Threat actors have found a way to disable antivirus (opens in new tab) solutions and other endpoint (opens in new tab) protection tools using an increasingly popular method.
Cybersecurity researchers from Sophos recently detailed how the method, known as called Bring Your Own Vulnerable Driver, works, and the dangers it brings to businesses around the world.
According to the company’s research, ransomware operators BlackByte are abusing a vulnerability tracked as CVE-2019-16098. It is found in RTCore64.sys and RTCore32.sys, drivers used by Micro-Star’s MSI AfterBurner 4.6.2.15658. Afterburner is an overclocking utility for GPUs, that gives users more control over the hardware.
Blocking the drivers
The vulnerability allows authenticated users to read and write to arbitrary memory, consequently leading to privilege escalation, code execution, and data theft – and in this case, helped BlackByte disable more than 1,000 drivers that security products need to run.
“Chances are good that they will continue abusing legitimate drivers to bypass security products,” Sophos said in a blog post (opens in new tab) outlining the threat.
To protect against this new attack method, Sophos suggests IT admins add these particular MSI drivers to an active blocklist and make sure they aren’t running on their endpoints. Furthermore, they should keep a close eye on all drivers being installed on their devices, and audit the endpoints regularly to look for rogue injections without a hardware match.
Bring Your Own Vulnerable Driver might be a new method, but its popularity is rising, fast. Earlier this week, a notorious North Korean state-sponsored threat actor Lazarus Group was observed using the same technique against Dell. Cybersecurity researchers from ESET have recently seen the group approach aerospace experts and political journalists in Europe with fake job offers from Amazon. They would share fake job description pdfs, which are essentially old, vulnerable Dell drivers.
What makes this technique particularly dangerous is the fact that these drivers aren’t malicious per se, and as such, are not flagged by antivirus solutions.
Via: BleepingComputer (opens in new tab)
