12 ms·
Microsoft admits to signing rootkit malware in supply-chain fiasco
- McTossOut 5y agoHow does a $2 Trillion company continue to whiff on things like this, AND CONTINUE GETTING FUNDING FROM BANKS, INVESTORS, THE FEDERAL AND STATE GOVERNMENTS, AND CORPORATE PARTNERS? Google literally hijacked their whole software stack 15 years ago from the inside, for a fraction of the capitalization, and Chrome has barely an inch on Windows' rap sheet, security-wise. Absolutely mind boggling. Their whole business model is IP theft anyways, Slack becomes teams, Wave becomes Office 365. The only thing that can end this is a bank run on something else.
- lawl 5y agoMicrosoft needs to stop signing kernel level anti cheats completely. They are always rootkits by design. No game should require a kernel driver.
- cartoonworld 5y agoTalking out of school here, but games currently seem to require such low level hardware access that this is rendered impossible. No matter if your game has crappy memory management and the escalation exploit roots your XBOX, an update will quash that. But people are banking and buying/mining crypto and then launching fortnite or whatever. Game security is nuts. It's always been a training ground for RE/binary exploitation engineers, so thats a plus.
- the8472 5y ago> but games currently seem to require such low level hardware access that this is rendered impossible That doesn't seem plausible considering that a lot of games run under linux with wine/proton, so clearly they don't need direct hardware access.
- cartoonworld 5y agoI don't think it follows that because they can run on linux/wine compat they don't require excessive privs. Maybe low level hardware access is not the right term, versus excessive privileges that the hardware acceleration libraries require?
- ogurechny 5y agoHardware drivers that deal with hardware acceleration are written by hardware companies. Libraries and applications only call their functions as defined in the documentation. Game programmers in most cases have no clue about the low-level specifics of hardware that accelerate their games.
- sennight 5y ago> but games currently seem to require such low level hardware access... lol, no. The industry has converged on a small number of engines, which is why you see so many cross platform games - back in the day that usually required subcontracting out the task of porting. Also, what is it that you imagine they need to poke so deeply in hardware that they need to bypass the kernel?
- cartoonworld 5y agoGotcha, I suppose I was thinking about the hardware and other drivers. Games sometimes implement special audio, network, video stuff. Point taken, do you think there is any reason they can't run with locked down privileges or is it all anti-cheat?
- sennight 5y agoIt is all "anti-cheat". Many years ago gamedevs like John Carmack were no joke wizards pushing the envelope, which certainly required low level access. Today's gamedevs aren't doing that... not even close. Modern games are known for shamefully janky code - and it isn't motivated my performance, see the GTA json parsing travesty for example: https://news.ycombinator.com/item?id=26296339 https://news.ycombinator.com/item?id=26296339
- giobox 5y agoWhile there’s no question Carmack was an exceptional talent, let’s not forget the original Doom shipped with serious network killing bugs in 93: https://doomwiki.org/wiki/Broadcast_packet_meltdown https://doomwiki.org/wiki/Broadcast_packet_meltdown Making software is hard, I’d not be so quick to judge the GTA devs, especially when GTA games are massively larger development undertakings. Doom was made by a handful of people in less than six months - GTA most certainly wasn’t. There is such a vast difference in complexity I’m not sure there is much value in comparing. The entire doom source code is likely smaller than a single grand theft auto save file.
- 5y ago
- gmueckl 5y agoThis isn't the 80s or 90s anymore. Back then, pretty much every somewhat advanced game asserted full control over the computer hardware as the first order of business. Operating systems neither had the means to prevent this, nor did they have the right kinds of drivers in most cases. With proper protected mode operating systems that include usable driver interfaces, this is thankfully a thing of the past. Modern hardware and modern operating systems usually take care to ensure that any hardware acceleration features are exposed in a way that doesn't create security risks. And, unlike on consoles with known hardware, it doesn't make sense anymore to try to talk to PC hardware directly from a game because things like GPUs are so varied and have so much "secret sauce" these days that trying to create custom drivers is an exercise in futility.
- swebs 5y agoMicrosoft would not want to stop since it keeps users locked in to Windows. The majority of games now support Linux according to ProtonDB, but the few popular games that don't are almost always due to a kernel level anti cheat. https://www.protondb.com https://www.protondb.com
- belval 5y agoI love proton, I sure you like it too, but it's not an existential threat to Windows in any way. People always take the path of least resistance which is Windows on the laptop/desktop that they bought at Best Buy. They won't reinstall their OS because they don't know what it is.
- wyager 5y agoThey might buy a Mac, though. As far as evil software megacorps go, I kind of prefer people using Apple products to using MS products.
- okamiueru 5y agoHow do you feel about the monitoring of every executable you run, when and where?
- smokelegend 5y agoAre you suggesting that MS does this or Apple? Is this known behavior documented somewhere I can learn more about?
- okamiueru 5y agohttps://sneak.berlin/20201112/your-computer-isnt-yours/ https://sneak.berlin/20201112/your-computer-isnt-yours/
- lawnchair_larry 5y ago
- maccard 5y agoThe problem is the cheats use kernel drivers so the anti cheat providers have to to keep up. Edit: rather than downvoting can someone offer a reason as to why?
- Bancakes 5y agoBecause human moderation after an AI serverside filter is much more consistent and less desperate than solving the halting problem clientside 2 rings below your app's privilege level.
- maccard 5y agoCan you give an example of some games that take that approach that it works for? I'd also suggest that human moderation is definitely less consistent, and definitely less able to scale. Nobody is trying to solve the halting problem in the kernel either. If a cheat runs as a kernel level driver, and anticheat doesnt you've lost the battle already.
- Bancakes 5y agoCSGO and Overwatch come to mind. I watch a talk on the latter, how the devs transitioned and optimised their anticheat system. It makes sense the cheat I wrote would run as admin. It's my PC after all. I also don't have access to the server in any meaningful way and modify other people's data, either. It's a good trade-off. Devs can also write arbitrarily good statistical analyses for the game. It's their responsibility. The question is simple - is this person performing abnormally? Well, games gather tons of telemetry nowadays, and the harder-to-detect cheats like wallhacks or fluorescent player textures are also the least useful. I am a hard silver I in CSGO. With or without aids, when I see someone run around the corner, I'll duck and magdump. Any gold nova will overpower me either way.
- DizzyDoo 5y agoI do think you're correct, but one particularly sticky issue is what you do with all the subtle cheats. Rather than developing an exploit with wall-clip, radar, auto-headshots and so on - all obvious to a human moderator - what if you make one that just lowers recoil by a smidgen, 20% or so. If you're watching the game as a moderator you could never tell that's what's happening. Yet -20% recoil, especially for a competitive esports player, would be such a massive advantage as to make that player the best in the world, but a way that looks quite legitimate.
- meibo 5y agoIt also just keeps happening. A recent game(Genshin Impact) shipped with an Anti-Cheat driver that had unauthenticated read/write primitives via IPC for debugging and it's been abused since. It's a security theater.
- ryukafalz 5y agoWhoa, that's a really scary example that would be great to point people to to show why this stuff is so bad. Can you link to more info about this?
- canadianfella 5y ago> It's a security theater. Security theatre. Not a theatre.
- gene91 5y agoCan Microsoft revoke their signatures on kernel drivers? If so, why haven't they revoked Genshin Impact's anti-cheat driver now that it has been proven to be a vulnerability? Is there a technical reason, or purely business?
- aneutron 5y agoIt's a very difficult problem to solve. Once you sign something, it's by design impossible to repudiate that signature. That in turn means you need some other way of "revoking" or "repudiating" that signature. In the case of TLS for example, it's a certificate revocation list. I don't know if there's such a mechanism on Windows Kernel.
- wrren 5y agoLiterally no part of this comment is true. They’re not hidden and they’re not malicious. They’re also very much required, because a user mode anti-cheat is trivially circumvented by a kernel mode cheat. The only way to defeat cheats is to wage continuous war with them, adapting to their tactics and stamping them out. It’s like collecting trash; trash will keep accumulating, your goal is to keep homes and streets clean in spite of that.
- ithinkso 5y agoEvery part of that comment was true. They are rootkits with a non-hidden persona, they are not malicious unless it's worth being malicious. I don't give trash collectors access to my bank account so that they can better estimate the amount of plastic I'm about to produce and better prepare themselves to make streets even cleaner
- Spivak 5y agoThat’s such a weird point when people to complain about bots and cheaters in games a lot. It almost killed Fall Guys because games stopped being fun.
- nsgi 5y agoOr just accept the fact that you'll never completely stop people cheating? Have your server prevent obvious cheaters but maybe people should just accept that the only way to avoid people cheating against them is to only play with people they trust
- zdkl 5y agoThat wipes out any trust in public rankings and some very big games are entirely built around those. Not going to happen while competition is a major income source.
- feu 5y agoThat completely destroys a whole class of games. How do you suggest I get 60 of my friends together at once for a game of Apex Legends? You'll never completely stop people cheating, but that doesn't mean that game developers should just give up. Thankfully the people clamouring for less, rather than more, anticheat is relegated to a vocal minority.
- swiley 5y agoWill we admit yet that having OS vendors sign software does nothing to stop malware?
- jon-wood 5y agoAs with all security mitigations it does something, it’s significantly more difficult to get kernel level malware installed now than in the Win95 days, but it’s not a cast iron guarantee nothing bad will ever happen again.
- heresie-dabord 5y agoSigning is a useful measure. But not by itself. There are several harder admissions to be made. The security business is very lucrative ambulance-chasing. A business-grade OS needs high-confidence evaluation and design. mWindows cannot be safe while being all things to all users, with backward-compatability extending three decades. It may be time to split the product into more than just artificial marketing tiers. Rewrite the OS in a safer language. I won't pick one, but Microsoft is large and sufficiently profitable to know what to do and how to do it. mWindows 11 should not just be a change of curtains and doilies.
- elisaado 5y agoI think it doesn't stop malware completely, that's impossible, but if you look at the Apple ecosystem you can see that it does help, a lot.
- swiley 5y agoIt barely helps at all (almost all your apps are pulling in telemtry/auth libraries from data brokers regardless of the permissions you give them) and the cost (no more personal computing.) is incredible.
- tgsovlerkhgsel 5y agoIt's a significant hurdle, especially if getting something signed requires some kind of certification process and company identity verification. It also ensures that the OS vendor has a copy of the binary (although it will only be the first stage, I assume). Without signing, attackers can push malware onto one machine without anyone else getting a copy.
- oefrha 5y ago> Notably, the C2 IP 110.42.4.180 that the malicious Netfilter driver connects to belonged to Ningbo Zhuo Zhi Innovation Network Technology Co., Ltd, according to WHOIS records. > The U.S. Department of Defense (DoD) has previously marked this organization as a "Communist Chinese military company," another researcher @cowonaut observed. Tried to check the claim, which links to http://www.defense.gov/Newsroom/Releases/Release/Article/2472464/dod-releases-list-of-additional-companies-in-accordance-with-section-1237-of-fy/ http://www.defense.gov/Newsroom/Releases/Release/Article/247.... There are four short PDFs linked there, and I couldn't find the company in any of the lists. Tried to check historical versions on Internet Archive, still couldn't find anything, but admittedly I only looked briefly. "site:defense.gov Ningbo Zhuo Zhi" turned up nothing on Google. Now, WHOIS record points to nbgaofang.com, which claims to be a cloud provider specializing in DDoS protection, so a Cloudflare of sort. Do reporters actually read what they link? Do they intentionally report “juicy” bs with sham links that don’t support the bs, knowing full well that few readers would try to verify sources?
- throw0101a 5y agoThese are the US trademarks for "Ningbo Zhuozhi Innovation Network Technology Co.,Ltd." (one less space): * https://uspto.report/company/Ningbo-Zhuozhi-Innovation-Network-Technology-Co-L-T-D https://uspto.report/company/Ningbo-Zhuozhi-Innovation-Netwo... There may be something lost in transliteration, or the DoD may have listed the parent (holding) company.
- oefrha 5y agoSure, there’s nothing for one less space either, or anything close. > or the DoD may have listed the parent (holding) company Like which one? I think it’s the reporter’s job to find out. Posting a link implying something’s there when there’s actually nothing is garbage reporting at best and malicious at worst. Here's a more likely explanation though. The "security researcher" quoted saw AS56041 China Mobile communications corporation in WHOIS, which is actually listed by DoD, rather than the aforementioned company. However, that's just the backbone provider; attributing based on that is kind of like attributing a U.S. C2 server to Hurricane Electric. The "security researcher" should probably stay away from the attribution game if they can't recognize backbone providers.
- sigmoid10 5y agoWait a second. According to the article, the only weird thing the driver does is sending some CPU info telemetry and automatically checking for updates. By that standard, nearly every piece of gaming software that releases nowadays is malware. "Ningbo Zhuo Zhi Innovation Network Technology" is also not on the current DOD list of Communist Chinese military companies. The whois record for the given ip doesn't even link to this company, it's a protected record under some Chinese telecorp. Who wrote this garbage? This seems like a cheap attempt to generate outrage.
- swiley 5y ago>every piece of gaming software that releases nowadays is malware Yes.
- tgv 5y agoA kernel driver can patch anything on your system. It's not the same as an auto-updating game.
- sigmoid10 5y agoI'm not talking about games. I was referring to the typical gaming software in form of GPU or input hardware drivers. Nvidia for example bundles a shitton of telemetry services with their drivers, as does logitech with their keyboard drivers.
- judge2020 5y agoLooks like this is a booter and it hooks into network traffic https://twitter.com/gossithedog/status/1407328596247646217?s=21 https://twitter.com/gossithedog/status/1407328596247646217?s...
- aj3 5y agoThis malware registers system wide proxy and redirects certain traffic on IP level. It also registers it's own CA certificate making TLS MITM possible. Finally it has auto-update functionality which could be used to push different malware to selected users.
- ogurechny 5y agoThis article is certainly low quality, it rehashes existing media stereotypes (something bad happened, and naughty China is behind it) instead of making things clear. Obvious questions (What game or other software bundled the driver? Was it made by the same company that signed the code? What runs on the servers from the redirected addresses list?) are not even mentioned. If the narrative is that Chinese hackers tricked the impregnable systems of Microsoft, then it falls apart after learning, say, how many times official drivers from Intel and the likes were found to have privilege escalation functionality. Also, we are supposed to be happy when it's official western corporate rootkits that collect all system information they want, and share it with who knows which organizations, or when Microsoft itself does it.
- ilamont 5y agoMicrosoft has refrained from attributing this incident to nation-state actors just yet. They can always blame "accidental human error." https://www.bbc.com/news/world-asia-57367100 https://www.bbc.com/news/world-asia-57367100
- realmod 5y agoIf we think rationally, why would a nation state put in effort to block ONE single search term to hinder information spread while still letting multiple other queries give the same results? There is zero to gain from that.
- tyingq 5y agoSounds similar to the AMD "PCI Driver": https://news.ycombinator.com/item?id=27171520 https://news.ycombinator.com/item?id=27171520 Well, perhaps for less shady purposes, but still very misleading.
- nomoreplease 5y agoThe details in the article are much worse than the headline suggests.
- deleted 5y ago[deleted]
- TheRealPomax 5y agoSo what are the legal ramifications? Because that's really the only interesting thing here? (A list of affected products would also be good, but that's not interesting, that'd kind of the bare minimum)
- deleted 5y ago[deleted]
- ineedasername 5y agoWhere does the driver come from, in the supply chain? I mean, is it the game devs that put it in? Is it the anti-cheat software they buy from a vendor? If so, who develops that and how did the driver get into it? It would be good to know at what stage it was injected.
- deleted 5y ago[deleted]
- andrecarini 5y agoWhat's the reasoning behind not disclosing the list of games affected?
- andrecarini 5y agoEdit: after getting in touch with Joshua, behind Echo, the original evidence on Twitter by Kevin Beaumont has been retracted [0] and Joshua claims that Echo is not related to the rootkit in question. Edit 2: Some further clarifications about Echo from Joshua: "We also don't just give untethered access, it's a scan which does specific things and doesn't have any malicious capabilities from the staff member on the player. How it works is cheats leave traces behind, Echo is almost a forensic analysis to see if cheats were on that PC. For example, any executable on windows that resolves a domain has strings in the Dnscache service, or any process that makes requests to cheat servers will leave the domain as strings in lsass.exe (which is can be PPL and can require kernel to read from). We use the driver and strong obfuscation to prevent cheat developers (known to be good reverse engineers) from being able to just clear these traces." [0] https://twitter.com/GossiTheDog/status/1408900596145569795 https://twitter.com/GossiTheDog/status/1408900596145569795 Piecing together info scattered across disclosures [1] and tweets [2], it seems the malware is related to Echo [3], a product marketed for Minecraft server owners that allegedly helps in detecting cheaters. From what I understand, suspected cheaters are requested by the server staff to download and install the Echo client, which shares the player's screen [4] with the admins and apparently gives full, unrestricted OS access. I've tried to get in touch with the people allegedly behind Echo [5] [6] for clarification, and I'll update this once I get more info. [1] https://www.gdatasoftware.com/blog/microsoft-signed-a-malicious-netfilter-rootkit https://www.gdatasoftware.com/blog/microsoft-signed-a-malici... [2] https://twitter.com/GossiTheDog/status/1407328596247646217 https://twitter.com/GossiTheDog/status/1407328596247646217 [3] https://echo.ac https://echo.ac [4] https://www.reddit.com/r/screensharing/ https://www.reddit.com/r/screensharing/ [5] https://find-and-update.company-information.service.gov.uk/company/13017981/officers https://find-and-update.company-information.service.gov.uk/c... [6] https://discord.gg/mGTTAT5 https://discord.gg/mGTTAT5
- swiley 5y ago>From what I understand, suspected cheaters are requested by the server staff to download and install the Echo client, which shares the player's screen [4] with the admins and apparently gives full, unrestricted OS access. Downloading and running software like that from someone you met on a game server is incredibly stupid. I know multiple people who have gotten rootkits and lost control of important accounts this way.
- FounderBurr 5y agoThe driver is signed with the certificate of the developer, an EV certificate at that. The “Microsoft signature” is just an attestation signature and does not indicate the software is from Microsoft. Every driver that runs on Windows 7+ is required to be signed this way via the Microsoft portal. Why the article seems to go out of its way to not mention the name of the certificate used to sign the driver first is strange. They also fail to mention that this cross signature gives Microsoft the power to revoke the validity of the driver or every driver signed with the developers certificate. Again this may not have fit into the crafted narrative they are providing.
- judge2020 5y agoThe issue it seems is that MS dropped the requirement that drivers must also be signed by the developer’s own EV certificate - it seems developers can get binaries signed without that, which means only MS knows which company is the one that signed a specific program/driver in this configuration. https://twitter.com/gossithedog/status/1405976566694395906?s=21 https://twitter.com/gossithedog/status/1405976566694395906?s...
- FounderBurr 5y agoWow that’s a huge WTF on Microsoft’s part. Why drop the only component of signing that actually identifies the author?!