Key Takeaways

• Kernel access is a powerful capability that allows software to interact directly with an operating system's core.
• It can provide performance benefits and enable advanced functionality, but also poses massive security risks.

Kernel access is a powerful capability that allows software to interact directly with an operating system's core.

While this can provide performance benefits and enable advanced functionality, it also poses massive security risks.

This article serves as public awareness for the types of software that may be requesting this access without your knowledge.

A recent incident involving the BSOD demonstrated the risks of kernel access even for necessary software.

It raised questions about which applications truly need kernel access and which ones could operate with only user-mode access.

Hidden in Plain Sight

The following is a list of applications that may require kernel access.

Best practice is to limit kernel access to only the most necessary applications.

Application	Purpose	Examples
Anti-Cheat Software	Monitors game processes, memory, and hardware to detect low-level cheating	Vanguard, EasyAntiCheat, BattlEye
Security Software	Protects against malware by monitoring system calls and intercepting malicious activities	Antivirus, EDR solutions
Virtualization Software	Manages virtual machines with direct hardware access for near-native performance	VMware, VirtualBox, Hyper-V
Performance Monitoring Tools	Monitors CPU frequencies, temperatures, voltages; enables hardware overclocking	MSI Afterburner, HWiNFO
Remote Access Software	Enhances remote desktop functionality and secure connections	TeamViewer, RealVNC
Backup and Recovery Software	Creates disk images, backs up locked files, performs bare-metal recovery	Acronis, Macrium Reflect
Disk Management Tools	Manipulates partition tables, file systems, and disk structures at low level	EaseUS, MiniTool Partition Wizard
VPN Clients	Bypasses user-mode processing for better throughput and network traffic interception	Some enterprise VPN solutions
Development and Debugging Tools	Inspects kernel memory, sets hardware breakpoints, analyzes system crashes	WinDbg, Sysinternals tools

Identifying Kernel Access Requests

Recognizing when software is requesting kernel-level access is essential for system security:

• Driver Installation Prompts: Windows will display security warnings when installing unsigned or kernel-mode drivers
• UAC Elevation Requests: Frequent or persistent administrator privilege requests, especially during installation
• Digital Signatures: Check if drivers are signed by Microsoft or verified publishers
• Installation Warnings: Antivirus software may flag kernel-mode components during installation
• System Restart Requirements: Many kernel-level components require system restarts to load properly

Mitigation Strategies

When kernel access is unavoidable, implement these protective measures:

• Application Sandboxing: Use Windows Sandbox or virtual machines for untrusted software
• Windows Defender Application Guard: Isolate potentially risky applications
• System Restore Points: Create restore points before installing kernel-level software
• Regular Backups: Maintain current system and data backups
• Staged Deployment: Test kernel-level software on non-critical systems first

User-Mode Alternatives

Consider these alternatives before granting kernel access:

• Application-Level Monitoring: Many monitoring tasks can be performed without kernel access
• Windows Performance Counters: Access system metrics through standard APIs
• User-Mode Network Filters: Use WinSock LSP or WFP for network monitoring
• Managed Security Solutions: Cloud-based security services that reduce local kernel dependencies
• Hardware Abstraction Layers: Use manufacturer-provided APIs instead of direct hardware access

Warning Signs

Be alert to these red flags when evaluating software requesting kernel access:

• Unsigned Drivers: Lack of valid digital signatures from trusted publishers
• Unknown Publishers: Software from unestablished or suspicious developers
• Excessive Permissions: Requests for more access than functionally necessary
• Poor Documentation: Vague explanations for why kernel access is required
• Bundled Software: Kernel components included with unrelated applications
• Emergency Updates: Rushed patches that bypass normal testing procedures

Be vigilant about which software you allow this level of access to—reserve it for what is truly necessary.

Trust only reputable developers unless you have verified the publisher's reputation and understand the security implications.

Exercise caution to keep your systems secure.