Kernel Driver Patching to Block Malicious Execution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security measures are inadequate in preventing unwanted drivers from accessing the kernel space in Windows OS, making endpoint security products and anti-viruses vulnerable to attacks, as there is no method to block signed or unsigned drivers from being loaded into the kernel layer.
Innovation Solution
A system and method that allows users to selectively block unwanted drivers by patching them in memory before they access the kernel space, using security drivers to register filters for notifications and parsing PE headers to determine and terminate driver execution, with options for whitelisting and automatic or user-initiated prevention.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If driver signature enforcement is implemented to ensure driver reliability, then driver quality is improved, but security vulnerability increases as hackers can bypass it using stolen certificates
Solution Approach 1:
The system performs preliminary actions by patching driver code in memory before the driver accesses kernel space. A security driver intercepts driver loading, modifies the driver's entry point or critical code sections, and then allows the patched driver to execute. This prevents malicious drivers from executing unauthorized code while still allowing legitimate drivers to function.
Solution Approach 2:
A security driver acts as an intermediary between the driver loading mechanism and kernel space access. This intermediary security driver monitors driver loading, applies patches to driver code in memory, and controls access to kernel space. The security driver effectively mediates between the need for driver functionality and the need to prevent malicious execution.
2Adaptability or versatility
If kernel space access is opened to allow driver functionality, then system adaptability is improved, but security risk increases as malicious drivers can disarm endpoint security products
Solution Approach 1:
The system applies local quality by selectively patching only specific code sections within driver binaries. Instead of blocking all driver functionality, the security driver identifies and patches only the critical entry points or vulnerable code sections that could be exploited by malicious drivers. This allows legitimate driver functionality to proceed while neutralizing security risks in specific locations.
Solution Approach 2:
The security driver performs preliminary patching of driver code in memory before the driver executes any harmful code. By modifying the driver binary in place during the loading process, the system prepares the driver in a secure state before it gains access to kernel resources, preventing malicious actions while preserving necessary functionality.
3Ease of operation
If driver loading is unrestricted to maintain system compatibility, then ease of operation is improved, but security protection deteriorates as unwanted drivers can access kernel space
Solution Approach 1:
The security driver performs self-service by automatically monitoring and patching driver loading without requiring user intervention. The system transparently intercepts driver loading requests, applies necessary security patches, and allows or blocks execution based on the patching results. This maintains ease of operation for legitimate users while providing automated security protection.
Solution Approach 2:
The security driver serves as an intermediary layer between the driver loading mechanism and kernel space. It transparently monitors all driver loading attempts, applies patches to driver code in memory, and controls access to kernel space. This intermediary function maintains system compatibility for legitimate drivers while providing security protection against malicious drivers.
Data Source
AI summary
Systems and methods for preventing drivers from being loaded in Windows® OS kernel space. A security driver according to aspects of the invention is loaded in kernel space and is configured to register a filter to provide a notification in the event of an ImageLoad. So configured, the Windows® kernel provides a notification on all executables being loaded to the kernel on a first method and all file system related activities for a second method before executing them. The user may then selectively determine whether the executable or the file system related activities may be executed.