Microsoft accidentally signed a malware-rigged driver targeting gamers

Responding to what first appeared to be a false positive, cybersecurity researchers caught hold of a malicious driver that was officially signed by Microsoft.

Karsten Hahn, a malware analyst with security vendor G Data blogged about Microsoft’s faux pas, while sharing his observations about the driver’s malicious activities.

Analysis revealed that the driver, named Netfilter, was in fact a rootkit that redirected traffic to Chinese command and control (C&C) servers.

TechRadar needs you!

We're looking at how our readers use VPNs with streaming sites like Netflix so we can improve our content and offer better advice. This survey won't take more than 60 seconds of your time, and you can also choose to enter the prize draw to win a $100 Amazon voucher or one of five 1-year ExpressVPN subscriptions.

>> Click here to start the survey in a new window <<

“Last week our alert system notified us of a possible false positive because we detected a driver named 'Netfilter' that was signed by Microsoft…In this case the detection was a true positive, so we forwarded our findings to Microsoft who promptly added malware signatures to Windows Defender and are now conducting an internal investigation,” wrote Hahn.

Malicious driver

Hahn explains that, since the launch of Windows Vista, all code that runs in the kernel space needs to be tested and signed by Microsoft. Simply put, any driver that doesn’t bear the official seal of approval from Microsoft cannot be installed “by default.” 

As per Hahn’s analysis, the Netfilter driver was flagged because it didn’t appear to provide any “legitimate functionality” and was exhibiting non-normal behavior by communicating with China-based C&C IPs.

According to Bleeping Computer, Microsoft has confirmed it accidentally signed the malicious driver, which is being distributed within gaming environments.

Software supply chain threat

Hahn states that Microsoft is actively investigating how the driver managed to pass the signing process.

Bleeping Computer adds that the software giant hasn’t found evidence that the driver was signed by stolen code-signing certificates. This would seem to suggest the malicious actor got the seal of approval following due process. 

This is an even more worrying prospect, as it points to chinks in Microsoft’s driver signing process that might have been exploited to poison the software supply chain, with potential ramifications for businesses of all sizes.



from TechRadar - All the latest technology news https://ift.tt/35UOgr5
Share:

No comments:

Post a Comment

Categories

Rove Reviews Youtube Channel

  1. Subscribe to our youtube channel
  2. Like our videos and share them too.
  3. Our youtube channel name Rove reviews.

WITNUX

This website is made by Witnux LLC. This website provides you with all the news feeds related to technology from large tech media industries like GSM Arena, NDTV, Gadgets 360, Firstpost and many other such ates altogether at technical depicts so that you need not go to several sites to view their post provide you advantantage of time.

From the developer
Tanzeel Sarwar

OUR OTHER NETWORKS

OUR YOUTUBE CHANNEL

ROVE REVIEWS PLEASE SUBSCRIBE

OUR FACEBOOK PAGE

The Rove Reviews

Support

Trying our best to provide you the best DONATE or SUPPORTour site Contact me with details how are you gonna help us