Microsoft announced last week that starting with Windows 10, version 1607, the operating system will refuse to load any new kernel mode drivers that are not signed by the Windows Hardware Developer Center Dashboard portal, or Dev Portal. To be clear, new installations of this version of Windows 10 will enforce the new driver signing rule, whereas older versions of Windows 10 upgrading to 1607 will not be affected by the change.
Microsoft actually made changes to the driver signing rule with the launch of Windows 10 back in July 2015. The company said from that point on, all new Windows 10 kernel mode drivers must be submitted to and digitally signed by the Dev Portal. If they were not, Windows 10 reportedly wouldn’t load those new kernel drivers.
However, as the company pointed out last week, the new driver signing change wasn’t really enforced up until now due to “technical and ecosystem readiness issues.” Thus, the change remained as a mere policy statement and wasn’t enforced by the Windows Code Integrity component of Windows 10, which validates the integrity of a driver or system file.
For developers, Microsoft described two steps that must take place to push new drivers to Windows 10. First, they must submit the drivers to Microsoft via the Dev Portal. Next, they need to begin the process of getting an Extended Validation (EV) Code Signing Certificate. All drivers submitted to the Dev Portal must have this EV certification no matter what operating system version the developer plans to support with their driver package.
Additionally, developers wanting to get a driver that’s signed for all versions of Windows between Vista and Windows 10 must run the HLK tests for Windows 10, and the HCK tests for Windows 8.1 and earlier. After that, developers can use the Windows 10 HLK to merge the two test logs and submit those results to Microsoft along with the driver in question.
As for existing drivers, developers are not required to have them re-signed for Windows 10 1607 and newer. “To ensure backwards compatibility, drivers which are properly signed by a valid cross-signing certificate issued prior to July 29th, 2015, will continue to pass signing checks on Windows 10, version 1607,” Microsoft states.
So what does all of this mean for the end user? A more secure environment. Thanks to this enforced rule, Windows 10 will prevent users from unknowingly installing malicious driver software that could in turn load up malicious apps or programs, enable remote control to a hacker, and open a doorway to sensitive files and data, like passwords and bank account information.
According to Microsoft, the new driver signing change also reduces the risk of lost or stolen driver signing keys from the publisher. The change even ensures that driver publishers are “strongly authenticated,” thus fortifying the secure foundation of Windows 10 on a whole.
