Responding to what first appeared to be a false positive, cybersecurity researchers caught hold of a malicious driver that was officially signed by Microsoft.
Karsten Hahn, a malware analyst with security vendor G Data blogged about Microsoft’s faux pas, while sharing his observations about the driver’s malicious activities.
Analysis revealed that the driver, named Netfilter, was in fact a rootkit that redirected traffic to Chinese command and control (C&C) servers.
We’re looking at how our readers use VPNs with streaming sites like Netflix so we can improve our content and offer better advice. This survey won’t take more than 60 seconds of your time, and you can also choose to enter the prize draw to win a $100 Amazon voucher or one of five 1-year ExpressVPN subscriptions.
“Last week our alert system notified us of a possible false positive because we detected a driver named ‘Netfilter’ that was signed by Microsoft…In this case the detection was a true positive, so we forwarded our findings to Microsoft who promptly added malware signatures to Windows Defender and are now conducting an internal investigation,” wrote Hahn.
Malicious driver
Hahn explains that, since the launch of Windows Vista, all code that runs in the kernel space needs to be tested and signed by Microsoft. Simply put, any driver that doesn’t bear the official seal of approval from Microsoft cannot be installed “by default.”
As per Hahn’s analysis, the Netfilter driver was flagged because it didn’t appear to provide any “legitimate functionality” and was exhibiting non-normal behavior by communicating with China-based C&C IPs.
According to Bleeping Computer, Microsoft has confirmed it accidentally signed the malicious driver, which is being distributed within gaming environments.
Software supply chain threat
Hahn states that Microsoft is actively investigating how the driver managed to pass the signing process.
Bleeping Computer adds that the software giant hasn’t found evidence that the driver was signed by stolen code-signing certificates. This would seem to suggest the malicious actor got the seal of approval following due process.
This is an even more worrying prospect, as it points to chinks in Microsoft’s driver signing process that might have been exploited to poison the software supply chain, with potential ramifications for businesses of all sizes.
