Guru3D.com
  • HOME
  • NEWS
    • Channels
    • Archive
  • DOWNLOADS
    • New Downloads
    • Categories
    • Archive
  • GAME REVIEWS
  • ARTICLES
    • Rig of the Month
    • Join ROTM
    • PC Buyers Guide
    • Guru3D VGA Charts
    • Editorials
    • Dated content
  • HARDWARE REVIEWS
    • Videocards
    • Processors
    • Audio
    • Motherboards
    • Memory and Flash
    • SSD Storage
    • Chassis
    • Media Players
    • Power Supply
    • Laptop and Mobile
    • Smartphone
    • Networking
    • Keyboard Mouse
    • Cooling
    • Search articles
    • Knowledgebase
    • More Categories
  • FORUMS
  • NEWSLETTER
  • CONTACT

New Reviews
Corsair MM700 & Corsair Katar Pro XT Review
Guru3D Rig of the Month - February 2021
ASUS GeForce RTX 3060 STRIX Gaming OC review
EVGA GeForce RTX 3060 XC Gaming review
MSI GeForce RTX 3060 Gaming X TRIO review
PALIT GeForce RTX 3060 DUAL OC review
ZOTAC GeForce RTX 3060 AMP WHITE review
Fractal Design Meshify 2 Compact chassis review
Sabrent Rocket 4 PLUS 2TB NVMe SSD review
MSI Radeon RX 6900 XT GAMING X TRIO review

New Downloads
Display Driver Uninstaller Download version 18.0.3.7
Guru3D RTSS Rivatuner Statistics Server Download 7.3.0 Final
Media Player Classic - Home Cinema v1.9.10 Download
GeForce 461.72 WHQL driver download
AIDA64 Download Version 6.32.5640 beta
CrystalDiskInfo 8.11.2 Download
AMD Radeon Adrenalin Edition 21.2.3 driver download
GPU-Z Download v2.37.0
Intel HD graphics Driver Download Version: DCH27.20.100.9313
HWiNFO Download v6.43 - 4380 Beta


New Forum Topics
GeForce RTX 3090 with blower style coolers discontinued en masse New AMD Radeon drivers - how to save monitor profiles? NVIDIA 465.21 DEVELOPER AMD Radeon Software Adrenalin 2020 Edition 21.2.3 RDNA2 RX6000 Series Owners Thread, Tests, Mods, BIOS & Tweaks ! Next-gen AMD EPYC (Genoa) Would get 50% larger socket SP5, 96 cores and 400W TDP Afterburner's Sytem Tray icons font options Is NVIDIA the only IT company forcing telemetry to its costumers?? WDDM 3.0 / 465.51 MSI Z490 Motherboards Open Up for PCIe 4.0 Graphics Cards and SSDs




Guru3D.com » News » Vulnerable yet digitally signed Gigabyte driver actively being exploited - RobbinHood Randomware

Vulnerable yet digitally signed Gigabyte driver actively being exploited - RobbinHood Randomware

by Hilbert Hagedoorn on: 02/10/2020 08:12 AM | source: sophos | 8 comment(s)
Vulnerable yet digitally signed Gigabyte driver actively being exploited - RobbinHood Randomware

There is a form of ransomware exploiting a vulnerable Gigabyte driver. since the driver is digitally signed it becomes easy to install. The malware installs a second driver that disables security software, after which the encryption begins.

The signed driver, part of a now-deprecated software package published by Taiwan-based motherboard manufacturer Gigabyte, has a known vulnerability, tracked as CVE-2018-19320. The problem is a kernel driver called gdrv .sys that is prone to escalation privilege . Although the driver is no longer being used, it is still digitally approved by Versign, why this is the case is not yet known. Thanks to this certificate, the driver can still be installed, after which Windows driver signature verification can be disabled.

The vulnerability, published along with proof-of-concept code in 2018 and widely reported at the time, was disclaimed by the company, who told the researcher who tried to report the bug that “its products are not affected by the reported vulnerabilities.” The company later recanted, and has discontinued using the vulnerable driver, but it still exists, and it apparently remains a threat. Verisign, whose code signing mechanism was used to digitally sign the driver, has not revoked the signing certificate, so the Authenticode signature remains valid. In this attack scenario, the criminals have used the Gigabyte driver as a wedge so they could load a second, unsigned driver into Windows. This second driver then goes to great lengths to kill processes and files belonging to endpoint security products, bypassing tamper protection, to enable the ransomware to attack without interference. 

