3 ms·
Less likely Microsoft has signed multiple rootkits and more likely that someone has either stolen the certificate, they have someone at Microsoft signing the ma
by _kbh_ 5y ago
Less likely Microsoft has signed multiple rootkits and more likely that someone has either stolen the certificate, they have someone at Microsoft signing the malware for them or they have found a vulnerability in the signing process imo.
- st_goliath 5y agoNot necessarily. Driver QA & signing is not malware exorcising magic. If you are a genuine hardware vendor, giving them an actual, working driver binary so they can run whatever QA and static static analysis test suite on the binary, you might have the benefit of a doubt and get it signed once it passes. That assumption of good faith mixed with "Betriebsblindheit" is probably all it takes to get a signed driver with a backdoor/rootkit/whatever in it. For comparison: https://news.ycombinator.com/item?id=26887670 https://news.ycombinator.com/item?id=26887670 EDIT: I'm not trying to imply that's what happened here, we don't have enough details yet. Just trying to point out, that binary signing isn't a panacea and doesn't require Ethan Hunt cable dangling into a secure computer room to work around.
- candiodari 5y agoPerhaps it should be mentioned that drivers are halfway to a rootkit even when not being malicious. A driver has (and often needs) access to all apps' memory for example.
- encryptluks2 5y agoI certainly believe Microsoft has high level employees working for Russian Government. Every version of Microsoft internal builds leak to Russian websites.