Windows Downdate: Downgrade Attacks Using Windows Updates

Explore a groundbreaking security presentation from DEF CON 32 that reveals critical vulnerabilities in Windows Update systems through downgrade attacks. Learn how researchers discovered methods to manipulate Windows Updates, enabling the creation of downgrading updates that bypass verification steps and compromise system security. Dive into technical demonstrations showing successful downgrades of DLLs, drivers, and kernel components while maintaining a falsely "fully updated" system status. Understand the implications for virtualization security as the research exposes ways to downgrade Hyper-V's hypervisor, Secure Kernel, and Credential Guard. Examine the first known bypass of VBS's UEFI locks and discover how unprivileged attackers can exploit Windows Update restoration vulnerabilities. Get introduced to "Windows Downdate," a powerful tool that demonstrates how these downgrade attacks can potentially affect any Windows machine globally, challenging the concept of "fully patched" systems.