  

Known Affected Software Configurations

 cpe:2.3:a:gigabyte:aorus_graphics_engine:*:*:*:*:*:*:*:*
     Show Matching CPE(s) 
Up to (including)
1.33
 cpe:2.3:a:gigabyte:app_center:*:*:*:*:*:*:*:*
     Show Matching CPE(s) 
Up to (including)
1.05.21
 cpe:2.3:a:gigabyte:oc_guru_ii:2.08:*:*:*:*:*:*:*
     Show Matching CPE(s) 
 cpe:2.3:a:gigabyte:xtreme_gaming_engine:*:*:*:*:*:*:*:*
     Show Matching CPE(s) 
Up to (including)
1.25

The vulnerability is active throughout the entire software suite

 

It is the first time we have observed ransomware shipping a trusted, signed (yet vulnerable) third party driver to patch the Windows kernel in-memory, load their own unsigned malicious driver, and take out security applications from kernel space. The ransomware that was being installed in both instances calls itself RobbinHood.

Gigabyte earlier on Gigabyte claimed its products were not affected.

Read more on sophos.



Vulnerable yet digitally signed Gigabyte driver actively being exploited - RobbinHood Randomware Vulnerable yet digitally signed Gigabyte driver actively being exploited - RobbinHood Randomware




« Overclocker gets AMD Threadripper 3990X Running 5.3 GHZ on all 64-core (LN2) · Vulnerable yet digitally signed Gigabyte driver actively being exploited - RobbinHood Randomware · Grab for free: Sims 4 Standard Edition is free on Origin »

Related Stories

New CacheOut Speculative Execution Vulnerability Hits Intel Processors - 01/28/2020 03:34 PM
Intel is not spared when it comes to the number of vulnerabilities that keep hitting their processors. The latest one is CacheOut, a new speculative execution attack that is capable of leaking data fr...

Microsoft patches crypt32.dll vulnerability that allows certificate spoofing - 01/15/2020 08:39 AM
Yesterday we shared news about a big potential vulnerability with a Microsoft Windows component known as crypt32.dll, a Windows module that Microsoft says handles “certificate and cryptographic mes...

Rumor: Microsoft might share information on extremely critical vulnerability later today - 01/14/2020 02:53 PM
It's tagged as a rumor, but you can rest assured it'll become a fact. Keep an eye out on your Tuesday patches, and apply them. According to Krebs On Security, Microsoft is about to release an extre...

Intel will be addressing 77 security vulnerabilities this month - 11/13/2019 01:53 PM
Followed by the news of the Zombieload v2 attack news today, Intel yesterday posted a security blog, in which they state to close 77 vulnerabilities in November....

Epic Games Store Vulnerability, Borderlands 3 DRM Concerns - 11/05/2019 07:59 AM
A new vulnerability was spotted in the Epic Games Store system. Willian Worrall of CCN said that this security allows users to work around the system’s security to access a game without owning it....


2 pages 1 2


Astyanax
Senior Member



Posts: 9512
Joined: 2018-03-21

#5758949 Posted on: 02/10/2020 09:26 AM
Yep, i absolutely saw this coming.

This file has been used to hack EAC and Battle eye protected games for months

386SX
Senior Member



Posts: 1078
Joined: 2017-06-26

#5758950 Posted on: 02/10/2020 09:26 AM
Verisign should put the cert on their blacklist ... the driver will get invalid, but so does the ransomware which relys on this driver to infect.

Just another example of "I dont think this will raise any issues".

skimike
Junior Member



Posts: 2
Joined: 2020-02-10

#5759090 Posted on: 02/10/2020 06:02 PM
Verisign should put the cert on their blacklist ... the driver will get invalid, but so does the ransomware which relys on this driver to infect.

Just another example of "I dont think this will raise any issues".

Verisign hasn't been a CA since 2010 when it sold the CA portion of its business to Symantec and is thus not responsible for this certificate in any way. The burden is on the certificate owner (Gigabyte) to revoke the certificate. If a CA randomly revoked certificates that they signed but did not own, they would not be a CA for very long.

386SX
Senior Member



Posts: 1078
Joined: 2017-06-26

#5759115 Posted on: 02/10/2020 08:00 PM
Verizon ... you're right about them. I somehow had the name in my mind but completely forgot this story ... :)

GlennB
Senior Member



Posts: 251
Joined: 2009-12-12

#5759128 Posted on: 02/10/2020 09:05 PM
Yep, i absolutely saw this coming.

This file has been used to hack EAC and Battle eye protected games for months

And i was under the impression Bluehole finally fixed the anti-cheat in PUBG :rolleyes:

2 pages 1 2


Post New Comment
Click here to post a comment for this news story on the message forum.


Guru3D.com © 2021