ITSEC Newsletter 2025-09-11

Author

Henrik Falk
September 11, 2025

Leveraging Raw Disk Reads to Bypass EDR

Drivers are a common part of every Windows environment, and many of them provide low-level functionality. This blog details how to connect with a default Windows driver or vulnerable driver to bypass Endpoint Detection and Response Tools (EDR), file locks, and access controls, to directly read sensitive files. This highlights the need for organizations to better review and understand the drivers in their own environments.

medium.com/workday-engineering/leveraging-raw-disk-reads-to-bypass-edr-f145838b0e6d

Exploit development for IBM i

IBM i administrators have long relied on exit programs as their primary safeguard against abuse of remote services like DDM and DRDA. These hooks are meant to enforce access control, log activity, or block unwanted requests – effectively serving as the last line of defense for many organizations. Our research showed that this trust is often misplaced. We developed techniques to bypass improperly configured exit programs, allowing our payloads to reach the system even in environments where administrators believed they were protected.

blog.silentsignal.eu/2025/09/04/Exploit-development-for-IBM-i

Windows Internals: Secure Calls - The Bridge Between The NT Kernel and Secure Kernel

Communication between VTLs is certainly, in my opinion, an interesting thing. Because of this I decided to write this blog post about the secure call interface, which allows VTL 0 to request the services of VTL 1, or to allow VTL 0 to enlighten VTL 1 with various information. Additionally I am releasing a tool on the same subject called SkBridge, which is capable of issuing secure calls with user-specified parameters.

connormcgarr.github.io/secure-calls-and-skbridge