4 ms·

Ransomware Actor Abuses Genshin Impact Anti-Cheat Driver to Kill Antivirus

55 points by kevingadd 4y ago

ronsor 4y ago
I'm honestly surprised it took this long. Beware of "anti-cheat" drivers that often poke more holes than they plug.
- hulitu 4y ago
  "Running complex programs with network access with system priviledges is a good idea" /s People never learn. They don't have time for this.
- smileybarry 4y ago
  I wouldn't even call it "anti-cheat". It's a (online) single-player game with co-op challenges. There's no PvP, leaderboards, joint loot, nothing. "Cheating" would just involve unlocking characters or faking damage. It's more akin to SecuROM and co. than BattlEye, in a way. (You can't OpenProcess(...) the game EXE) But either way it's completely useless and unnecessary.
  - alexvoda 4y ago
    In other words it is just defective by design Digital Restrictions Management.
- donkarma 4y ago
  you need administrator privileges to load a driver anyways, you're fucked if malware has admin permissions
- josephcsible 4y ago
  > I'm honestly surprised it took this long. It didn't take this long, though. This kind of thing happens all the time. Here it is happening to the same game back in 2020: https://github.com/Luohuayu/evil-mhyprot-cli https://github.com/Luohuayu/evil-mhyprot-cli
ChoGGi 4y ago
For those that don't RTA; you don't need the game installed. The malware authors are making use of a signed .sys file.
mcraiha 4y ago
I don't understand why the driver is code signed for so long time. AFAIK Genshin Impact receives updates at least once per month and it is always online game. So why don't they limit the drivers lifetime to e.g. 6 months?
- smileybarry 4y ago
  Sadly, it's not even some vulnerable previous version, AFAIK the current driver is the same version. It's a mess, and I'm frankly annoyed it hasn't been blacklisted by now.
upupandup 4y ago
is PunkBuster safe?
LorenPechtel 4y ago
Things like this shouldn't require the company to revoke the certificate. The issuing authority should nuke it. Yes, that would kill the game (and perhaps other stuff) until they fix the problem--their flaw, they have to live with the consequences. It would be an incentive to be more careful next time.

55 points by kevingadd 4y ago

ronsor 4y ago

I'm honestly surprised it took this long. Beware of "anti-cheat" drivers that often poke more holes than they plug.

hulitu 4y ago
"Running complex programs with network access with system priviledges is a good idea" /s People never learn. They don't have time for this.
smileybarry 4y ago
I wouldn't even call it "anti-cheat". It's a (online) single-player game with co-op challenges. There's no PvP, leaderboards, joint loot, nothing. "Cheating" would just involve unlocking characters or faking damage. It's more akin to SecuROM and co. than BattlEye, in a way. (You can't OpenProcess(...) the game EXE) But either way it's completely useless and unnecessary.
- alexvoda 4y ago
  In other words it is just defective by design Digital Restrictions Management.
donkarma 4y ago
you need administrator privileges to load a driver anyways, you're fucked if malware has admin permissions
josephcsible 4y ago
> I'm honestly surprised it took this long. It didn't take this long, though. This kind of thing happens all the time. Here it is happening to the same game back in 2020: https://github.com/Luohuayu/evil-mhyprot-cli https://github.com/Luohuayu/evil-mhyprot-cli

ChoGGi 4y ago

For those that don't RTA; you don't need the game installed. The malware authors are making use of a signed .sys file.

mcraiha 4y ago

I don't understand why the driver is code signed for so long time. AFAIK Genshin Impact receives updates at least once per month and it is always online game. So why don't they limit the drivers lifetime to e.g. 6 months?

smileybarry 4y ago
Sadly, it's not even some vulnerable previous version, AFAIK the current driver is the same version. It's a mess, and I'm frankly annoyed it hasn't been blacklisted by now.

upupandup 4y ago

is PunkBuster safe?

LorenPechtel 4y ago

Things like this shouldn't require the company to revoke the certificate. The issuing authority should nuke it. Yes, that would kill the game (and perhaps other stuff) until they fix the problem--their flaw, they have to live with the consequences. It would be an incentive to be more careful next time.