Guru3D.com
  • HOME
  • NEWS
    • Channels
    • Archive
  • DOWNLOADS
    • New Downloads
    • Categories
    • Archive
  • GAME REVIEWS
  • ARTICLES
    • Rig of the Month
    • Join ROTM
    • PC Buyers Guide
    • Guru3D VGA Charts
    • Editorials
    • Dated content
  • HARDWARE REVIEWS
    • Videocards
    • Processors
    • Audio
    • Motherboards
    • Memory and Flash
    • SSD Storage
    • Chassis
    • Media Players
    • Power Supply
    • Laptop and Mobile
    • Smartphone
    • Networking
    • Keyboard Mouse
    • Cooling
    • Search articles
    • Knowledgebase
    • More Categories
  • FORUMS
  • NEWSLETTER
  • CONTACT

New Reviews
Razer Leviathan V2 gaming soundbar review
Guru3D NVMe Thermal Test - the heatsink vs. performance
EnGenius ECW220S 2x2 Cloud Access Point review
Alphacool Eisbaer Aurora HPE 360 LCS cooler review
Noctua NH-D12L CPU Cooler Review
Silicon Power XPOWER XS70 1TB NVMe SSD Review
Hyte Y60 chassis review
ASUS ROG Thor 1000W Platinum II (1000W PSU) review
ASUS ROG Rapture GT-AXE11000 WIFI6E router review
Backforce One Plus Gaming Chair review

New Downloads
CrystalDiskInfo 8.17 Download
AMD Radeon Software Adrenalin 22.6.1 Windows 7 driver download
ReShade download v5.2.2
HWiNFO Download v7.26
7-Zip v22.00 Download
GeForce 516.40 WHQL driver download
Intel ARC graphics Driver Download Version: 30.0.101.1736
AMD Radeon Software Adrenalin 22.5.2 WHQL driver download
Corsair Utility Engine Download (iCUE) Download v4.24.193
Intel HD graphics Driver Download Version: 30.0.101.1994


New Forum Topics
NVIDIA GeForce 516.40 WHQL driver download & Discussion AMD has released the FSR 2.0 Plugin for Unreal Engine 4 and 5. RDNA2 RX6000 Series Owners Thread, Tests, Mods, BIOS & Tweaks ! Up to 96 cores and 12 DDR5 memory channels with AMD Zen4-based server processors. AMD Radeon Software Adrenalin 22.5.2 driver download and discussion 6900xt red devil for 830eur Guru3D NVMe Thermal Test - the influence of a heatsink 3090 Owner's thread Intel Arc Alchemist A770M/A730M benchmarks fvs RTX 3060 and 3050 Ti are available We need to talk about UE4 Shader compilation issues




Guru3D.com » News » Vulnerable yet digitally signed Gigabyte driver actively being exploited - RobbinHood Randomware

Vulnerable yet digitally signed Gigabyte driver actively being exploited - RobbinHood Randomware

by Hilbert Hagedoorn on: 02/10/2020 09:12 AM | source: sophos | 8 comment(s)
Vulnerable yet digitally signed Gigabyte driver actively being exploited - RobbinHood Randomware

There is a form of ransomware exploiting a vulnerable Gigabyte driver. since the driver is digitally signed it becomes easy to install. The malware installs a second driver that disables security software, after which the encryption begins.

The signed driver, part of a now-deprecated software package published by Taiwan-based motherboard manufacturer Gigabyte, has a known vulnerability, tracked as CVE-2018-19320. The problem is a kernel driver called gdrv .sys that is prone to escalation privilege . Although the driver is no longer being used, it is still digitally approved by Versign, why this is the case is not yet known. Thanks to this certificate, the driver can still be installed, after which Windows driver signature verification can be disabled.

The vulnerability, published along with proof-of-concept code in 2018 and widely reported at the time, was disclaimed by the company, who told the researcher who tried to report the bug that “its products are not affected by the reported vulnerabilities.” The company later recanted, and has discontinued using the vulnerable driver, but it still exists, and it apparently remains a threat. Verisign, whose code signing mechanism was used to digitally sign the driver, has not revoked the signing certificate, so the Authenticode signature remains valid. In this attack scenario, the criminals have used the Gigabyte driver as a wedge so they could load a second, unsigned driver into Windows. This second driver then goes to great lengths to kill processes and files belonging to endpoint security products, bypassing tamper protection, to enable the ransomware to attack without interference. 

