New “Bring Your Own Trusted Caller” Method Lets Hackers Bypass Windows Driver Auth Controls

A security researcher collective known as GBHackers has documented a novel Windows attack technique called Bring Your Own Trusted Caller (BYOTC). The method enables malicious actors to sidestep driver‑level authorization checks without exploiting classic memory‑corruption vulnerabilities, allowing them to invoke privileged operations in kernel drivers that would otherwise be off‑limits.

Unlike traditional attacks that rely on buffer overflows or use‑after‑free bugs to gain code execution inside a driver, BYOTC leverages the trust relationship between user‑mode applications and signed kernel components. By convincing a legitimate, trusted client program to make a call on the attacker’s behalf, the malicious code can trigger driver functions that assume the caller is authorized, effectively borrowing the client’s privileges.

The technique takes advantage of Windows’ driver signing and caller‑validation mechanisms, which were originally designed to prevent unsigned code from loading into kernel space. However, these checks often focus on the identity of the calling process rather than the intent of the request. BYOTC exploits this gap by routing malicious commands through a benign executable that already possesses the necessary trust token, thereby bypassing the driver’s internal safeguards.

Security experts note that the approach is particularly concerning because it does not require a zero‑day memory‑corruption flaw, which are typically harder to discover and exploit. Instead, attackers can repurpose existing, signed binaries that are already present on most Windows installations, making detection and mitigation more challenging. The method also sidesteps many of the mitigations introduced in recent Windows versions, such as PatchGuard and driver isolation, which focus on preventing unauthorized code from executing directly in kernel mode.

Microsoft has not yet issued a specific advisory on BYOTC, but the company’s ongoing efforts to harden driver signing and to require stricter caller verification may limit the technique’s effectiveness. Industry analysts suggest that future updates could incorporate additional context checks, such as validating the origin of the request or enforcing least‑privilege principles for driver interfaces, to close the loophole.

In the meantime, security teams are advised to review the list of trusted client applications on their systems, monitor for unusual driver interactions, and apply the latest security patches. The discovery underscores the evolving nature of Windows kernel threats, where attackers increasingly look for logical weaknesses rather than relying solely on low‑level bugs. As the BYOTC pattern gains attention, both vendors and defenders will need to adapt their strategies to address trust‑based exploitation vectors.