Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft have signed multiple rootkits

twitter.com

Post reply on HN
Print view View original

11–20 of 29 posts

Re: Microsoft have signed multiple rootkits

#11

Post by qzw »

dogma1138 wrote: post #7

Looks like a signed driver, it’s not particularly hard to turn any driver into a rootkit especially a networking one. If you manage to say install npcap on a machine which is also signed these days you can pretty much capture the entire network traffic and send it w/e you want… heck both the capturing and the “sending” can be done from within the npcap driver itself since it can both capture and send packages the log…

Looking at the VirusTotal results in the Twitter thread, all but one of the rootkits were actually detected by Microsoft's own anti-virus engine. I think Microsoft should consider running the submissions for driver signing through their anti-virus scanner (or even better, VirusTotal). Won't catch everything, of course, but it's pretty low hanging fruit.

Re: Microsoft have signed multiple rootkits

#14

Post by tialaramex »

dogma1138 wrote: post #7

Looks like a signed driver, it’s not particularly hard to turn any driver into a rootkit especially a networking one. If you manage to say install npcap on a machine which is also signed these days you can pretty much capture the entire network traffic and send it w/e you want… heck both the capturing and the “sending” can be done from within the npcap driver itself since it can both capture and send packages the log…

Our experience in the Web PKI is pretty stark. Assuming well-meaning, basically competent people, all you can hope for is that they can enforce some simple easy-to-follow rules and you will need to check their work to keep them on the straight and narrow. To the extent they screw up and you miss it, the screw-ups will continue, to the extent the rules are too hard for them to follow they just won't.

But I don't see how that regime is useful here because the rules they would need to follow are anything but simple and easy-to-follow. To be effective they need to be more or less reverse engineering complicated drivers day in and day out. So I am not surprised the result is ineffective.

Actually I'd say the practical alternative, which you should indeed prefer in real life, is Class Drivers. Notice how that webcam you bought just plugs in and works? Same for your wireless mouse, the no-name USB headset and the 2TB USB hard disk you bought. Because those are standard classes of device, they don't need custom drivers.

This current practice is security theatre. There's the big show with the "certification process" and then actually they'll just ship whatever malware somebody pays for.

Re: Microsoft have signed multiple rootkits

#16

Post by encryptluks2 »

est31 wrote: post #8

I wonder what would happen if Microsoft required drivers to be redistributable at least by Microsoft and hosted them on a server for download by independent researchers, similar to how fwupd is doing it. Then the researchers could find ways to identify malware and point it out to Microsoft. As a bonus it might make the life of fwupd easier too.

In many ways they do this already and they do it terribly as you would expect from Microsoft. Not only do they install spyware automatically from OEM manufacturers like HP, they also often revert driver updates like Radeon drivers where they'll install an old driver on top of the new one you just installed.

Re: Microsoft have signed multiple rootkits

#17

Post by encryptluks2 »

_kbh_ wrote: post #4

Less likely Microsoft has signed multiple rootkits and more likely that someone has either stolen the certificate, they have someone at Microsoft signing the malware for them or they have found a vulnerability in the signing process imo.

I certainly believe Microsoft has high level employees working for Russian Government. Every version of Microsoft internal builds leak to Russian websites.

Re: Microsoft have signed multiple rootkits

#18

Post by drewcoo »

dogma1138 wrote: post #7

Looks like a signed driver, it’s not particularly hard to turn any driver into a rootkit especially a networking one. If you manage to say install npcap on a machine which is also signed these days you can pretty much capture the entire network traffic and send it w/e you want… heck both the capturing and the “sending” can be done from within the npcap driver itself since it can both capture and send packages the log…

A catalog file (.cat) has a bunch of file hashes (think file identities) in it. Signing that means indirectly signing all of those files.

Signature validation means checking an embedded signature if it exists, then looking for the hash in the installed .cat files and, if found, checking that signature.

Authenticode signatures like this are PKI-based. They can be revoked if determined not to be valid later.

Re: Microsoft have signed multiple rootkits

#19

Post by dogma1138 »

qzw wrote: post #11
dogma1138 wrote: post #7

Looks like a signed driver, it’s not particularly hard to turn any driver into a rootkit especially a networking one. If you manage to say install npcap on a machine which is also signed these days you can pretty much capture the entire network traffic and send it w/e you want… heck both the capturing and the “sending” can be done from within the npcap driver itself since it can both capture and send packages the log…

Looking at the VirusTotal results in the Twitter thread, all but one of the rootkits were actually detected by Microsoft's own anti-virus engine. I think Microsoft should consider running the submissions for driver signing through their anti-virus scanner (or even better, VirusTotal). Won't catch everything, of course, but it's pretty low hanging fruit.

I’m pretty sure that these were added to the defender list after they were signed and seen in the wild…

Same goes for VT they only classify something as malware after there is sufficient evidence that it is malware.

For the most part the only difference between malware and non malware is the intent of the operator, pretty much any functionality can be abused for malicious purposes.

This especially holds true for most security/system management suites they have pretty much the same capabilities as any decent RAT malware the only difference is the reason behind why they are deployed.

Re: Microsoft have signed multiple rootkits

#20

Post by chiph »

mikewarot wrote: post #2

With the offensive posture of the NSA, I would be highly surprised if this weren't true. They can be compelled to do anything, and compelled to keep it secret.

While they could, I don't think so in this case, as the drivers mentioned report back to C&C servers in China. While the NSA could obviously set up servers there, the simpler case would be that they have not.

Don't forget that the other mission of the NSA is to protect American computer infrastructure. Doing something like this where the driver distribution is so wide and indiscriminate would also argue against their involvement.

My guesses are in order: 1. The driver authors copied source from somewhere else without understanding what it did. 2. Malicious intent from the Chinese firms. 3. Malicious intent from the CCP. 4. Any other reason.

Post reply on HN