11 ms·

Microsoft have signed multiple rootkits

157 points by bobcostas55 5y ago

mikewarot 5y ago
With the offensive posture of the NSA, I would be highly surprised if this weren't true. They can be compelled to do anything, and compelled to keep it secret.
- sneak 5y ago
  Incompetence is more likely than malice. I am sure they have done both.
- rincebrain 5y ago
  While it's true that the NSA could feasibly compel them to do this, I would be reasonably surprised if they exerted that capability so casually that this many ended up uploaded in e.g. VirusTotal. If everyone thinks random signed drivers can be malicious, then they're more cautious about them, looking for them. If everyone thinks signed drivers are a sign of trustworthiness, it's much more likely that your malicious driver can wind up where it needs to be, and stay there without being noticed. My personal bet is heavily on malware getting signed either through a stolen cert/compromised signer or simple incompetence.
- xbar 5y ago
  I do not suspect this is a complete analysis of the risk.
- deleted 5y ago
  [deleted]
- chiph 5y ago
  While they could, I don't think so in this case, as the drivers mentioned report back to C&C servers in China. While the NSA could obviously set up servers there, the simpler case would be that they have not. Don't forget that the other mission of the NSA is to protect American computer infrastructure. Doing something like this where the driver distribution is so wide and indiscriminate would also argue against their involvement. My guesses are in order: 1. The driver authors copied source from somewhere else without understanding what it did. 2. Malicious intent from the Chinese firms. 3. Malicious intent from the CCP. 4. Any other reason.
_kbh_ 5y ago
Less likely Microsoft has signed multiple rootkits and more likely that someone has either stolen the certificate, they have someone at Microsoft signing the malware for them or they have found a vulnerability in the signing process imo.
- st_goliath 5y ago
  Not necessarily. Driver QA & signing is not malware exorcising magic. If you are a genuine hardware vendor, giving them an actual, working driver binary so they can run whatever QA and static static analysis test suite on the binary, you might have the benefit of a doubt and get it signed once it passes. That assumption of good faith mixed with "Betriebsblindheit" is probably all it takes to get a signed driver with a backdoor/rootkit/whatever in it. For comparison: https://news.ycombinator.com/item?id=26887670 https://news.ycombinator.com/item?id=26887670 EDIT: I'm not trying to imply that's what happened here, we don't have enough details yet. Just trying to point out, that binary signing isn't a panacea and doesn't require Ethan Hunt cable dangling into a secure computer room to work around.
  - candiodari 5y ago
    Perhaps it should be mentioned that drivers are halfway to a rootkit even when not being malicious. A driver has (and often needs) access to all apps' memory for example.
- encryptluks2 5y ago
  I certainly believe Microsoft has high level employees working for Russian Government. Every version of Microsoft internal builds leak to Russian websites.
dogma1138 5y ago
Looks like a signed driver, it’s not particularly hard to turn any driver into a rootkit especially a networking one. If you manage to say install npcap on a machine which is also signed these days you can pretty much capture the entire network traffic and send it w/e you want… heck both the capturing and the “sending” can be done from within the npcap driver itself since it can both capture and send packages the logic however needs to reside somewhere else. The biggest issue here looks to be that MSFT changed their signing protocols. > In the past, Microsoft only signed the .cat file. Starting with Windows 10, Microsoft now signs all of the portable executables in the returned payload. For example, the .dll file is also signed by Microsoft. https://docs.microsoft.com/en-us/windows-hardware/drivers/dashboard/get-drivers-signed-by-microsoft-for-multiple-windows-versions https://docs.microsoft.com/en-us/windows-hardware/drivers/da... They used to sign only CAT files now they’ll sign pretty much anything that was submitted, I’m guessing their review process can’t actually validate what these things do other than they meet the compatibility requirements. So what they do is that they base their process on “validating” the partner which these days with 100,000 hardware vendors especially in China is pretty darn hard, and even if the process is quite strict it still leaves them open to supply chain attacks. While it might look bad it’s still better than the alternative, if getting your driver signed would be too hard then it would be the same as the early Windows 7 days during which even relatively large and reputable hardware vendors asked you to disabled driver the mandatory driver signature checks because they were too slow in getting their software signed. Also note that this doesn’t impact other signing protection such as smart screen for that Microsoft has a much stricter process however I’m also guessing it would quite possible to sneak something past that too since plenty of small even one man shop commercial software managed to get through the red tape for that.
- qzw 5y ago
  Looking at the VirusTotal results in the Twitter thread, all but one of the rootkits were actually detected by Microsoft's own anti-virus engine. I think Microsoft should consider running the submissions for driver signing through their anti-virus scanner (or even better, VirusTotal). Won't catch everything, of course, but it's pretty low hanging fruit.
  - 5y ago
est31 5y ago
I wonder what would happen if Microsoft required drivers to be redistributable at least by Microsoft and hosted them on a server for download by independent researchers, similar to how fwupd is doing it. Then the researchers could find ways to identify malware and point it out to Microsoft. As a bonus it might make the life of fwupd easier too.
- encryptluks2 5y ago
  In many ways they do this already and they do it terribly as you would expect from Microsoft. Not only do they install spyware automatically from OEM manufacturers like HP, they also often revert driver updates like Radeon drivers where they'll install an old driver on top of the new one you just installed.
- canada_dry 5y ago
  > researchers could find ways to identify malware Perhaps OS developers should move to a validation system something like FCC has (i.e. to check for allowed electromagnetic interference) that requires analysis and certification by a third party of the driver before it gets signed and rolled-out.
cryptica 5y ago
The real purpose of all these so-called 'security measures' which many Operating System software companies have implemented (e.g. dev licences, requiring programs to be signed) is to restrict users' ability to use software written by third party entities in favor of software designed by the OS's parent company. The irony is that these big corporations have become some of the least trustworthy entities on the planet - They have become hotbeds for hackers, white collar criminals and psychopaths. Any random software you can download online is more likely to be trustworthy than a signed software developed by big tech. With big tech, the chance of software being malware (e.g. spying on you) is almost 100%.
Gamermeme 5y ago
They're also working on these things https://corexbox.com/3353/microsoft-now-brings-next-gen-games-to-xbox-one-through-cloud/ https://corexbox.com/3353/microsoft-now-brings-next-gen-game...
mychannel 5y ago
They're also working on these things https://corexbox.com/3353/microsoft-now-brings-next-gen-games-to-xbox-one-through-cloud/ https://corexbox.com/3353/microsoft-now-brings-next-gen-game...
falcolas 5y ago
Of course they do. They regularly sign anti-cheat programs which are rootkits, so it’s not even an uncommon occurrance. Being a rootkit is insufficient to flag a program as malicious.
mapgrep 5y ago
I’m sure Apple has/will do similar. Isn’t the point of the cert not so much to vet the recipient but to create cost (including nonmonetary) to attain the cert and then have the ability to rapidly revoke the cert and nullify the malware installed base? Even if Microsoft makes some pretense of vetting, no one can ever perfectly weed out malware authors in advance, as that would require knowledge of their future thoughts and motivations (hard enough to assess those in the present). (If Microsoft has failed to revoke certs for known rootkits, by all means bash them hard for that.)
jnxx 5y ago
By the way, this is the equivalent of smuggling malicious source code into the Linux kernel. Look what worked better, security-wise.

