3 ms·

iVentoy installing unsafe Windows Kernel drivers?

15 points by _a8di 1y ago

_a8di 1y ago
(I am not the person who found it, but I reproduced and I confirm his finding) Another source: https://security.stackexchange.com/questions/281238/iventoy-installing-unsafe-windows-kernel-drivers-why-is-this-happening https://security.stackexchange.com/questions/281238/iventoy-...
deleted 1y ago
[deleted]
_a8di 1y ago
Up to now, I confirm I can reproduce the following steps: - download of official "iventoy-1.0.20-win64-free.zip" - extraction of "iventoy.dat" - conversion back to "iventoy.dat.xz" thanks to @ppatpat's Python code - confirm that "wintool.tar.xz" is recognized by VirusTotal as something that injects fake root certificates The next steps are scary, given the popularity of Ventoy/iVentoy : > Analyzing "iventoy.dat.xz\iventoy.dat.\win\vtoypxe64.exe" we see it includes a self signed certificate named "EV" certificate "JemmyLoveJenny EV Root CA0" at offset=0x0002C840 length=0x70E. > vtoypxe64.exe programmatically installs this certificate in the registry as a "trusted root certificate"
- Maxious 1y ago
  JemmyLoveJenny still lives! https://www.bleepingcomputer.com/news/security/hackers-exploit-windows-policy-to-load-malicious-kernel-drivers/ https://www.bleepingcomputer.com/news/security/hackers-explo...
  - _a8di 1y ago
    Playing devil's advocate, could it be that they require a temporary access to a customized Windows driver (and thus they fake a trusted root certificate) to make Ventoy work? If that's the case, they should have documented it properly in the source... Or do you think it's 100% malicious?
    - ziml77 1y ago
      This year old issue regarding blobs in the repo with a ton of replies has not gotten responses from the author https://github.com/ventoy/Ventoy/issues/2795 https://github.com/ventoy/Ventoy/issues/2795 Doesn't mean for sure it's malicious but them not even explaining why there's blobs like this is very suspicious.
    - Maxious 1y ago
      I think regardless of intent, it is a security vulnerability to install these ring 0 loopholes. Microsoft is cracking down on RGB lighting and anticheat software drivers similarly
sn0n 1y ago
So... If I use ventoy should I worry? *Starts looking for alternatives just cuz*
- out-of-ideas 1y ago
  isnt iventoy different than ventoy? also check if your system has the reg key listed in the issue there's always https://www.supergrubdisk.org/super-grub2-disk/ https://www.supergrubdisk.org/super-grub2-disk/ and finally, if you are really concerned and dont want to re-install, you can always take export the registry key of your root certs of a ventoy installed system and compare against a system not loaded with ventoy edit: can also use systemd to boot iso's (among many other things)

15 points by _a8di 1y ago

(I am not the person who found it, but I reproduced and I confirm his finding) Another source: https://security.stackexchange.com/questions/281238/iventoy-installing-unsafe-windows-kernel-drivers-why-is-this-happening https://security.stackexchange.com/questions/281238/iventoy-...

deleted 1y ago

[deleted]

_a8di 1y ago

Up to now, I confirm I can reproduce the following steps: - download of official "iventoy-1.0.20-win64-free.zip" - extraction of "iventoy.dat" - conversion back to "iventoy.dat.xz" thanks to @ppatpat's Python code - confirm that "wintool.tar.xz" is recognized by VirusTotal as something that injects fake root certificates The next steps are scary, given the popularity of Ventoy/iVentoy : > Analyzing "iventoy.dat.xz\iventoy.dat.\win\vtoypxe64.exe" we see it includes a self signed certificate named "EV" certificate "JemmyLoveJenny EV Root CA0" at offset=0x0002C840 length=0x70E. > vtoypxe64.exe programmatically installs this certificate in the registry as a "trusted root certificate"

Maxious 1y ago
JemmyLoveJenny still lives! https://www.bleepingcomputer.com/news/security/hackers-exploit-windows-policy-to-load-malicious-kernel-drivers/ https://www.bleepingcomputer.com/news/security/hackers-explo...
- _a8di 1y ago
  Playing devil's advocate, could it be that they require a temporary access to a customized Windows driver (and thus they fake a trusted root certificate) to make Ventoy work? If that's the case, they should have documented it properly in the source... Or do you think it's 100% malicious?
  - ziml77 1y ago
    This year old issue regarding blobs in the repo with a ton of replies has not gotten responses from the author https://github.com/ventoy/Ventoy/issues/2795 https://github.com/ventoy/Ventoy/issues/2795 Doesn't mean for sure it's malicious but them not even explaining why there's blobs like this is very suspicious.
  - Maxious 1y ago
    I think regardless of intent, it is a security vulnerability to install these ring 0 loopholes. Microsoft is cracking down on RGB lighting and anticheat software drivers similarly

sn0n 1y ago

So... If I use ventoy should I worry? *Starts looking for alternatives just cuz*

out-of-ideas 1y ago
isnt iventoy different than ventoy? also check if your system has the reg key listed in the issue there's always https://www.supergrubdisk.org/super-grub2-disk/ https://www.supergrubdisk.org/super-grub2-disk/ and finally, if you are really concerned and dont want to re-install, you can always take export the registry key of your root certs of a ventoy installed system and compare against a system not loaded with ventoy edit: can also use systemd to boot iso's (among many other things)