Reply to thread

Message

<blockquote data-quote="436880927" data-source="post: 828097">Pfftttt... so you want me to stroke you and tell you that everything&#039;s going to be alright and that MemProtect can explicitly block code injection when it cannot?Pathetic.If you are already in the kernel, like a good AV will already be, then these mechanisms cannot stop you.1. Anyone already in the kernel can use DKOM to disable the protected process mechanism and re-enable it after they have performed work. Such has always been the case and Microsoft have never done anything about it because they do not consider it to be a &quot;security issue&quot;.2. MemProtect can be bypassed from user-mode with standard rights generically. It isn&#039;t specific to MemProtect. The technique is allowed by Microsoft - they have been aware of it for over a decade and since it doesn&#039;t exploit any security features, it is perfectly acceptable.3. MemProtect&#039;s driver uses ObRegisterCallbacks to restrict handle creation or duplication. It does not explicitly block code injection. However, it would be stupid to expect it to block an AV with kernel-mode software from injecting code, because such doesn&#039;t even have to try and bypass MemProtect.So [USER=50782]@Windows_Security[/USER]: are you going to continue dancing like an idiot or listen to what you&#039;re being told?</blockquote>

[QUOTE="436880927, post: 828097"] Pfftttt... so you want me to stroke you and tell you that everything's going to be alright and that MemProtect can explicitly block code injection when it cannot? Pathetic. If you are already in the kernel, like a good AV will already be, then these mechanisms cannot stop you. 1. Anyone already in the kernel can use DKOM to disable the protected process mechanism and re-enable it after they have performed work. Such has always been the case and Microsoft have never done anything about it because they do not consider it to be a "security issue". 2. MemProtect can be bypassed from user-mode with standard rights generically. It isn't specific to MemProtect. The technique is allowed by Microsoft - they have been aware of it for over a decade and since it doesn't exploit any security features, it is perfectly acceptable. 3. MemProtect's driver uses ObRegisterCallbacks to restrict handle creation or duplication. It does not explicitly block code injection. However, it would be stupid to expect it to block an AV with kernel-mode software from injecting code, because such doesn't even have to try and bypass MemProtect. So [USER=50782]@Windows_Security[/USER]: are you going to continue dancing like an idiot or listen to what you're being told? [/QUOTE]

Verification