Several Microsoft hardware developer accounts have been revoked after drivers certified through their profiles were used for cyber crimes, including ransomware attacks.<\/p>\n
Mandiant<\/a><\/strong>, Sophos<\/a><\/strong>, and SentinelOne<\/a><\/strong> notified Microsoft of the malicious activity, and the companies revealed the issue in a coordinated disclosure.<\/p>\n “Microsoft was informed that drivers certified by Microsoft’s Windows Hardware Developer Program were being used maliciously in post-exploitation activity,” Microsoft said in its security advisory<\/a><\/strong>.<\/p>\n “In these attacks, the attacker had already gained administrative privileges on compromised systems prior to use of the drivers.”<\/p>\n Microsoft said that it was notified of the activity in October. However, the coordinated disclosure occurred on 13 December 2022 after Microsoft completed its investigations.<\/p>\n “This investigation revealed that several developer accounts for the Microsoft Partner Center were engaged in submitting malicious drivers to obtain a Microsoft signature,” it said.<\/p>\n “A new attempt at submitting a malicious driver for signing on September 29th, 2022, led to the suspension of the sellers’ accounts in early October.”<\/p>\n According to Bleeping Computer<\/a><\/strong>, kernel-mode hardware drivers are assigned the highest privilege level when loaded in Windows, allowing them to perform various malicious activities, including eliminating security software and deleting protected files.<\/p>\n Microsoft made the signing of kernel-mode hardware drivers through its Windows Hardware Developer Program since Windows 10, released in July 2015.<\/p>\n Mandiant and SentinelOne reported on the discovery of “POORTRY” and “STONESTOP” malware that can terminate antivirus and Endpoint Detection and Response (EDR) processes.<\/p>\n STONESTOP is a user-mode application that tries to terminate endpoint security processes and acts as both a loader and installer for POORTRY.<\/p>\n POORTRY is a Microsoft-signed kernel-mode driver that terminates associated processes and Windows services.<\/p>\n “STONESTOP functions as both a loader\/installer for POORTRY, as well as an orchestrator to instruct the driver with what actions to perform,” SentinelOne explained.<\/p>\n Another STONESTOP variant can overwrite and delete files.<\/p>\n Drivers certified through Microsoft’s Windows Hardware Developer Program were used in cyberattacks, including ransomware incidents.<\/p>\n","protected":false},"author":341076,"featured_media":465441,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[27],"tags":[801,73696,123,30150,80863,765,83311],"class_list":["post-474163","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-malware","tag-mandiant","tag-microsoft","tag-ransomware","tag-sentinelone","tag-sophos","tag-windows-hardware-developer-program"],"_links":{"self":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/474163"}],"collection":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/users\/341076"}],"replies":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/comments?post=474163"}],"version-history":[{"count":1,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/474163\/revisions"}],"predecessor-version":[{"id":474173,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/474163\/revisions\/474173"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media\/465441"}],"wp:attachment":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media?parent=474163"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/categories?post=474163"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/tags?post=474163"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\nNow read: Google defeats lawsuit claiming it tracked users without permission<\/a><\/h2>\n","protected":false},"excerpt":{"rendered":"