157 points by bobcostas55 5y ago

With the offensive posture of the NSA, I would be highly surprised if this weren't true. They can be compelled to do anything, and compelled to keep it secret.

sneak 5y ago
Incompetence is more likely than malice. I am sure they have done both.
rincebrain 5y ago
While it's true that the NSA could feasibly compel them to do this, I would be reasonably surprised if they exerted that capability so casually that this many ended up uploaded in e.g. VirusTotal. If everyone thinks random signed drivers can be malicious, then they're more cautious about them, looking for them. If everyone thinks signed drivers are a sign of trustworthiness, it's much more likely that your malicious driver can wind up where it needs to be, and stay there without being noticed. My personal bet is heavily on malware getting signed either through a stolen cert/compromised signer or simple incompetence.
xbar 5y ago
I do not suspect this is a complete analysis of the risk.
deleted 5y ago
[deleted]
chiph 5y ago
While they could, I don't think so in this case, as the drivers mentioned report back to C&C servers in China. While the NSA could obviously set up servers there, the simpler case would be that they have not. Don't forget that the other mission of the NSA is to protect American computer infrastructure. Doing something like this where the driver distribution is so wide and indiscriminate would also argue against their involvement. My guesses are in order: 1. The driver authors copied source from somewhere else without understanding what it did. 2. Malicious intent from the Chinese firms. 3. Malicious intent from the CCP. 4. Any other reason.

_kbh_ 5y ago

Less likely Microsoft has signed multiple rootkits and more likely that someone has either stolen the certificate, they have someone at Microsoft signing the malware for them or they have found a vulnerability in the signing process imo.

st_goliath 5y ago
Not necessarily. Driver QA & signing is not malware exorcising magic. If you are a genuine hardware vendor, giving them an actual, working driver binary so they can run whatever QA and static static analysis test suite on the binary, you might have the benefit of a doubt and get it signed once it passes. That assumption of good faith mixed with "Betriebsblindheit" is probably all it takes to get a signed driver with a backdoor/rootkit/whatever in it. For comparison: https://news.ycombinator.com/item?id=26887670 https://news.ycombinator.com/item?id=26887670 EDIT: I'm not trying to imply that's what happened here, we don't have enough details yet. Just trying to point out, that binary signing isn't a panacea and doesn't require Ethan Hunt cable dangling into a secure computer room to work around.
- candiodari 5y ago
  Perhaps it should be mentioned that drivers are halfway to a rootkit even when not being malicious. A driver has (and often needs) access to all apps' memory for example.
encryptluks2 5y ago
I certainly believe Microsoft has high level employees working for Russian Government. Every version of Microsoft internal builds leak to Russian websites.

