SoylentNews is people
SoylentNews
A kernel-level driver for old PC motherboards has been abused by criminals to hijack Windows computers, disable antivirus, and hold files to ransom.
Sophos this month reported that an arbitrary read-write flaw in a digitally signed driver for now-deprecated Gigabyte hardware was recently used by ransomware, dubbed Robbinhood, to quietly switch off security safeguards on Windows 7, 8 and 10 machines.
The problem, said Sophos, is that while Gigabyte stopped supporting and shipping the driver a while back, the software's cryptographic signature is still valid. And so, when the ransomware infects a computer – either by some other exploit or by tricking a victim into running it – and loads the driver, the operating system and antivirus packages will allow it because the driver appears legit.
At that point, the ransomware exploits the security flaw in the Gigabyte driver to alter memory to bypass protection mechanisms and inject malicious code into kernel space, completely compromising the box and allowing the file-scrambling component to run unhindered.
Also at: threatpost.
If only they used their powers for good.
(Score: 3, Informative) by dwilson on Wednesday February 12 2020, @04:36PM
You don't need it previously installed, and you don't need the hardware present.
As I understood it, the flow goes something like this:
Bad actor uses some sort of browser exploit (ideally with no privilege escalation or user input required. We see these pop up somewhat regularly, sadly) to download their NastyCode(tm) packaged in with this driver, in the background. User remains clueless.
The download is executed on completion by the same or a separate exploit, again ideally with no privilege escalation or user input. Because the driver is 'Signed", standard safeguards don't raise any red flags and allow it run, again silently. It gains admin rights as it installs without a hiccup, which the payload then uses to do... whatever it wants.
- D