Signed by Microsoft Does Not Mean Safe

Sat, 11 Jul 2026 13:01:35 +0200

A digital signature on a Windows driver proves who made it. It was never proof that the driver is safe. Attackers built a technique on that gap, called Bring Your Own Vulnerable Driver, and it hands them control of Windows at its deepest level. Some of the malware they use was signed through Microsoft’s own program.

A driver is the piece of software that lets Windows and a device work together, your keyboard, your printer, your graphics card. It runs in the kernel, the core of the operating system, at a level called ring 0, where code has direct access to memory and hardware. Security software mostly watches from a step below. Some of it runs inside the kernel too, but even that cannot protect itself once an attacker controls that level. Reaching the kernel puts an attacker on top.

CVE-2023-31096: Microsoft Modem Driver Exploit Fixed Three Years Later

Wed, 14 Jan 2026 15:11:28 +0100

In January 2026, Microsoft had already patched 114 vulnerabilities! Four modem drivers deleted since October. Companies that wrote them: gone. Source code: inaccessible. Microsoft’s only option: remove them entirely. Meanwhile, ransomware groups are loading over 900 other vulnerable drivers that still ship with Windows. 😱 Hackers discovered they could use a 20-year-old telephone code to take over any Windows machine. No hardware required.

One vulnerability stood out: CVE-2023-31096. A CVE number from 2023. Fixed in 2026. Three years later.

Byovd on HackingPassion.com : root@HackingPassion.com-[~]

Signed by Microsoft Does Not Mean Safe

CVE-2023-31096: Microsoft Modem Driver Exploit Fixed Three Years Later