dogma1138 5y ago

Looks like a signed driver, it’s not particularly hard to turn any driver into a rootkit especially a networking one. If you manage to say install npcap on a machine which is also signed these days you can pretty much capture the entire network traffic and send it w/e you want… heck both the capturing and the “sending” can be done from within the npcap driver itself since it can both capture and send packages the logic however needs to reside somewhere else. The biggest issue here looks to be that MSFT changed their signing protocols. > In the past, Microsoft only signed the .cat file. Starting with Windows 10, Microsoft now signs all of the portable executables in the returned payload. For example, the .dll file is also signed by Microsoft. https://docs.microsoft.com/en-us/windows-hardware/drivers/dashboard/get-drivers-signed-by-microsoft-for-multiple-windows-versions https://docs.microsoft.com/en-us/windows-hardware/drivers/da... They used to sign only CAT files now they’ll sign pretty much anything that was submitted, I’m guessing their review process can’t actually validate what these things do other than they meet the compatibility requirements. So what they do is that they base their process on “validating” the partner which these days with 100,000 hardware vendors especially in China is pretty darn hard, and even if the process is quite strict it still leaves them open to supply chain attacks. While it might look bad it’s still better than the alternative, if getting your driver signed would be too hard then it would be the same as the early Windows 7 days during which even relatively large and reputable hardware vendors asked you to disabled driver the mandatory driver signature checks because they were too slow in getting their software signed. Also note that this doesn’t impact other signing protection such as smart screen for that Microsoft has a much stricter process however I’m also guessing it would quite possible to sneak something past that too since plenty of small even one man shop commercial software managed to get through the red tape for that.

qzw 5y ago
Looking at the VirusTotal results in the Twitter thread, all but one of the rootkits were actually detected by Microsoft's own anti-virus engine. I think Microsoft should consider running the submissions for driver signing through their anti-virus scanner (or even better, VirusTotal). Won't catch everything, of course, but it's pretty low hanging fruit.
- 5y ago

est31 5y ago

I wonder what would happen if Microsoft required drivers to be redistributable at least by Microsoft and hosted them on a server for download by independent researchers, similar to how fwupd is doing it. Then the researchers could find ways to identify malware and point it out to Microsoft. As a bonus it might make the life of fwupd easier too.

encryptluks2 5y ago
In many ways they do this already and they do it terribly as you would expect from Microsoft. Not only do they install spyware automatically from OEM manufacturers like HP, they also often revert driver updates like Radeon drivers where they'll install an old driver on top of the new one you just installed.
canada_dry 5y ago
> researchers could find ways to identify malware Perhaps OS developers should move to a validation system something like FCC has (i.e. to check for allowed electromagnetic interference) that requires analysis and certification by a third party of the driver before it gets signed and rolled-out.

cryptica 5y ago

The real purpose of all these so-called 'security measures' which many Operating System software companies have implemented (e.g. dev licences, requiring programs to be signed) is to restrict users' ability to use software written by third party entities in favor of software designed by the OS's parent company. The irony is that these big corporations have become some of the least trustworthy entities on the planet - They have become hotbeds for hackers, white collar criminals and psychopaths. Any random software you can download online is more likely to be trustworthy than a signed software developed by big tech. With big tech, the chance of software being malware (e.g. spying on you) is almost 100%.

Gamermeme 5y ago

They're also working on these things https://corexbox.com/3353/microsoft-now-brings-next-gen-games-to-xbox-one-through-cloud/ https://corexbox.com/3353/microsoft-now-brings-next-gen-game...

mychannel 5y ago

They're also working on these things https://corexbox.com/3353/microsoft-now-brings-next-gen-games-to-xbox-one-through-cloud/ https://corexbox.com/3353/microsoft-now-brings-next-gen-game...

falcolas 5y ago

Of course they do. They regularly sign anti-cheat programs which are rootkits, so it’s not even an uncommon occurrance. Being a rootkit is insufficient to flag a program as malicious.

mapgrep 5y ago

I’m sure Apple has/will do similar. Isn’t the point of the cert not so much to vet the recipient but to create cost (including nonmonetary) to attain the cert and then have the ability to rapidly revoke the cert and nullify the malware installed base? Even if Microsoft makes some pretense of vetting, no one can ever perfectly weed out malware authors in advance, as that would require knowledge of their future thoughts and motivations (hard enough to assess those in the present). (If Microsoft has failed to revoke certs for known rootkits, by all means bash them hard for that.)

jnxx 5y ago

By the way, this is the equivalent of smuggling malicious source code into the Linux kernel. Look what worked better, security-wise.