- The in-depth blogpost provides an in-depth look at vulnerabilities in kernel (the central component of the Windows operating system) drivers.
- Vulnerabilities in signed drivers are mostly utilized by game cheat developers to circumvent anti-cheat mechanisms, but they have also been used by several APT groups and in commodity malware.
- Delivering a vulnerable signed kernel driver is a popular option for attackers – this technique is called Bring Your Own Vulnerable Driver (BYOVD).
- This technique was utilized by the Slingshot and InvisiMole APT groups, the RobbinHood ransomware family, and LoJax, the first-ever UEFI rootkit used in the wild.
- ESET researchers have discovered vulnerabilities in three drivers.
- The blogpost details mitigation techniques.
BRATISLAVA, PRAGUE — January 11, 2022 — ESET Research has released an in-depth blogpost offering an in-depth look into the abuse of vulnerable kernel drivers. Vulnerabilities in signed drivers are mostly utilized by game cheat developers to circumvent anti-cheat mechanisms, but they have also been observed being used by several APT groups and in commodity malware. The blogpost discusses the types of vulnerabilities that commonly occur in kernel drivers, provides several case studies of malware utilizing such vulnerable drivers, analyzes examples of vulnerable drivers discovered during our research, and outlines effective mitigation techniques against this type of exploitation. These drivers can often become unguarded gateways to Windows’ core for malicious actors.
Among the various types of kernel (the central component of the Windows operating system) drivers are “software” drivers that provide specific, non-hardware related features like software debugging and diagnostics, system analysis, etc. These are prone to extend the attack surface significantly. Although directly loading a malicious, unsigned driver is no longer possible in the newer versions of Windows, and kernel rootkits are considered to be a thing of the past, there are still ways to load malicious code into the kernel, especially by abusing legitimate, signed drivers. Indeed, there are many drivers from various hardware and software vendors available that offer functionality to fully access the kernel with minimal effort.
The vulnerabilities most frequently observed in kernel drivers include:
- failures to add checks that restrict read and write access to critical model-specific registers (MSRs);
- exposing the ability to map physical memory from user mode for reading and writing; and
- exposing the ability to access virtual kernel memory from user mode for reading and writing.
“When malware actors need to run malicious code in the Windows kernel on x64 systems with driver signature enforcement in place, carrying a vulnerable signed kernel driver seems to be a viable option for doing so. This technique is known as Bring Your Own Vulnerable Driver, abbreviated as BYOVD, and has been observed being used in the wild by both high-profile APT actors and in commodity malware,” explains Peter Kálnai, one of the co-investigators of this research.
Examples of malicious actors using the BYOVD technique include the Slingshot APT group, which implemented their main module, called Cahnadr, as a kernel-mode driver that can be loaded by vulnerable signed kernel drivers. Another example is the InvisiMole APT group, which was uncovered by ESET researchers in 2018. A newer variant of the InvisiMole malware is the only case to date that ESET has observed of MSR exploitation on Windows 10 x64 systems being used in the wild by a malicious actor.
Yet another example is the RobbinHood ransomware which, as commodity malware, aims to reach as many people as possible. Thus, seeing it use a BYOVD technique is rare but powerful. This ransomware leverages a vulnerable GIGABYTE motherboard driver to disable driver signature enforcement and install its own malicious driver. Finally, LoJax, another ESET discovery in 2018 and the first-ever UEFI rootkit used in the wild, used the RWEverything driver to gain access to victims’ UEFI modules.
ESET researchers not only catalogued existing vulnerabilities, but also looked for new ones — a full list of the discovered vulnerabilities can be found in the published in-depth blogpost. The vendors that ESET contacted were very proactive during the disclosure process and eager to fix the uncovered vulnerabilities.
“Although there are several mechanisms employed by the CPU and/or the operating system, most of them can be bypassed with some clever techniques and are not very effective if the attacker prepares for them ahead of time,” says Kálnai.
The blogpost offers the following useful mitigation techniques:
- Virtualization-based security: This is a feature introduced in Windows 10 that leverages hardware virtualization to place the kernel in a sandbox thus securing the operating system with various protections.
- Certificate revocation: On modern Windows systems, drivers need to have a valid signature based on an “acceptable” certificate. Hence, revoking the certificate of a vulnerable driver would be an easy way to “disarm” it and render it useless in most cases.
- Driver blocklisting: This is a practice adopted by both Microsoft and various third-party security product vendors, including ESET, to detect and delete the most notorious vulnerable drivers when found on a system.
For more technical details about vulnerable signed kernel drivers, read the blogpost “Signed kernel drivers – Unguarded gateway to Windows’ core” on WeLiveSecurity. Make sure to follow ESET Research on Twitter for the latest news from ESET Research.
About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.
