Post #4423031

2026-08-06 16:57 UTC

Over at the bad place, somebody mentioned a "BYOVD" attack that's happening in the wild that's going to be demonstrated at Defcon. We're not in Las Vegas, because all of that nonsense is silly. So let's look at what we've got. The Driver is on VirusTotal. It's made by MOCOMSYS & DRC. Its authentihash of 2a7ed8d0be70e0667aa14e161ae1dc6b7daaeb1438b534d73b1093c0b44d78a2 is (obviously) not on the Microsoft recommended driver block rules list, but it's also not in #LOLDrivers anywhere. The ioctl is 0x2205c0. And you can instruct the Windows kernel to kill a PID that you specify. Yeah, it works.

Replies (2)

@wdormann@infosec.exchange 2026-08-06 17:08

If we look at the driver permissions, it turns out it actually is a vulnerable driver, as anybody can tickle any of the ioctls. So if anybody already had this driver on their system (which might be named DCRCVDrv.sys), then it is indeed a driver that introduces a vulnerability. The term "BYOVD" is complete nonsense, as if an attacker is bringing their own driver, it doesn't need to be vulnerable. It's a BYOD attack. Vaguely interesting is that with this driver, Ghidra actually did a better job of decompiling the vulnerable code than IDA did. IDA: Take the ioctl, subtract 0x220540, then subtract 4, then subtract 4, then subtract 4, then subtract 4, then subtract 0x34, and then if you're left with 0x3C, run the function. Ghidra: If the ioctl is 0x2205c0, run the function.

Open ##4423213
@pedro_mateus@mas.to 2026-08-06 17:00

@wdormann@infosec.exchange I will never not read BYOVD as bring your own venereal disease.

Open ##4423476