Defender-Pretender: When Windows Defender Updates Become a Security Risk
summary
Researchers disclose a flaw in Windows Defender’s update verification that lets a low‑privilege user craft delta actions to merge unsigned VDMs and push malicious signature DBs; they extract 2.5 million signatures, reverse the merge/CRC checks, and build WD Pretender to deploy unsigned updates successfully. Demos include removing detection for a malware binary, swapping a friendly hash to whitelist mimikatz, and a proof that a crafted signature can mark all PE files as malicious; they also recover 30,000 Lua scripts and report a patched CVE.
AI-written summary · about
chapters (12)
- 0:00Introduction and motivation
- 1:36Defender update process
- 4:30Investigating update files
- 6:45Initial bypass attempts
- 9:40Reverse engineering RPC
- 11:34Signature format analysis
- 15:54Validation mechanisms
- 21:24Merge process internals
- 28:42Attack vector demonstrations
- 31:20Friendly file signatures
- 33:32Permanent denial of service
- 35:44Conclusion and takeaways
related talks
40mIn NTDLL I Trust - Process Reimaging and Endpoint Security Solution Bypass
48m"Sneaking Past Device Guard"
37mMicrosoft Defender for Office 365 Evasion - The Story of Confirmed Vulnerability
58mRed Team Techniques for Evading, Bypassing & Disabling MS
33mAikido: Turning EDRs to Malicious Wipers Using 0-day Exploits
40mBeyond Living-Off-the-Land: Why XP Exploits Still Matter
36mAikido: Turning EDRs to Malicious Wipers Using 0-day Exploits
43mSneaking Past Device Guard