Microsoft waited 6 months to patch actively exploited admin-to-kernel vulnerability
2 years ago by ylai to c/technology
Microsoft has enforced mandatory digital signatures for drivers, and getting a digital signing key from Microsoft costs a ton of money. So, presumably they do care.
In contrast, consider nProtect GameGuard, the anti-cheat system in Helldivers 2. It is a rootkit, and runs in the kernel. Why does Microsoft permit this? Shouldn't this be blocked? It must be using either an exploit like the article, or a properly signed driver. Either way, Microsoft could fix it -- by patching the exploit, or revoking the signing key.
The fact that Microsoft hasn't done anything about malicious anticheat rootkits is a sign that they really don't care. They just want their payment.
I might be completely wrong, but I've heard that a key is only a few hundred dollars, and once you've got it you can sign whatever you want. I think ReactOS also used to offer free driver signing for open source projects.
So I guess if ReactOS can afford one, so can most anti-cheat companies.
I'm not sure that's necessarily true with enforcement of driver signing.
The latest OS kernels typically make some effort to resist arbitrary code injection even by the system administrator and sometimes goes even further against an attacker with a read/write primitive on the kernel. Linux with secure boot will refuse to load unsigned kernel modules for example.
You generally cannot load whatever you want into the kernel as admin on Windows.
You have to either disable secure boot to enable changing it via command prompt, or you have to boot into a special recovery mode first that verifies you have physical access to turn it off.
Linux with secure boot is similar. Root cannot patch the kernel (without a bug). The kernel lockdown feature is activated, which enforces code signing. You have to use your physical access to change the UEFI setting to disable secure boot first or use a MOK to enable signing your own modules in such a way the secure boot chain accepts them.
Huh. I must be outdated. I didn’t know they got secure boot working. So what do you do when you need to update your kernel? Or does the fact that it comes from the package manager mean that it is allowed to update that?
It is part of the SSSCA / CBDTPA / "Trusted" computing initiative. The large corporations want to control what you are allowed to do with your computer. This is where the phrase "digital rights management" comes from.
Probably business as usual, NSA just needed a little more time to finish a job.
This is the best summary I could come up with:
Infosec in brief Cybersecurity researchers informed Microsoft that Notorious North Korean hackers Lazarus Group discovered the "holy grail" of rootkit vulnerabilities in Windows last year, but Redmond still took six months to patch the problem.
Researchers at Avast said they informed Microsoft of a serious admin-to-kernel exploit in a driver associated with AppLocker, the app for whitelisting software built into Windows, in August of last year.
"This presented an ideal exploitation scenario, allowing the attacker to call an arbitrary kernel function with a high degree of control over the first argument."
Avast claims Lazarus Group used the vulnerability to obtain read/write primitive on the Windows kernel and install their FudModule rootkit, but Microsoft's opinion on the severity of admin-to-kernel exploits meant it didn't prioritize the matter, waiting until February's patch Tuesday to fix the issue, which it tagged as CVE-2024-21338, with a CVSS score of 8/10.
Of admin-to-kernel issues, Microsoft said administrative processes and users are part of Trusted Computing Base for Windows, and thus "not strong [sic] isolated from the kernel boundary."
"By providing complementary security certifications, we aim to break down barriers and create opportunities for women in Jordan, fostering a more inclusive and diverse workforce," OpenSSF said.
The original article contains 705 words, the summary contains 200 words. Saved 72%. I'm a bot and I'm open source!
@lemmy.world
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
go to feed...
@lemmy.world
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
go to feed...
Doesn’t having admin privileges mean you can load any driver into the kernel anyway, including blatantly malicious drivers?
save