How the TLD4 rootkit gets around driver signing policy on a 64-bit machine

[Corrine]

Microsoft's Windows operating system, running on a 64-bit machine provides enhanced security with driver signing of system and low level drivers. This policy, called the kernel mode code signing policy, disallows any unauthorized or malicious driver to be loaded. [1.]

The TDL4 rootkit bypasses driver signing policy on 64-bit machines by changing the boot options of Microsoft boot programs that will allow an unsigned driver to load.

See how its done at the SunbeltBlog:  How the TLD4 rootkit gets around driver signing policy on a 64-bit machine.

Story at The Register:  World's most advanced rootkit penetrates 64-bit Windows.

[Corrine]

Additional information at Alert: Alureon rootkit & 64-bit windows