Bar Attias: How Windows Defender Updates Can Become a Vulnerability
A DEF CON 31 talk on a 0-day vulnerability in the Windows Defender signature update mechanism.
The researcher shows how, with standard user privileges, an attacker can intercept the update process and take full control of Defender. The tool Defender-Pretender demonstrates how to disable protections, execute malware without detection, and even force Defender to delete system files, rendering the system unusable.
The researcher shows how, with standard user privileges, an attacker can intercept the update process and take full control of Defender. The tool Defender-Pretender demonstrates how to disable protections, execute malware without detection, and even force Defender to delete system files, rendering the system unusable.