Earlier this year security researchers described a ransomware attack with an interesting twist. Before encrypting anything, the attackers installed an old, legitimately signed hardware driver from a well-known manufacturer. The driver had a known vulnerability, and the attackers used it to load their own malicious driver into the Windows kernel. From there they could kill the antivirus and delete its files, and then the encryption could run undisturbed.<\/p>\n
Why does this work? Because drivers run in the kernel, with more power than anything else on the machine, including most security products. Windows only loads signed drivers, but a signed driver with a vulnerability is still signed. And there are a lot of old drivers out there.<\/p>\n
So what can you do? Keep track of which drivers actually run on your machines and remove the ones nobody needs. Turn on Hypervisor-protected Code Integrity, HVCI, where the hardware supports it. It makes it a lot harder to run malicious code in the kernel. Use Windows Defender Application Control to block drivers you don\u00b4t want. And watch for the signs: a driver being installed by an admin account on a server is not something that happens every day.<\/p>\n
And as always, the attacker needed admin rights to install the driver. Protect your admins and this attack gets a lot harder.<\/p>\n
Signed doesn\u00b4t mean safe.<\/p>\n","protected":false},"excerpt":{"rendered":"
Earlier this year security researchers described a ransomware attack with an interesting twist. Before encrypting anything, the attackers installed an old, legitimately signed hardware driver from a well-known manufacturer. The driver had a known vulnerability, and the attackers used it to load their own malicious driver into the Windows kernel. From there they could kill […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[3,4,13],"tags":[76,77,42],"class_list":["post-1225","post","type-post","status-publish","format-standard","hentry","category-computer-forensics","category-security-architecture","category-technology","tag-drivers","tag-endpoint-protection","tag-ransomware"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1225","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1225"}],"version-history":[{"count":1,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1225\/revisions"}],"predecessor-version":[{"id":1253,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1225\/revisions\/1253"}],"wp:attachment":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1225"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1225"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1225"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}