Items tagged with rootkit
Ever since the introduction of Windows Vista in early 2007, Microsoft has enforced the rule that Windows drivers must carry digital signatures by default. Any software that runs in kernel mode, in fact, has to be signed by the company. This is a security measure that should prevent malicious software from digging its claws in too deep. However, what happens when Microsoft gives its blessing to a rootkit? That's what happened a few months ago and was just now discovered thanks to G DATA Software security analyst Karsten Hahn. Initially, the company received a false-positive alert from a driver that was signed by Microsoft. After a lot of investigation into the matter, it turns out that the positive...
Read more...
Gamers that downloaded the latest update for Capcom’s Street Fighter V are getting quite a bit more than they bargained for — an unsecured rootkit. Redditor LoGicMoTion issued a warning to gamers that the latest update for the Windows version of the game was attempting to gain kernel level access to the operating system. The update puts capcom.sys in your System32 directory and in essence provides backdoor access to your PC, allowing a non-privileged user to run code. “The driver first registers itself using a pseudo-randomly generated name. That's kind of suspicious,” writes extrwi. “It also doesn't specify any security, so any user at any privilege level can attempt to open and control...
Read more...
It has been suggested that the microprocessors we use each and every day could pack in a bit more than we bargained for; namely, the tools needed for spying or undetectable access. And unfortunately, according to security researcher and developer Damien Zammit, there's a potential reason to be concerned over the "ME" or Management Engine module found in all Intel chipsets manufactured after the Core 2 era. If you've built your own Intel-based PC in recent years, or have at least reinstalled the OS and needed to install all of the drivers on your own, you've probably noticed a piece of software called "Intel Management Engine". What this corresponds to is a feature in modern Intel chipsets...
Read more...
When acquiring a new notebook or desktop, one of the first things many power users do is wipe it clean. No one likes the "junk" that comes preinstalled, and if time is available, sometimes it's just preferable to start fresh. But what if that was easier said than done? What if that preinstalled junk became more like a plague, persisting even through a fresh install of Windows? You might think, "That's crazy. Impossible." Well, it is crazy, but it's definitely not impossible. It seems that installing some asinine malware on customer PCs wasn't enough to satisfy Lenovo's insatiable appetite for intrusion, as it's recently been discovered that the company's installed what's effectively a rootkit...
Read more...
There have been many juicy bits of info to come out of this year's Black Hat conference, including hacking into autos, Macs that suffer a Thunderbolt bug, Microsoft boosting its bug bounty, and yet more vulnerabilities relating to Android. But wait - there's more! According to Christopher Domas, a researcher for Battelle Memorial Institute, all of Intel's (and possibly AMD's, and with the exception of its absolute latest) x86-based processors dating back to 1997 are vulnerable to an exploit that could grant someone access to the lowest-level firmware in a PC. The exact target is System Management Mode, the part of a PC that handles system errors and grants control to various subsystems, such...
Read more...
Security firms the world over dream of a day like this, but this one belongs to Kaspersky. The Russian-based firm has discovered the existence of a threat actor that could be linked to the US Government, and NSA in particular. Kaspersky has dubbed the group Equation, as it became clear that the folks involved loved advanced encryption algorithms and other obfuscation techniques. Through its Global Research and Analysis Team (GReAT), Kaspersky has discovered that Equation has itself created advanced malware - dating back to at least the early 2000s - and also had extremely close ties to groups responsible for some infamous malware, such as Stuxnet. Here's how Kaspersky summarizes Equation: The...
Read more...
