New SSDT Exploit Bypasses Windows Anti-Virus Protection Method

A (nearly) new attack method is reportedly able to bypass anti-virus software for Windows in order to, for example, load infected drivers, despite protection mechanisms. The attack, developed by Matousec.com, makes use of the fact that many anti-virus programs hook into the kernel's System Service Descriptor Table (SSDT) in order to monitor program behaviour. If a user calls a particular system function

The link for this article located at H Security is no longer available.