Microsoft confirmed that it gave its seal of approval to Netfilter, a malicious driver used to distribute rootkit malware, as part of its Windows Hardware Compatibility Program (WHCP).
BleepingComputer reported that Netfilter was publicly disclosed by G Data researcher Karsten Hahn on June 17. The Microsoft Security Response Center officially recognized the issue on June 25; Hahn offered more information about how the malware functioned that same day.
“Since Windows Vista, any code that runs in kernel mode is required to be tested and signed before public release to ensure stability for the operating system,” Hahn said in the followup blog post. “Drivers without a Microsoft certificate cannot be installed by default.”
That’s why attackers sometimes attempt to compromise the WHCP signing certificate. It’s much easier to distribute malware that appears to have been signed by Microsoft. In this case, however, Microsoft said the Netfilter driver was legitimately signed as part of the WHCP.
BleepingComputer characterized this mistake as a “supply-chain fiasco” because it showed even rootkit malware can receive Microsoft’s approval via the WHCP. What’s the point of blocking drivers that aren’t signed by Microsoft if even officially sanctioned drivers can be malicious?
Microsoft, for its part, downplayed the impact of this campaign. The company said the attack was only effective post exploitation because “an attacker must either have already gained administrative privileges in order to be able to run the installer to update the registry and install the malicious driver the next time the system boots or convince the user to do it on their behalf.”
The company also said “the actor’s activity is limited to the gaming sector specifically in China” and that “the malware enables them to gain an advantage in games and possibly exploit other players by compromising their accounts through common tools like keyloggers.”
Microsoft said it has suspended the account of an unidentified third party who built the Netfilter driver, blocked the driver via Microsoft Defender for Endpoint, and shared information “with other AV security vendors so they can proactively deploy detections” to their products.
Instructions for determining if a system has been affected by Netfilter can be found in Microsoft’s blog post. The company said it “will be sharing an update on how we are refining our partner access policies, validation and the signing process to further enhance our protections” in light of this incident but didn’t say when exactly it plans to share that information.
