Windows Downdate: Downgrade Attacks Using Windows Updates

This Black Hat conference talk explores the concept of "Windows Downdate" - downgrade attacks that force software to revert to older, vulnerable versions. Learn how security researcher Alon Leviev from SafeBreach investigates whether critical Windows components beyond Secure Boot are vulnerable to downgrade attacks. The 34-minute presentation builds on the context of the 2023 BlackLotus UEFI bootkit that downgraded Windows boot manager to bypass Secure Boot, examining potential new attack vectors despite Microsoft's mitigations. Discover insights into Windows update mechanisms and their potential security implications for system integrity.