Hackers are using open source software that’s popular with video game cheaters to allow their Windows-based malware to bypass restrictions Microsoft put in place to prevent such infections from occurring.

The software comes in the form of two software tools that are available on GitHub. Cheaters use them to digitally sign malicious system drivers so they can modify video games in ways that give the player an unfair advantage. The drivers clear the considerable hurdle required for the cheat code to run inside the Windows kernel, the fortified layer of the operating system reserved for the most critical and sensitive functions.

Researchers from Cisco’s Talos security team said Tuesday that multiple Chinese-speaking threat groups have repurposed the tools—one called HookSignTool and the other FuckCertVerifyTimeValidity. Instead of using the kernel access for cheating, the threat actors use it to give their malware capabilities it wouldn’t otherwise have.

A new way to bypass Windows driver restrictions

“During our research we identified threat actors leveraging HookSignTool and FuckCertVerifyTimeValidity, signature timestamp forging tools that have been publicly available since 2019 and 2018 respectively, to deploy these malicious drivers,” the researchers wrote. “While they have gained popularity within the game cheat development community, we have observed the use of these tools on malicious Windows drivers unrelated to game cheats.”

With the debut of Windows Vista, Microsoft enacted strict new restrictions on the loading of system drivers that can run in kernel mode. The drivers are critical for devices to work with antivirus software, printers, and other kinds of software and peripherals, but they have long been a convenient inroad for hackers to run malware in kernel mode. These inroads are available to hackers post-exploit, meaning once they’ve already gained administrative privileges on a targeted machine. Advertisement

While attackers who gain such privileges can steal passwords and take other liberties, their malware typically must run in the Windows kernel to perform a large number of more advanced tasks. Under the policy put in place with Vista, all such drivers can be loaded only after they’ve been approved in advance by Microsoft and then digitally signed by a trusted certificate authority to verify they are safe.

Malware developers with admin privileges already had one well-known way to easily bypass the driver restrictions. The technique is known as “bring your own vulnerable driver.” It works by loading a publicly available third-party driver that has already been signed and later is found to contain a vulnerability allowing system takeover. The hackers install the driver post exploit and then exploit the driver vulnerability to inject their malware into the Windows kernel.

Although the technique has existed for more than a decade, Microsoft has yet to devise working defenses and has yet to provide any actionable guidance on mitigating the threat despite one of its executives publicly lauding the efficacy of Windows to defend against it.

The technique Talos has discovered represents a new way to bypass Windows driver restrictions. It exploits a loophole that has existed since the start of the policy that grandfathers in older drivers even when they haven’t been reviewed for safety by Microsoft. The exception, designed to ensure older software was still able to run on Windows systems, is triggered when a driver is signed by a Windows-trusted certificate authority prior to July 29, 2015.

“If a driver is successfully signed this way, it will not be prevented from being installed and started as a service,” Tuesday’s Talos post explained. “As a result, multiple open source tools have been developed to exploit this loophole. This is a known technique though often overlooked despite posing a serious threat to Windows systems and being relatively easy to perform due in part to the tooling being publicly available.”

  • @Molecular0079
    link
    English
    11 year ago

    Yeah, Ars article gave the impression that they were simply installing vulnerable versions of legit drivers and then taking advantage of that vulnerability. That’s very different than installing drivers with an invalid signature. If this was the case then it’s a very serious vulnerability indeed.

    • LeberechtReinhold
      link
      English
      11 year ago

      With admin privileges you can do the first one though, as the whole revocation list on certs is a fucking general mess (and that applies to web in general, not just windows).

      In general if your attacker is admin or has tricked you into executing something as admin, you are pretty much fucked, regardless of drivers.

      • Riskable
        link
        fedilink
        English
        3
        edit-2
        1 year ago

        The real problem here is that the vulnerable driver has a privilege level above admin. Once you’re exploited you can’t even figure it out because the malware will then be running as the same privilege level of a driver and as admin you won’t have the power to effectively investigate that since the malware has a higher privilege.

        You have to do everything offline if you want to detect if you’ve been compromised or not. Otherwise you’re just going to have to wait and hope Microsoft puts out a special tool to detect and remove it (which they often do).

        The entire concept of anything on the OS running at a privilege level above admin (but below kernel) is absurd to begin with. It only exists because Microsoft had this grand “Trusted Computing” plan back in the day that was supposed to install them as the sole gatekeepers of all media playing back on PCs. Hardware encryption and signed everything including the damned video cable going to your monitor.

        In order to facilitate that they invented this permissions level below kernel but above admin–because you can’t give the end users a mechanism to work around the encryption! If the (pretend) “secure” drivers ran at the same level as admin someone with such rights could just run some debug tools to dump memory and other runtime stuff to grab the decryption keys and do all sorts of terrible things like… Copy the media being played! (The horror).

        So now thanks to that effort Windows has a very unique sort of malware that no other OS has to deal with. Impossible to detect while running and extremely difficult to get rid of.

        Linux doesn’t have this problem because even if a malicious kernel driver is messing with all running binaries there’s ways to build a binary that can detect when itself has been messed with and also identify the mechanism of action. See: chkrootkit

        What’s worse is that Microsoft was warned that this would happen! Security experts at the time said it over and over again: A compromised driver would be an incredibly bad situation. Microsoft didn’t care! All they saw was dollar signs at the prospect of being able to take fees from anyone and everyone that wanted to play back movies and videos on their computers.