The exploit requires malware to get on your machine and execute first. This is not some exploit that you can get by visting some website. In this context, how is it theoretically different than the many current methods that malware uses to disable antivirus products?

Also, SSDT hooking is not needed in newer OSs like Vista and Windows 7, but on older OSs like Windows XP. Some antivirus products may still use SSDT, but they don’t need to.

Matousec grossly exaggerates: “We have performed tests with [most of] today’s Windows desktop security products…The results can be summarized in one sentence: If a product uses SSDT hooks or other kind of kernel mode hooks on similar level to implement security features it is vulnerable. In other words, 100% of the tested products were found vulnerable.”

So basically he installed the products and checked to see if they hooked SSDT and really did not care why the product hooked SSDT, and then called them vulnerable. His own write up he says only some parameters can be swapped out for new stuff (pointers to data, some handles), not all parameters.

Yes the technique is a viable attack but that does not mean all security products that hook SSDT or other kernel objects are vulnerable. It heavily depends on how the hooks are being used by the security software, how the software blocks bad stuff, and which parameters of the hook functions the software cares about.