3 ms·

Interesting. What I don't get from this analysis or the one by Symantec is how this rootkit is able to install kernel drivers on 64-bit Windows with driver sign

Interesting. What I don't get from this analysis or the one by Symantec is how this rootkit is able to install kernel drivers on 64-bit Windows with driver signing enabled. Is this using a new vulnerability to do so? An existing one? Did the GCHQ/NSA managed to get their hands on the keys necessary to sign Windows drivers? Each scenario has implications for code signing as a security technique...

dmix 12y ago
With DUQU and Stuxnet, the agencies had stolen the signing cert from Taiwanese businesses. Duqu = stolen from https://en.wikipedia.org/wiki/C-Media https://en.wikipedia.org/wiki/C-Media Stuxnet = stolen from https://en.wikipedia.org/wiki/Realtek https://en.wikipedia.org/wiki/Realtek Not hard to find a valid cert when you're a nation state. Source: https://firstlook.org/theintercept/2014/11/12/stuxnet/ https://firstlook.org/theintercept/2014/11/12/stuxnet/
- nullc 12y ago
  "stolen"
  - dmix 12y ago
    Are you suggesting they were acquired by other means?
iresa 12y ago
It's well established that there are links between the most important IT companies and the gov't. Why the surprise?
throwawayaway 12y ago
> Symantec is how this rootkit is able to install kernel drivers on 64-bit Windows with driver signing enabled. if you read the symantec pdf whitepaper, that is only how the 32 bit one works, the 64bit one works differently - something to do with winsock.