At Black Hat 2024, SafeBreach researcher Anon Leviev demonstrated a tool that could silently undo security patches installed on computers running Windows 10, Windows 11, and Windows Server. Through such a downgrade attack, threat actors could reintroduce old security vulnerabilities. Several months later, Leviev has released this tool as an open-source Python-based program and a pre-compiled Windows executable.
Using the tool, dubbed Windows Downdate, it’s possible to circumvent parts of Windows Update to make custom downgrade packages. These then expose past security vulnerabilities and allow users to compromise those systems as if they’d never been patched in the first place.
