The driver's seat to ransomware. [Research Saturday]

Key takeaways

Legacy drivers are a significant security risk because they are often overprivileged and difficult to revoke once signed.
BYOVD attacks, which leverage legitimate signed drivers with known vulnerabilities, are widely used by advanced threat actors to escalate privileges and disable security tools.
Disabling EDRs from kernel space requires sophisticated exploits, such as the zero-day discussed, which bypass typical security protections.
Organizations should consider implementing Windows Defender Application Control (WDAC) to prevent unauthorized drivers from loading, despite deployment challenges.
Maintaining an asset inventory and controlling driver signatures can help reduce attack surface and prevent exploitation of legacy drivers.
Threat actors like The Gentlemen have extensive exploit arsenals, complicating defenses and emphasizing the need for layered security measures.

Summary

Introduction and Context of the Research

The episode opens with host Dave Bittner introducing the focus of this Research Saturday, which is an analysis of a zero-day exploit used by the ransomware group known as The Gentlemen to disable endpoint detection and response (EDR) tools. Marcus Hutchins from Expel discusses his team's investigation into this exploit, which involves sophisticated techniques to evade Windows security protections and gain kernel-level access.

Technical Breakdown of the Exploit

Marcus Hutchins explains that the exploit is a zero-day vulnerability in a legacy Windows driver, referred to as a Bring Your Own Vulnerable Driver (BYOVD). Attackers exploit legitimate, digitally signed drivers that contain vulnerabilities, allowing them to perform kernel mode code execution. The specific driver discussed, KTAPI.SIS, was found to be a 'God mode' driver with overprivileged capabilities. The exploit involves redirecting kernel functions to malicious code, enabling privilege escalation.

Implications and Defensive Strategies

Disabling EDRs is crucial for ransomware attackers because modern EDRs can detect patterns typical of ransomware activities. The exploit allows malicious actors to disable detection tools directly from kernel memory. Marcus emphasizes that the widespread use of legacy drivers and the difficulty in revoking or updating their signatures leave many systems vulnerable. He advocates for application allow-listing, specifically Windows Defender Application Control (WDAC), to mitigate these threats, despite its deployment challenges.

Research Methodology and Discovery Process

Marcus describes his process of reverse-engineering the suspicious file named 'WER.exe' found on a privileged network domain controller. By analyzing the file, he identified references to the malicious driver and verified its presence on VirusTotal. He details how he examined the driver and discovered its severe vulnerability—allowing arbitrary memory read/write. He then elaborates on how the exploit uses manipulation of kernel functions and unsafe driver capabilities to escalate privileges.

Sophistication of the Exploit and Threat Actor Capabilities

Analysis revealed that the exploit was notably sophisticated, involving bypasses for Windows security features such as Supervisor Mode Execution Prevention. Marcus notes similarities to techniques used in game cheats, indicating a high level of technical skill. The group behind the exploit appears to maintain a large arsenal of kernel exploits, potentially developed in-house or sourced from exploit markets, enabling them to rapidly adapt to security measures.

Lessons for Defenders and Future Outlook

The main lesson for defenders is that legacy driver vulnerabilities continue to be a significant risk due to the difficulty in removing or controlling signed drivers. Marcus recommends enabling Windows Defender Application Control (WDAC) to prevent unauthorized drivers from loading. He discusses the challenges of asset inventory and the complex process required to implement effective kernel-level protections and suggests that Microsoft could improve security by segmenting kernel space for trusted drivers. The importance of balancing transparency and security in public research is also touched upon.

Insights on The Gentleman Ransomware Group

The research indicates that The Gentlemen group possesses an extensive collection of kernel exploits, suggesting they have dedicated teams or sources for development. They demonstrate a high level of sophistication in their attack techniques, which poses a significant threat to organizations relying on legacy drivers and traditional defenses.

Key Takeaways for Security Practitioners

The podcast concludes with Marcus emphasizing the importance of application allow-listing tools like WDAC, understanding the limitations of legacy drivers, and the need for organizations to maintain up-to-date asset inventories. He highlights that while complete security is hard to achieve, adopting layered protections focusing on kernel security and driver management remains essential.

Show notes

This week, we are joined by Marcus Hutchins, Principal Threat Researcher at Expel, sharing their work on "Not very gentlemanly: Analyzing a zero-day exploit used by The Gentlemen ransomware to disable targets’ EDRs." Researchers examine how the Gentlemen ransomware group used a previously unknown zero-day vulnerability in a legacy Windows driver to disable endpoint detection and response (EDR) tools before deploying ransomware. The report details the group's advanced bring-your-own-vulnerable-driver (BYOVD) techniques, which bypass multiple Windows security protections to gain kernel-level access and terminate protected security software. It also outlines defensive measures organizations can take, including enabling Windows Defender Application Control (WDAC), virtualization-based security (VBS), and vulnerable driver blocklists to reduce the risk of similar attacks.

The research and executive brief can be found here:

Not very gentlemanly: Analyzing a zero-day exploit used by The Gentlemen ransomware to disable targets’ EDRs

Learn more about your ad choices. Visit megaphone.fm/adchoices