Bring your own vulnerable driver (BYOVD)

Modern operating systems allow drivers, programs running at the system's core with the highest privileges, to be loaded only if digitally signed by a recognized publisher. Attackers therefore cannot easily write their own malicious drivers. The so-called BYOVD technique gets around this protection: the attacker, who already has administrator rights, installs a perfectly legitimate, signed driver from old hardware or software that contains a known vulnerability. Exploiting that flaw gives access to the system kernel, which is then used to stop the endpoint detection and response tools installed on machines, which cannot protect themselves against code running at a level above theirs. Ready-made tools, sold or shared among criminal groups, automate this neutralization. Once defenses are blinded, ransomware deploys without an alert. Countermeasures consist of blocking known vulnerable drivers using blocklists published by vendors, restricting administrator rights, and monitoring the loading of unusual drivers. For insurance, the technique shows that a detection tool ticked in the questionnaire is not enough: its resistance to being disabled and the management of admin rights matter as much as its presence.