A forum for reverse engineering, OS internals and malware analysis
EP_X0FF wrote:How do you want to prevent/block if you don't know what is it, how does it work and what it exploits? By denying everything? Becoming a slave of "security" trashware is not the option for everyone.Many zero-day exploits can be easily mitigated by utilising a variety of programs, some of them free. And you don't need to become a slave at all. For example, if this wasn't a kernel-level exploit, opening the document in Sandboxie would probably prevent the exploit.
ssj100 wrote:Many zero-day exploits can be easily mitigated by utilising a variety of programs, some of them free. And you don't need to become a slave at all. For example, if this wasn't a kernel-level exploit, opening the document in Sandboxie would probably prevent the exploit.Because sandboxie can supervise it at upper level. In case of kernel exploiting I doubt that something like this exists or will be implemented because of overhead. However for example common attack vectors used in kernel mode exploits can be covered by system itself, what was done for example in Windows 8 (e.g. - NULL dereference vulnerabilities class).
The driver is registered in the HKLM\System\CurrentControlSet\Services\ registry path. The exact name of the registry key varies in different versions of Duqu drivers.WOW! Quite smart! :lol:
