4 ms·

It also just keeps happening. A recent game(Genshin Impact) shipped with an Anti-Cheat driver that had unauthenticated read/write primitives via IPC for debuggi

by meibo 5y ago

It also just keeps happening. A recent game(Genshin Impact) shipped with an Anti-Cheat driver that had unauthenticated read/write primitives via IPC for debugging and it's been abused since. It's a security theater.

ryukafalz 5y ago
Whoa, that's a really scary example that would be great to point people to to show why this stuff is so bad. Can you link to more info about this?
- meibo 5y ago
  Here's a PoC for it on GitHub, you can read the code, it's pretty much just an IOCTL for each operation. Check Driver/MhyProt2.cs. https://github.com/kagurazakasanae/Mhyprot2DrvControl https://github.com/kagurazakasanae/Mhyprot2DrvControl
  - ryukafalz 5y ago
    Yikes! Thank you!
canadianfella 5y ago
> It's a security theater. Security theatre. Not a theatre.
gene91 5y ago
Can Microsoft revoke their signatures on kernel drivers? If so, why haven't they revoked Genshin Impact's anti-cheat driver now that it has been proven to be a vulnerability? Is there a technical reason, or purely business?
- aneutron 5y ago
  It's a very difficult problem to solve. Once you sign something, it's by design impossible to repudiate that signature. That in turn means you need some other way of "revoking" or "repudiating" that signature. In the case of TLS for example, it's a certificate revocation list. I don't know if there's such a mechanism on Windows Kernel.