying squid can fly in formation. The shoal of about 100 squid rose unexpectedly from a patch of the Pacific Ocean around 370 miles from Tokyo and glided near the boat for about 30 metres. The astonished researchers were the first to capture photographs of such a thing, which looked like the early stages of an alien invasion. They were probably neon flying squid (Ommastrephes bartramii), the subsequent study states, a species that is part of a 20-strong flying squid family that was known to leap from the water but, until then, was only rumoured to also be able to glide above it. The neon flying squid was able to gain such elevation by using the hyponome, a funnel-like muscular organ also present in other cephalopods, such as octopuses. The organ is able to force water out in a jet, propelling the body along both in and out of the sea. Photographs of the gliding squid show them with their arms (they have 10 limbs in all) splayed outwards. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog moderation policy.

OtherDark Reading·2 days ago

OWASP Flags Top AI Skill Risks in New Security Blueprint

OWASP has released a new top 10 security list designed for the current threat landscape, introducing a Universal Skill Format to standardize and enhance security practices around AI integrations. The framework aims to address the distinct risks associated with AI implementations across development and deployment environments.