Monday, March 7th 2022
Malware On the Prowl Using Stolen NVIDIA Code Signing Certificates
Stolen code-signing certificates of NVIDIA scored from the recent cyber-attack, are being used to develop a new breed of malware that can appear "trustworthy" to Windows PCs. The code-signing certificates leaked to the web as part of the hacker group expired in 2014 and 2018, but Windows PCs are still able to see them as being used for signing drivers. One such malware that hit anti-virus provider VirusTotal, is a variant of the Quasar RAT (remote-access trojan), signed with NVIDIA certificates. A RAT works in the background, granting remote-access to your machine to an attacking group with read-write access, who can then do anything from stealing data or holding it to ransom by encrypting it.
Source:
BleepingComputer
35 Comments on Malware On the Prowl Using Stolen NVIDIA Code Signing Certificates
While drivers are usually WHQL-signed by Microsoft (using the Microsoft Windows Hardware Compatibility Publisher CA) there are exceptions that still get installed even if the CA certificate is expired.
There are mechanisms to revoke a CA certificate, but it's going to be a messy affair - every piece of software signed by that CA will become untrusted.
How is your comment even remotely relevant to the article ......... :banghead:
Hopefully users savvy enough to block updates are also savvy enough to spot an expired certificate.
The problem is that there's a lot of legitimate software made by NVidia which is signed with those leaked CAs. If Microsoft/NV/VeriSign revoke the certs then those executable will cause scary UAC errors. That's why a compromised CA is always a huge hurdle to fix.It can be called whatever really, let's say NvBroadcast.Container.exe or any other legitimate-sounding name.
Unfortunately that UAC will tell you it's valid software from NVidia, at least until the CA is revoked and the changes propagated to Windows trust store.
Most don't read those dialogues carefully unless they are errors, and some just click through it as fast as possible.
Common threats will be detected beforehand by either Windows Defender or other AV products, but a leaked trusted CA like that gives a lot of opportunities for bad actors. Tailored exploits won't be detected and will seem like legitimate software from NVidia. It's a bad situation for everybody, especially NVidia.
If someone clicks "Yes" every single time UAC pops up without reading it, it's their own fault. UAC was created exactly for situations like this. All I can do is spread the word (which I do anyway).
It's a different kind of situation when you downloaded something, and UAC says it's from nvidia. But that's suspicious enough as well, I guess.
That's not true. Take for example the GeForce 342.01 driver from 2016 which is signed with a Code Signing certificate valid from 2015 to 2018. Windows validates this signature and UAC shows the .exe to be trusted, from NVidia.Edit: Scratch that, I misunderstood you. You're correct, the timestamping countersignature prevents using those leaked CAs for signing new software, under normal circumstances.
So it seems windows itself is inconsistent as App locker and SRP do not trust expired certs. But as you said other parts of the OS do.
But those two features are aimed at enterprise use so logical they are strict.
I guess its going to be revocation and hoping people keep their cert stores updated.
Why not just teach people?
Oh right... because, we're dealing with a population of computer illiterate potatoes. I keep forgetting.
I'm sorry I say it that harshly, but you know it's true.