Microsoft Bolsters Windows Security: Adds Paragon Driver to Blocklist Amid Ransomware Threats

Microsoft has taken a proactive step to enhance the security of its Windows operating system by adding the vulnerable Paragon Partition Manager driver to its Vulnerable Driver Blocklist. This move comes in response to the exploitation of a Microsoft-signed driver by ransomware miscreants, highlighting the importance of coordinated vulnerability disclosure and the company's commitment to changing the vulnerability economy.

The Paragon Partition Manager driver, BioNTdrv.sys, was found to contain five security flaws that could be exploited by attackers to gain SYSTEM-level control over affected systems. These vulnerabilities, including arbitrary kernel memory mapping and write vulnerabilities, a null pointer dereference, insecure kernel resource access, and an arbitrary memory move vulnerability, allowed attackers to escalate privileges or cause a denial-of-service (DoS) scenario on the victim's machine.

Microsoft identified these vulnerabilities and promptly reported them to Paragon Software, leading to the release of a patched driver version 2.0.0. The company also added vulnerable BioNTdrv.sys versions to its Vulnerable Driver Blocklist, ensuring that the operating system no longer trusts the buggy driver if it shows up in a Bring Your Own Vulnerable Driver (BYOVD) based infection. This blocklist is enabled by default on Windows 11 devices and can be verified under Windows Security settings.



The addition of the vulnerable Paragon Partition Manager driver versions to Microsoft's Vulnerable Driver Blocklist significantly enhances the overall security posture of Windows users, particularly those who have not installed the latest updates. This proactive measure helps to mitigate the risk of ransomware attacks and other malicious activities that could exploit these vulnerabilities.

Microsoft's commitment to Coordinated Vulnerability Disclosure (CVD) and its efforts to change the vulnerability economy are evident in this incident. By promptly identifying and addressing the vulnerabilities, collaborating with security researchers and industry partners, and protecting customers, Microsoft helps to create a more secure environment for all.

In conclusion, Microsoft's addition of the Paragon Partition Manager driver to its Vulnerable Driver Blocklist demonstrates the company's dedication to enhancing Windows security and protecting its users. By staying vigilant and addressing vulnerabilities promptly, Microsoft continues to make strides in changing the vulnerability economy and maintaining user trust in its products and services.