Of course they do. They regularly sign anti-cheat programs which are rootkits, so it’s not even an uncommon occurrance. Being a rootkit is insufficient to flag a program as malicious.
Microsoft have signed multiple rootkits
21–29 of 29 posts
Re: Microsoft have signed multiple rootkits
#22Less likely Microsoft has signed multiple rootkits and more likely that someone has either stolen the certificate, they have someone at Microsoft signing the malware for them or they have found a vulnerability in the signing process imo.
Not necessarily. Driver QA & signing is not malware exorcising magic. If you are a genuine hardware vendor, giving them an actual, working driver binary so they can run whatever QA and static static analysis test suite on the binary, you might have the benefit of a doubt and get it signed once it passes. That assumption of good faith mixed with "Betriebsblindheit" is probably all it takes to get a signed driver with…
Perhaps it should be mentioned that drivers are halfway to a rootkit even when not being malicious. A driver has (and often needs) access to all apps' memory for example.
Re: Microsoft have signed multiple rootkits
#23I’m sure Apple has/will do similar. Isn’t the point of the cert not so much to vet the recipient but to create cost (including nonmonetary) to attain the cert and then have the ability to rapidly revoke the cert and nullify the malware installed base?
Even if Microsoft makes some pretense of vetting, no one can ever perfectly weed out malware authors in advance, as that would require knowledge of their future thoughts and motivations (hard enough to assess those in the present).
(If Microsoft has failed to revoke certs for known rootkits, by all means bash them hard for that.)
Re: Microsoft have signed multiple rootkits
#24I wonder what would happen if Microsoft required drivers to be redistributable at least by Microsoft and hosted them on a server for download by independent researchers, similar to how fwupd is doing it. Then the researchers could find ways to identify malware and point it out to Microsoft. As a bonus it might make the life of fwupd easier too.
> researchers could find ways to identify malware
Perhaps OS developers should move to a validation system something like FCC has (i.e. to check for allowed electromagnetic interference) that requires analysis and certification by a third party of the driver before it gets signed and rolled-out.
Re: Microsoft have signed multiple rootkits
#25Looks like a signed driver, it’s not particularly hard to turn any driver into a rootkit especially a networking one. If you manage to say install npcap on a machine which is also signed these days you can pretty much capture the entire network traffic and send it w/e you want… heck both the capturing and the “sending” can be done from within the npcap driver itself since it can both capture and send packages the log…
Our experience in the Web PKI is pretty stark. Assuming well-meaning, basically competent people, all you can hope for is that they can enforce some simple easy-to-follow rules and you will need to check their work to keep them on the straight and narrow. To the extent they screw up and you miss it, the screw-ups will continue, to the extent the rules are too hard for them to follow they just won't. But I don't see h…
Then why not use an open source OS with generic drivers which are available in source code and can be inspected, and even build in an exactly reproducible way with a system like GNU Guix?
Re: Microsoft have signed multiple rootkits
#26Looks like a signed driver, it’s not particularly hard to turn any driver into a rootkit especially a networking one. If you manage to say install npcap on a machine which is also signed these days you can pretty much capture the entire network traffic and send it w/e you want… heck both the capturing and the “sending” can be done from within the npcap driver itself since it can both capture and send packages the log…
Our experience in the Web PKI is pretty stark. Assuming well-meaning, basically competent people, all you can hope for is that they can enforce some simple easy-to-follow rules and you will need to check their work to keep them on the straight and narrow. To the extent they screw up and you miss it, the screw-ups will continue, to the extent the rules are too hard for them to follow they just won't. But I don't see h…
> the practical alternative, which you should indeed prefer in real life, is Class Drivers
Class drivers are great, but they require devices to comply with standards, which are usually not very accommodating of whatever new bells and whistles manufacturers want to add. Putting RGB lighting on literally everything, for example, was not really considered when the standards were written.
Re: Microsoft have signed multiple rootkits
#27Looks like a signed driver, it’s not particularly hard to turn any driver into a rootkit especially a networking one. If you manage to say install npcap on a machine which is also signed these days you can pretty much capture the entire network traffic and send it w/e you want… heck both the capturing and the “sending” can be done from within the npcap driver itself since it can both capture and send packages the log…
A catalog file (.cat) has a bunch of file hashes (think file identities) in it. Signing that means indirectly signing all of those files. Signature validation means checking an embedded signature if it exists, then looking for the hash in the installed .cat files and, if found, checking that signature. Authenticode signatures like this are PKI-based. They can be revoked if determined not to be valid later.
I think the issue with the Win10 model is that the signature on any PE files is independent so one can use it for some bypass outside of the process of installing a driver. That said WHQL/WHLK signatures aren’t useful for bypassing things like smartscreen and do require an additional EV code signing cert to identify the publisher for that.
Which again at large scale isn’t probably hard to get.
Re: Microsoft have signed multiple rootkits
#28By the way, this is the equivalent of smuggling malicious source code into the Linux kernel. Look what worked better, security-wise.
Re: Microsoft have signed multiple rootkits
#29Earlier quoted context omitted.
Our experience in the Web PKI is pretty stark. Assuming well-meaning, basically competent people, all you can hope for is that they can enforce some simple easy-to-follow rules and you will need to check their work to keep them on the straight and narrow. To the extent they screw up and you miss it, the screw-ups will continue, to the extent the rules are too hard for them to follow they just won't. But I don't see h…
> the practical alternative, which you should indeed prefer in real life, is Class Drivers Class drivers are great, but they require devices to comply with standards, which are usually not very accommodating of whatever new bells and whistles manufacturers want to add. Putting RGB lighting on literally everything, for example, was not really considered when the standards were written.
RGB doesn't really need kernel-level drivers.