Windows Downdate allows attackers to downgrade Windows systems to previous versions, negating security updates and reintroducing vulnerabilities.<\/p>\n
A newly developed tool named Windows Downdate, crafted by Alon Leviev from SafeBreach, facilitates the downgrading of Windows 10<\/a>, Windows 11<\/a>, and Windows Server<\/a> systems, posing significant security risks. This tool can revert devices to older software versions, reinstating previously fixed security flaws.<\/p>\n Earlier this month, I initially reported on the Downdate issue when it became publicly known. Dubbed as “Downdate,” this exploit takes advantage of the update mechanism that involves communications between user PCs and the Microsoft server, particularly focusing on update folders and action lists.<\/p>\n For further details, you can read more about it here<\/a>.<\/p>\n The utility, accessible as both an open-source Python script and a Windows executable on GitHub<\/a>, targets multiple Windows components including the Hyper-V hypervisor, Windows Kernel, NTFS driver, and Filter Manager driver, reverting them to their original states. Leviev demonstrates using Windows Downdate to revert patches for specific vulnerabilities like CVE-2021-27090<\/a>, CVE-2022-34709<\/a>, and CVE-2023-21768<\/a>.<\/p>\n Windows Downdate tool is now live! Utilize this tool to manage Windows Updates, allowing the downgrading and exposing of past vulnerabilities in DLLs, drivers, NT kernel, Secure Kernel, Hypervisor, IUM trustlets and more!https:\/\/t.co\/59DRIvq6PZ<\/a><\/p>\n \u2014 Alon Leviev (@_0xDeku) August 25, 2024<\/a><\/p>\n Using the vulnerabilities CVE-2024-21302<\/a> and CVE-2024-38202<\/a>, the tool remains undetectable by many endpoint detection and response (EDR) services. Although systems are downgraded, the Windows Update<\/a> system still incorrectly shows that the system is current. This defect enables attackers to disable Windows virtualization-based security measures like Credential Guard and Hypervisor-Protected Code Integrity<\/a> (HVCI), even under UEFI locks.<\/p>\n Microsoft has responded to security concerns by introducing the update KB5041773 to address the vulnerability identified as CVE-2024-21302, though CVE-2024-38202 continues to be an issue without a patch. Microsoft recommends that users employ protective measures to guard against downgrade attacks, which include adjusting \u201cAudit Object Access\u201d settings, restricting update and restore activities, applying Access Control Lists for file access limitation, and keeping track of system rights to identify any misuse.<\/p>\n The security threat posed by Windows Downdate was showcased at both the Black Hat USA 2024 Briefings and DEFCON 32. To deploy this tool, users need to duplicate the related repository, set up the tool using Python, and execute it with an XML configuration file that determines which files to be downgraded.<\/p>\n","protected":false},"excerpt":{"rendered":" Windows Downdate allows attackers to downgrade Windows systems to previous versions, negating security updates and reintroducing vulnerabilities. A newly developed tool named Windows Downdate, crafted by Alon Leviev from SafeBreach, facilitates the downgrading of Windows 10, Windows 11, and Windows Server systems, posing significant security risks. This tool can revert devices to older software versions, […]<\/p>\n","protected":false},"author":1,"featured_media":9905,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-9904","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog"],"_links":{"self":[{"href":"https:\/\/cheapwindowsvps.com\/blog\/wp-json\/wp\/v2\/posts\/9904","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cheapwindowsvps.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cheapwindowsvps.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cheapwindowsvps.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cheapwindowsvps.com\/blog\/wp-json\/wp\/v2\/comments?post=9904"}],"version-history":[{"count":1,"href":"https:\/\/cheapwindowsvps.com\/blog\/wp-json\/wp\/v2\/posts\/9904\/revisions"}],"predecessor-version":[{"id":10287,"href":"https:\/\/cheapwindowsvps.com\/blog\/wp-json\/wp\/v2\/posts\/9904\/revisions\/10287"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cheapwindowsvps.com\/blog\/wp-json\/wp\/v2\/media\/9905"}],"wp:attachment":[{"href":"https:\/\/cheapwindowsvps.com\/blog\/wp-json\/wp\/v2\/media?parent=9904"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cheapwindowsvps.com\/blog\/wp-json\/wp\/v2\/categories?post=9904"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cheapwindowsvps.com\/blog\/wp-json\/wp\/v2\/tags?post=9904"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}