How a Microsoft blunder opened millions of PCs to potent malware attacks - Ars Technica

Getty Images

For astir 2 years, Microsoft officials botched a cardinal Windows defense, an unexplained lapse that near customers unfastened to a malware corruption method that has been particularly effectual successful caller months.

Microsoft officials person steadfastly asserted that Windows Update volition automatically adhd caller bundle drivers to a blocklist designed to thwart a well-known instrumentality successful the malware corruption playbook. The malware technique—known arsenic BYOVD, abbreviated for "bring your ain susceptible driver"—makes it casual for an attacker with administrative power to bypass Windows kernel protections. Rather than penning an exploit from scratch, the attacker simply installs immoderate 1 of dozens of third-party drivers with known vulnerabilities. Then the attacker exploits those vulnerabilities to summation instant entree to immoderate of the astir fortified regions of Windows.

It turns out, however, that Windows was not decently downloading and applying updates to the operator blocklist, leaving users susceptible to caller BYOVD attacks.

As attacks surge, Microsoft countermeasures languish

Drivers typically let computers to enactment with printers, cameras, oregon different peripheral devices—or to bash different things specified arsenic supply analytics astir the functioning of machine hardware. For galore drivers to work, they request a nonstop pipeline into the kernel, the halfway of an operating strategy wherever the astir delicate codification resides. For this reason, Microsoft heavy fortifies the kernel and requires each drivers to beryllium digitally signed with a certificate that verifies they person been inspected and travel from a trusted source.

Even then, however, morganatic drivers sometimes incorporate representation corruption vulnerabilities oregon different superior flaws that, erstwhile exploited, let hackers to funnel their malicious codification straight into the kernel. Even aft a developer patches the vulnerability, the old, buggy drivers stay fantabulous candidates for BYOVD attacks due to the fact that they’re already signed. By adding this benignant of operator to the execution travel of a malware attack, hackers tin prevention weeks of improvement and investigating time.

BYOVD has been a information of beingness for astatine slightest a decade. Malware dubbed "Slingshot" employed BYOVD since astatine slightest 2012, and different aboriginal entrants to the BYOVD country included LoJax, InvisiMole, and RobbinHood.

Over the past mates of years, we person seen a rash of caller BYOVD attacks. One specified onslaught precocious past twelvemonth was carried retired by the North Korean government-backed Lazarus group. It used a decommissioned Dell operator with a high-severity vulnerability to people an worker of an aerospace institution successful the Netherlands and a governmental writer successful Belgium.

In a abstracted BYOVD onslaught a fewer months ago, cybercriminals installed the BlackByte ransomware by installing and past exploiting a buggy operator for Micro-Star’s MSI AfterBurner 4.6.2.15658, a wide utilized graphics paper overclocking utility.

In July, a ransomware menace radical installed the operator mhyprot2.sys—a deprecated anti-cheat operator utilized by the wildly fashionable crippled Genshin Impact—during targeted attacks that went connected to exploit a code execution vulnerability successful the operator to burrow further into Windows.

A month earlier, criminals spreading the AvosLocker ransomware likewise abused the susceptible Avast anti-rootkit operator aswarpot.sys to bypass microorganism scanning.

Entire blog posts person been devoted to enumerating the increasing instances of BYOVD attacks, with this station from information steadfast Eclypsium and this 1 from ESET among the astir notable.

Microsoft is acutely alert of the BYOVD menace and has been moving connected defenses to halt these attacks, chiefly by creating mechanisms to halt Windows from loading signed-but-vulnerable drivers. The astir communal mechanics for operator blocking uses a operation of what's called representation integrity and HVCI, abbreviated for Hypervisor-Protected Code Integrity. A abstracted mechanics for preventing atrocious drivers from being written to disk is known arsenic ASR, oregon Attack Surface Reduction.

Unfortunately, neither attack seems to person worked arsenic good arsenic intended.