Day 2 at Black Hat: Check Point Research Takes the Stage

Sicherheitsmeldung mit Schweregrad noch nicht bewertet. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.

Originaltext der Quelle (nicht übersetzt) – die deutsche Zusammenfassung findest du im Tab „Kurzfassung".

Day two at Black Hat, and Check Point Research brought two talks to the stage that gave the room plenty to think about. One dug into a fifteen year old blind spot sitting inside Windows itself. The other pulled apart the agent frameworks powering today’s AI products and found familiar bugs wearing new clothes. 

Here’s what our researchers presented yesterday at Black Hat

BTR Reforged: The Driver Nobody Had Looked At

Jiří Vinopal opened the day with a talk that started from an uncomfortable premise. Somewhere inside Windows Defender sits a kernel driver built to clean up malware that survives a normal removal. It runs in Ring 0, takes encrypted instructions from disk, and deletes itself when the job is done. Despite sitting on every Windows machine for over a decade, nobody had ever published an analysis of how it actually works. 

Jiří took it apart from raw binary, with no documentation and no symbols to lean on, across eighteen signed builds spanning Windows 7 through a fully updated Windows 11 25H2. Every single build carried the same hard coded encryption key. Once he learned to speak the driver’s language, he could hand it his own instructions instead of Defender’s. 

The talk walked through what that capability actually unlocks: a full set of Ring 0 file and registry operations, a boot phase window where the filesystem comes alive before Defender’s own protection does, and a live demo showing the entire Defender stack deleted from a fully patched, fully protected machine. Since the driver is doing exactly what Microsoft built it to do, there’s no CVE attached and …

Vollständiger Originalartikel ↗

• Betroffenheit im eigenen Stack prüfen: Versionen/Komponenten abgleichen.
• Originalquelle / Hersteller-Advisory lesen: https://research.checkpoint.com/2026/day-2-at-black-hat-check-point-research-takes-the-stage/
• Verfügbaren Patch oder Workaround einspielen und dokumentieren.