2 ms·

Looks like a signed driver, it’s not particularly hard to turn any driver into a rootkit especially a networking one. If you manage to say install npcap on a m

Looks like a signed driver, it’s not particularly hard to turn any driver into a rootkit especially a networking one. If you manage to say install npcap on a machine which is also signed these days you can pretty much capture the entire network traffic and send it w/e you want… heck both the capturing and the “sending” can be done from within the npcap driver itself since it can both capture and send packages the logic however needs to reside somewhere else. The biggest issue here looks to be that MSFT changed their signing protocols. > In the past, Microsoft only signed the .cat file. Starting with Windows 10, Microsoft now signs all of the portable executables in the returned payload. For example, the .dll file is also signed by Microsoft. https://docs.microsoft.com/en-us/windows-hardware/drivers/dashboard/get-drivers-signed-by-microsoft-for-multiple-windows-versions https://docs.microsoft.com/en-us/windows-hardware/drivers/da... They used to sign only CAT files now they’ll sign pretty much anything that was submitted, I’m guessing their review process can’t actually validate what these things do other than they meet the compatibility requirements. So what they do is that they base their process on “validating” the partner which these days with 100,000 hardware vendors especially in China is pretty darn hard, and even if the process is quite strict it still leaves them open to supply chain attacks. While it might look bad it’s still better than the alternative, if getting your driver signed would be too hard then it would be the same as the early Windows 7 days during which even relatively large and reputable hardware vendors asked you to disabled driver the mandatory driver signature checks because they were too slow in getting their software signed. Also note that this doesn’t impact other signing protection such as smart screen for that Microsoft has a much stricter process however I’m also guessing it would quite possible to sneak something past that too since plenty of small even one man shop commercial software managed to get through the red tape for that.

qzw 5y ago
Looking at the VirusTotal results in the Twitter thread, all but one of the rootkits were actually detected by Microsoft's own anti-virus engine. I think Microsoft should consider running the submissions for driver signing through their anti-virus scanner (or even better, VirusTotal). Won't catch everything, of course, but it's pretty low hanging fruit.
- dogma1138 5y ago
  I’m pretty sure that these were added to the defender list after they were signed and seen in the wild… Same goes for VT they only classify something as malware after there is sufficient evidence that it is malware. For the most part the only difference between malware and non malware is the intent of the operator, pretty much any functionality can be abused for malicious purposes. This especially holds true for most security/system management suites they have pretty much the same capabilities as any decent RAT malware the only difference is the reason behind why they are deployed.
tialaramex 5y ago
Our experience in the Web PKI is pretty stark. Assuming well-meaning, basically competent people, all you can hope for is that they can enforce some simple easy-to-follow rules and you will need to check their work to keep them on the straight and narrow. To the extent they screw up and you miss it, the screw-ups will continue, to the extent the rules are too hard for them to follow they just won't. But I don't see how that regime is useful here because the rules they would need to follow are anything but simple and easy-to-follow. To be effective they need to be more or less reverse engineering complicated drivers day in and day out. So I am not surprised the result is ineffective. Actually I'd say the practical alternative, which you should indeed prefer in real life, is Class Drivers. Notice how that webcam you bought just plugs in and works? Same for your wireless mouse, the no-name USB headset and the 2TB USB hard disk you bought. Because those are standard classes of device, they don't need custom drivers. This current practice is security theatre. There's the big show with the "certification process" and then actually they'll just ship whatever malware somebody pays for.
- jnxx 5y ago
  Then why not use an open source OS with generic drivers which are available in source code and can be inspected, and even build in an exactly reproducible way with a system like GNU Guix?
- franga2000 5y ago
  > the practical alternative, which you should indeed prefer in real life, is Class Drivers Class drivers are great, but they require devices to comply with standards, which are usually not very accommodating of whatever new bells and whistles manufacturers want to add. Putting RGB lighting on literally everything, for example, was not really considered when the standards were written.
  - account42 5y ago
    RGB doesn't really need kernel-level drivers.
drewcoo 5y ago
A catalog file (.cat) has a bunch of file hashes (think file identities) in it. Signing that means indirectly signing all of those files. Signature validation means checking an embedded signature if it exists, then looking for the hash in the installed .cat files and, if found, checking that signature. Authenticode signatures like this are PKI-based. They can be revoked if determined not to be valid later.
- dogma1138 5y ago
  I think the issue with the Win10 model is that the signature on any PE files is independent so one can use it for some bypass outside of the process of installing a driver. That said WHQL/WHLK signatures aren’t useful for bypassing things like smartscreen and do require an additional EV code signing cert to identify the publisher for that. Which again at large scale isn’t probably hard to get.

qzw 5y ago

Looking at the VirusTotal results in the Twitter thread, all but one of the rootkits were actually detected by Microsoft's own anti-virus engine. I think Microsoft should consider running the submissions for driver signing through their anti-virus scanner (or even better, VirusTotal). Won't catch everything, of course, but it's pretty low hanging fruit.

dogma1138 5y ago
I’m pretty sure that these were added to the defender list after they were signed and seen in the wild… Same goes for VT they only classify something as malware after there is sufficient evidence that it is malware. For the most part the only difference between malware and non malware is the intent of the operator, pretty much any functionality can be abused for malicious purposes. This especially holds true for most security/system management suites they have pretty much the same capabilities as any decent RAT malware the only difference is the reason behind why they are deployed.

tialaramex 5y ago

Our experience in the Web PKI is pretty stark. Assuming well-meaning, basically competent people, all you can hope for is that they can enforce some simple easy-to-follow rules and you will need to check their work to keep them on the straight and narrow. To the extent they screw up and you miss it, the screw-ups will continue, to the extent the rules are too hard for them to follow they just won't. But I don't see how that regime is useful here because the rules they would need to follow are anything but simple and easy-to-follow. To be effective they need to be more or less reverse engineering complicated drivers day in and day out. So I am not surprised the result is ineffective. Actually I'd say the practical alternative, which you should indeed prefer in real life, is Class Drivers. Notice how that webcam you bought just plugs in and works? Same for your wireless mouse, the no-name USB headset and the 2TB USB hard disk you bought. Because those are standard classes of device, they don't need custom drivers. This current practice is security theatre. There's the big show with the "certification process" and then actually they'll just ship whatever malware somebody pays for.

jnxx 5y ago
Then why not use an open source OS with generic drivers which are available in source code and can be inspected, and even build in an exactly reproducible way with a system like GNU Guix?
franga2000 5y ago
> the practical alternative, which you should indeed prefer in real life, is Class Drivers Class drivers are great, but they require devices to comply with standards, which are usually not very accommodating of whatever new bells and whistles manufacturers want to add. Putting RGB lighting on literally everything, for example, was not really considered when the standards were written.
- account42 5y ago
  RGB doesn't really need kernel-level drivers.

drewcoo 5y ago

A catalog file (.cat) has a bunch of file hashes (think file identities) in it. Signing that means indirectly signing all of those files. Signature validation means checking an embedded signature if it exists, then looking for the hash in the installed .cat files and, if found, checking that signature. Authenticode signatures like this are PKI-based. They can be revoked if determined not to be valid later.

dogma1138 5y ago
I think the issue with the Win10 model is that the signature on any PE files is independent so one can use it for some bypass outside of the process of installing a driver. That said WHQL/WHLK signatures aren’t useful for bypassing things like smartscreen and do require an additional EV code signing cert to identify the publisher for that. Which again at large scale isn’t probably hard to get.