I’m not sure that’s necessarily true with enforcement of driver signing.
Comment on Microsoft waited 6 months to patch actively exploited admin-to-kernel vulnerability
RavuAlHemio@lemmy.world 8 months ago
Doesn’t having admin privileges mean you can load any driver into the kernel anyway, including blatantly malicious drivers?
henfredemars@infosec.pub 8 months ago
hddsx@lemmy.ca 8 months ago
Why’s that? I thought admin could override that
henfredemars@infosec.pub 8 months ago
You generally cannot load whatever you want into the kernel as admin on Windows.
You have to either disable secure boot to enable changing it via command prompt, or you have to boot into a special recovery mode first that verifies you have physical access to turn it off.
Linux with secure boot is similar. Root cannot patch the kernel (without a bug). The kernel lockdown feature is activated, which enforces code signing. You have to use your physical access to change the UEFI setting to disable secure boot first or use a MOK to enable signing your own modules in such a way the secure boot chain accepts them.
hddsx@lemmy.ca 8 months ago
Huh. I must be outdated. I didn’t know they got secure boot working. So what do you do when you need to update your kernel? Or does the fact that it comes from the package manager mean that it is allowed to update that?
runefehay@kbin.social 8 months ago
It is part of the SSSCA / CBDTPA / "Trusted" computing initiative. The large corporations want to control what you are allowed to do with your computer. This is where the phrase "digital rights management" comes from.
Car@lemmy.dbzer0.com 8 months ago
Pretty much. This is one particular form of damage control for an attacker who has the keys to your system. I think there were more urgent security concerns that occur in the untrusted zone.
Limonene@lemmy.world 8 months ago
Microsoft has enforced mandatory digital signatures for drivers, and getting a digital signing key from Microsoft costs a ton of money. So, presumably they do care.
In contrast, consider nProtect GameGuard, the anti-cheat system in Helldivers 2. It is a rootkit, and runs in the kernel. Why does Microsoft permit this? Shouldn’t this be blocked? It must be using either an exploit like the article, or a properly signed driver. Either way, Microsoft could fix it – by patching the exploit, or revoking the signing key.
The fact that Microsoft hasn’t done anything about malicious anticheat rootkits is a sign that they really don’t care. They just want their payment.
SteveTech@programming.dev 8 months ago
I might be completely wrong, but I’ve heard that a key is only a few hundred dollars, and once you’ve got it you can sign whatever you want. I think ReactOS also used to offer free driver signing for open source projects.
So I guess if ReactOS can afford one, so can most anti-cheat companies.
fluxion@lemmy.world 8 months ago
I think what we’re trying to say here is FUCK kernel-based anticheat systems!