Microsoft admits Windows was not properly downloading and applying updates to the driver blocklist designed to thwart “bring your own vulnerable driver” attacks
Microsoft said Windows automatically blocked dangerous drivers. It didn't. — For almost two years …
Context & Ripple Effects
Microsoft's driver blocklist is the backstop against "bring your own vulnerable driver" attacks, where attackers load a legitimately signed but flawed driver to gain kernel access. The company now says Windows failed to download and apply blocklist updates for almost two years, meaning the mechanism customers relied on was quietly inert.
The admission lands on a signing pipeline already under strain: Microsoft previously admitted it signed the malicious Netfilter rootkit driver aimed at gaming environments, and weeks after this disclosure it acknowledged that drivers certified through its Windows Hardware Developer Program were used to sign malware. Blocklist staleness compounds the problem — the list meant to catch bad signed drivers was itself not updating.
First-order effects
- Windows machines that trusted automatic protection were left exposed to known vulnerable drivers for roughly two years, and Microsoft now has to ship a working blocklist update path to close the gap.
Second-order effects
- Security teams that treated the blocklist as a control will have to layer their own driver-allowlisting and monitoring, since Microsoft's own record — Netfilter, certified drivers signing malware, and now a stale blocklist — undermines confidence in the pipeline's self-policing.
Third-order effects
- If the pattern holds, kernel-level trust in Windows shifts from "signed means safe" toward signed-plus-blocklisted-plus-verified, pushing Microsoft toward more active revocation of driver certificates rather than passive list maintenance.
The trend: Driver-based attacks are forcing Microsoft's driver signing and blocklist pipeline to evolve from a passive trust mechanism into an actively maintained revocation system.