When the driver becomes the attacker
Posted in Computer Forensics, Security Architecture, Technology on Nov 30th, 2020
Earlier this year security researchers described a ransomware attack with an interesting twist. Before encrypting anything, the attackers installed an old, legitimately signed hardware driver from a well-known manufacturer. The driver had a known vulnerability, and the attackers used it to load their own malicious driver into the Windows kernel. From there they could kill […]