5 ms·
LOLDrivers – Living Off the Land Drivers
- vuln 4y agoNice! LolBAS and gtfobins are great projects. I’ve used both extensively. I can’t wait until Monday to start running this against my environment. Down the rabbit hole I go at 4pm on a Friday! Appreciate the hard work.
- SCHiM 4y agoThis is a webpage collecting a list of (signed?) drivers that may be loaded into the Windows kernel and thereby escalate privileges. Because the Windows kernel doesn't support loading drivers that are not signed by Microsoft, attackers have to resort to exploiting legitimate signed drivers to gain access to the kernel once they've obtained Administrator (root) or SYSTEM (root) privileges. A central list of exploitable drivers serves as a starting point for both attackers and defenders. Attackers can use it for their research if they want to raise their privileges by loading code into the kernel (rootkits), or attack protected processes (PPL and up, think anti-virus and anti-malware processes, DRM). For defenders it serves as a curated list of drivers to look out for in their environment. For example, to raise alerts if a Lenovo driver is loaded on a Dell system. A similar site is the LolBAS site, where signed Windows binaries are listed for their ability to serve as trusted "proxy" executables into which attackers can somehow inject or load their code.
- deleted 4y ago[deleted]
- deleted 4y ago[deleted]
- 0x69420 4y agoi'm not really a security guy but... is ibm poland ok? that's one hell of an outlier
- colinsane 4y agowhat does the name mean (“Living Off the Land”)? i expected some homesteading tools or something — does the phrase have some history in the security world?
- ghostpepper 4y agoIt means essentially that. The alternative is an attacker bringing/installing their own tools post-compromise. Living off the land is more stealthy because you’re using legitimate system tools to do malicious activities
- deleted 4y ago[deleted]
- jabroni_salad 4y agoLOTL means that the adversary is using tools already present on that computer instead of trying to download even more malware. This strategy is popular because not writing any files makes you immune to filescanners.
- teeray 4y agoI honestly thought this was going to be a forum for big rig truckers that also hunted and trapped their own food or something.
- tmtvl 4y agoI was also expecting something like survivalists who live in their pickup truck or something.
- defrost 4y agoI figured HN had discovered indigenous bush mechanics. Anybody living off the land should know how to replace a blown tire with a wired in hard wood tree branch skid. https://en.wikipedia.org/wiki/Bush_Mechanics https://en.wikipedia.org/wiki/Bush_Mechanics https://www.youtube.com/watch?v=cDeHI3fOlzo https://www.youtube.com/watch?v=cDeHI3fOlzo
- ronsor 4y agoAh yes, the venerable MHYProt is included in the list. I do love gaming anticheats; they make loading cheats so easy.
- jmholla 4y agoIf the designer of the page is here, I'd like to recommend using different colors for your pie chart and bar graph. Using the same color implies they are related, especially when there is only one key. Also, the orange box that says top publishers on top of the bar graph is confusing, and unnecessary. It is a toggle to turn things off, but it just turns off all the data on the chart. And, I have no idea what the color orange and Top Publishers have to do with each other. This is on Firefox. Not sure if it's different on Chrome.
- jeroenhd 4y agoIt's so silly that Microsoft set up this elaborate, expensive signature scheme and then doesn't use the scheme to protect its customers. I'd much prefer known vulnerable drivers to be blacklisted a while after vulnerabilities become known, or to prevent disruption to users, have Microsoft regularly remind users that "Hardware Product by Hardware Company is making your computer unsafe". Hardware companies and their terrible drivers should either fix their vulnerable software or have their problems exposed to their users. Either that or the mandatory driver signature verification feature should be disabled. Now they're restricting user freedom without any of the theoretical benefits.
- olliej 4y agoThis was very much not what I thought it was going to be. Don’t get me wrong the page is interesting, but I was much more curious about how this subculture of truckers, etc were harvesting food and what not as they drove across the US :D