  

Known Affected Software Configurations

 cpe:2.3:a:gigabyte:aorus_graphics_engine:*:*:*:*:*:*:*:*
     Show Matching CPE(s) 
Up to (including)
1.33
 cpe:2.3:a:gigabyte:app_center:*:*:*:*:*:*:*:*
     Show Matching CPE(s) 
Up to (including)
1.05.21
 cpe:2.3:a:gigabyte:oc_guru_ii:2.08:*:*:*:*:*:*:*
     Show Matching CPE(s) 
 cpe:2.3:a:gigabyte:xtreme_gaming_engine:*:*:*:*:*:*:*:*
     Show Matching CPE(s) 
Up to (including)
1.25

The vulnerability is active throughout the entire software suite

 

It is the first time we have observed ransomware shipping a trusted, signed (yet vulnerable) third party driver to patch the Windows kernel in-memory, load their own unsigned malicious driver, and take out security applications from kernel space. The ransomware that was being installed in both instances calls itself RobbinHood.

Gigabyte earlier on Gigabyte claimed its products were not affected.

Read more on sophos.



Vulnerable yet digitally signed Gigabyte driver actively being exploited - RobbinHood Randomware Vulnerable yet digitally signed Gigabyte driver actively being exploited - RobbinHood Randomware




« Overclocker gets AMD Threadripper 3990X Running 5.3 GHZ on all 64-core (LN2) · Vulnerable yet digitally signed Gigabyte driver actively being exploited - RobbinHood Randomware · Grab for free: Sims 4 Standard Edition is free on Origin »

Related Stories

New CacheOut Speculative Execution Vulnerability Hits Intel Processors - 01/28/2020 04:34 PM
Intel is not spared when it comes to the number of vulnerabilities that keep hitting their processors. The latest one is CacheOut, a new speculative execution attack that is capable of leaking data fr...

Microsoft patches crypt32.dll vulnerability that allows certificate spoofing - 01/15/2020 09:39 AM
Yesterday we shared news about a big potential vulnerability with a Microsoft Windows component known as crypt32.dll, a Windows module that Microsoft says handles “certificate and cryptographic mes...

Rumor: Microsoft might share information on extremely critical vulnerability later today - 01/14/2020 03:53 PM
It's tagged as a rumor, but you can rest assured it'll become a fact. Keep an eye out on your Tuesday patches, and apply them. According to Krebs On Security, Microsoft is about to release an extre...

Intel will be addressing 77 security vulnerabilities this month - 11/13/2019 02:53 PM
Followed by the news of the Zombieload v2 attack news today, Intel yesterday posted a security blog, in which they state to close 77 vulnerabilities in November....

Epic Games Store Vulnerability, Borderlands 3 DRM Concerns - 11/05/2019 08:59 AM
A new vulnerability was spotted in the Epic Games Store system. Willian Worrall of CCN said that this security allows users to work around the system’s security to access a game without owning it....


2 pages 1 2


Astyanax
Senior Member



Posts: 13415
Joined: 2018-03-21

#5758949 Posted on: 02/10/2020 10:26 AM
Yep, i absolutely saw this coming.

This file has been used to hack EAC and Battle eye protected games for months

386SX
Senior Member



Posts: 1442
Joined: 2017-06-26

#5758950 Posted on: 02/10/2020 10:26 AM
Verisign should put the cert on their blacklist ... the driver will get invalid, but so does the ransomware which relys on this driver to infect.

Just another example of "I dont think this will raise any issues".

skimike
Junior Member



Posts: 2
Joined: 2020-02-10

#5759090 Posted on: 02/10/2020 07:02 PM
Verisign should put the cert on their blacklist ... the driver will get invalid, but so does the ransomware which relys on this driver to infect.

Just another example of "I dont think this will raise any issues".

Verisign hasn't been a CA since 2010 when it sold the CA portion of its business to Symantec and is thus not responsible for this certificate in any way. The burden is on the certificate owner (Gigabyte) to revoke the certificate. If a CA randomly revoked certificates that they signed but did not own, they would not be a CA for very long.

386SX
Senior Member



Posts: 1442
Joined: 2017-06-26

#5759115 Posted on: 02/10/2020 09:00 PM
Verizon ... you're right about them. I somehow had the name in my mind but completely forgot this story ... :)

GlennB
Senior Member



Posts: 257
Joined: 2009-12-12

#5759128 Posted on: 02/10/2020 10:05 PM
Yep, i absolutely saw this coming.

This file has been used to hack EAC and Battle eye protected games for months

And i was under the impression Bluehole finally fixed the anti-cheat in PUBG :rolleyes:

2 pages 1 2


Post New Comment
Click here to post a comment for this news story on the message forum.


Guru3D.com © 2022