Digitally-Signed Rootkits are Back – A Look at FiveSys and Companions

guest · Oct 21, 2021

FiveSys Rootkit Abuses Microsoft-Issued Digital Signature
October 21, 2021
https://www.securityweek.com/fivesys-rootkit-abuses-microsoft-issued-digital-signature

To prevent certain types of malicious attacks, Microsoft introduced strict requirements for driver packages that seek to receive a WHQL (Windows Hardware Quality Labs) digital signature, and starting with Windows 10 build 1607 it’s preventing kernel-mode drivers to be loaded without such a certificate.

Malware developers, however, appear to have identified a means to circumvent Microsoft’s certification and receive digital signatures for their rootkits, which allows them to target victims without raising suspicion.
Click to expand...

In June, Microsoft admitted that attackers managed to successfully submit the Netfilter rootkit for certification through the Windows Hardware Compatibility Program.

Now, Bitdefender’s researchers warn that the FiveSys rootkit too features a Microsoft-issued digital signature, suggesting that this might soon prove to be a new trend, where adversaries manage to get their malicious drivers validated and signed by Microsoft.
Click to expand...

FiveSys, the researchers say, is similar to the Undead malware that was initially detailed a couple of years ago. Furthermore, the same as Netfilter, the rootkit targets the gaming sector in China.

“The attackers seem to originate from China and target several domestic games. We can confidently attribute this campaign to several threat actors, as their tools share the same functionality but are vastly different in implementation,” Bitdefender says.
Bitdefender also notes that they have identified several user mode binaries that are used to fetch and execute the malicious drivers onto the target machines. FiveSys appears to be using a total of four drivers, yet the security researchers isolated only two of them.
Click to expand...

Microsoft revoked the signature for FiveSys, after being informed of the abuse.
Click to expand...

Bitdefender: Digitally-Signed Rootkits are Back – A Look at FiveSys and Companions
(PDF): https://www.bitdefender.com/files/News/CaseStudies/study/405/Bitdefender-DT-Whitepaper-Fivesys-creat5699-en-EN.pdf

Key Findings
» Bitdefender researchers have identified a rootkit with a Microsoft-issued digital signature;
» The rootkit is used to proxy traffic to Internet addresses that interest the attackers.
» We assume that the rootkit targets online games with the main goal of credential theft and ingame-purchase hijacking
» The rootkit has been targeting computer users for more than a year now
» Rootkit spreading is limited to China and we presume that it is operated by a threat actor with significant interest in the market.
Click to expand...

Floyd 57 · Oct 22, 2021

Good thing @cruelsister added WV to her defense arsenal, as comodo would miss this (I think?). But I wonder if WV can catch it, without signatures that is

EASTER · Oct 22, 2021

Floyd 57 said: ↑

Good thing @cruelsister added WV to her defense arsenal, as comodo would miss this (I think?). But I wonder if WV can catch it, without signatures that is
Click to expand...

Good point. And herein enters the return of the infamous rootkit(s) again. Because once success sets in, duplicates are certain to follow.

Rasheed187 · Oct 23, 2021

Floyd 57 said: ↑

Good thing @cruelsister added WV to her defense arsenal, as comodo would miss this (I think?). But I wonder if WV can catch it, without signatures that is.
Click to expand...

The defence is quite simple, simply don't allow driver loading from untrusted apps. That's what I told you in another topic, with a tool like SpyShelter you can control app behavior, similar to the permission system in Android and iOS, only way more advanced. I have been using HIPS since 2004, I started with Process Guard then System Safety Monitor and Neoava Guard and now SS.

The problem with Windows is that once some app has managed to load a malicious driver, there is no easy way to block malicious behavior anymore. And that's what makes rootkits so dangerous. So that's why M$ decided to implement PatchGuard in Windows Vista, this will at least prevent rootkits from messing around with the Windows kernel, but they still got plenty of other capabilities.

Log in or Sign up

Digitally-Signed Rootkits are Back – A Look at FiveSys and Companions

guest Guest

Floyd 57 Registered Member

EASTER Registered Member

Rasheed187 Registered Member

Log in or Sign up

Digitally-Signed Rootkits are Back – A Look at FiveSys and Companions

guest Guest

Floyd 57 Registered Member

EASTER Registered Member

Rasheed187 Registered Member

Useful Searches