BYOVD Attacks Work Without Hardware, Research Shows
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Windows kernel mode drivers can be interacted with from user mode even when the hardware they were developed for is absent, according to a technical analysis published on the Atos Cyber Shield blog.
- BYOVD (Bring Your Own Vulnerable Driver) attacks are a post-exploitation technique used to disrupt EDR defenses, and the article identifies two key criteria for strong candidates: exploitation must cause meaningful disruption (e.g., arbitrary kernel read/write or code execution) and must be independent of rare system conditions like specific hardware.
- Non-PnP drivers typically create their device objects directly inside the DriverEntry function, making them interactable after a simple two-step deployment using sc.exe create and sc.exe start commands, with the loldrivers.io catalog of vulnerable drivers matching this pattern.
- PnP-compatible drivers — which make up most actual device drivers — generally only create device objects when the corresponding hardware is present, otherwise skipping creation entirely or calling IoDeleteDevice shortly after, creating a brief race-condition window.
- The AddDevice routine in PnP drivers is not invoked from DriverEntry; the PnP manager only calls it after discovering a new device node and assigning the driver to it, leaving the driver dormant on hardware-less systems.
- All experiments in the analysis were conducted on Windows 11 23H2, build 10.0.22631.3007, with the author noting that prior BYOVD research — including work on the Qilin ransomware and the Terminator tool — has not specifically examined hardware-gating's role in vulnerability reachability.
Why it matters: Security teams have historically treated driver vulnerabilities tied to specific hardware as low-priority because reaching them seemed to require owning the corresponding device. This research shows the hardware gate is often thinner than assumed: non-PnP drivers and certain conditional-creation patterns remain reachable from userland, expanding the practical BYOVD catalog that ransomware crews and other attackers can weaponize against EDR products on commodity Windows 11 23H2 systems.
