Vulnerable yet digitally signed Gigabyte driver actively being exploited - RobbinHood Randomware
There is a form of ransomware exploiting a vulnerable Gigabyte driver. since the driver is digitally signed it becomes easy to install. The malware installs a second driver that disables security software, after which the encryption begins.
The signed driver, part of a now-deprecated software package published by Taiwan-based motherboard manufacturer Gigabyte, has a known vulnerability, tracked as CVE-2018-19320. The problem is a kernel driver called gdrv .sys that is prone to escalation privilege . Although the driver is no longer being used, it is still digitally approved by Versign, why this is the case is not yet known. Thanks to this certificate, the driver can still be installed, after which Windows driver signature verification can be disabled.
The vulnerability, published along with proof-of-concept code in 2018 and widely reported at the time, was disclaimed by the company, who told the researcher who tried to report the bug that “its products are not affected by the reported vulnerabilities.” The company later recanted, and has discontinued using the vulnerable driver, but it still exists, and it apparently remains a threat. Verisign, whose code signing mechanism was used to digitally sign the driver, has not revoked the signing certificate, so the Authenticode signature remains valid. In this attack scenario, the criminals have used the Gigabyte driver as a wedge so they could load a second, unsigned driver into Windows. This second driver then goes to great lengths to kill processes and files belonging to endpoint security products, bypassing tamper protection, to enable the ransomware to attack without interference.
Known Affected Software Configurations
cpe:2.3:a:gigabyte:aorus_graphics_engine:*:*:*:*:*:*:*:* Show Matching CPE(s) |
Up to (including) 1.33 |
|
cpe:2.3:a:gigabyte:app_center:*:*:*:*:*:*:*:* Show Matching CPE(s) |
Up to (including) 1.05.21 |
|
cpe:2.3:a:gigabyte:oc_guru_ii:2.08:*:*:*:*:*:*:* Show Matching CPE(s) |
||
cpe:2.3:a:gigabyte:xtreme_gaming_engine:*:*:*:*:*:*:*:* Show Matching CPE(s) |
Up to (including) 1.25 |
The vulnerability is active throughout the entire software suite
It is the first time we have observed ransomware shipping a trusted, signed (yet vulnerable) third party driver to patch the Windows kernel in-memory, load their own unsigned malicious driver, and take out security applications from kernel space. The ransomware that was being installed in both instances calls itself RobbinHood.
Gigabyte earlier on Gigabyte claimed its products were not affected.
Read more on sophos.
New CacheOut Speculative Execution Vulnerability Hits Intel Processors - 01/28/2020 04:34 PM
Intel is not spared when it comes to the number of vulnerabilities that keep hitting their processors. The latest one is CacheOut, a new speculative execution attack that is capable of leaking data fr...
Microsoft patches crypt32.dll vulnerability that allows certificate spoofing - 01/15/2020 09:39 AM
Yesterday we shared news about a big potential vulnerability with a Microsoft Windows component known as crypt32.dll, a Windows module that Microsoft says handles “certificate and cryptographic mes...
Rumor: Microsoft might share information on extremely critical vulnerability later today - 01/14/2020 03:53 PM
It's tagged as a rumor, but you can rest assured it'll become a fact. Keep an eye out on your Tuesday patches, and apply them. According to Krebs On Security, Microsoft is about to release an extre...
Intel will be addressing 77 security vulnerabilities this month - 11/13/2019 02:53 PM
Followed by the news of the Zombieload v2 attack news today, Intel yesterday posted a security blog, in which they state to close 77 vulnerabilities in November....
Epic Games Store Vulnerability, Borderlands 3 DRM Concerns - 11/05/2019 08:59 AM
A new vulnerability was spotted in the Epic Games Store system. Willian Worrall of CCN said that this security allows users to work around the system’s security to access a game without owning it....
Senior Member
Posts: 1797
Joined: 2017-06-26
Verisign should put the cert on their blacklist ... the driver will get invalid, but so does the ransomware which relys on this driver to infect.
Just another example of "I dont think this will raise any issues".
Junior Member
Posts: 2
Joined: 2020-02-10
Verisign should put the cert on their blacklist ... the driver will get invalid, but so does the ransomware which relys on this driver to infect.
Just another example of "I dont think this will raise any issues".
Verisign hasn't been a CA since 2010 when it sold the CA portion of its business to Symantec and is thus not responsible for this certificate in any way. The burden is on the certificate owner (Gigabyte) to revoke the certificate. If a CA randomly revoked certificates that they signed but did not own, they would not be a CA for very long.
Senior Member
Posts: 1797
Joined: 2017-06-26
Verizon ... you're right about them. I somehow had the name in my mind but completely forgot this story ...

Senior Member
Posts: 260
Joined: 2009-12-12
Yep, i absolutely saw this coming.
This file has been used to hack EAC and Battle eye protected games for months
And i was under the impression Bluehole finally fixed the anti-cheat in PUBG

Senior Member
Posts: 15387
Joined: 2018-03-21
Yep, i absolutely saw this coming.
This file has been used to hack EAC and Battle eye protected games for months