Stolen Nvidia code signing certificates used to sign off malware

Malware
(Image credit: solarseven / Shutterstock)

A number of potentially dangerous malware strains have successfully snuck past antivirus software, thanks to highjacking signing certificates stolen from Nvidia.

The Lapsus$ cybercrime gang recently announced it had stolen a terabyte of data from the chip giant, and after failing to come to an agreement with the company on a ransom payment, decided to push the stolen intel live.

As researchers started to scour through the treasure trove of sensitive information, they discovered two code-signing certificates that Nvidia developers use to sign their drivers and executables. These security measures help Windows endpoints verify who built any specific app or program, as well as verifying nothing has been tampered with.

TechRadar needs you!

We're looking at how our readers use VPNs with different devices so we can improve our content and offer better advice. This survey shouldn't take more than 60 seconds of your time. Thank you for taking part.

>> Click here to start the survey in a new window <<

Malware passing off as legit software

Cross-referencing the stolen certificates with their database, the researchers were quick to find them being used to sign malware and other malicious tools. 

As reported on the VirusTotal malware scanning service, the certificates were used to sign Cobalt Strike beacons, Mimikatz, as well as various backdoors, remote access trojans, and other malware.

According to security researchers Kevin Beaumont and Will Dormann, the stolen certificates can be found under these serial numbers:

43BB437D609866286DD839E1D00309F5

14781bc862e8dc503a559346f5dcc518

Both certificates have reportedly already expired, but that won’t stop Windows allowing a driver signed with these, to be loaded in the OS.

There are ways to configure Windows Defender Application Control policies to eliminate compromised Nvidia drivers, but as BleepingComputer says, it’s “not an easy task, especially for non-IT Windows users”, who need to wait for the certificates to be added to Microsoft’s certificate revocation list.

Lapsus$ is making a name for itself, rather quickly. Having targeted Impresa, Portugal’s biggest media conglomerate, late last year, taking down multiple websites, TV channels, AWS infrastructure, and Twitter accounts, it also struck the websites of Brazil’s Ministry of Health (MoH), suspending Covid-19 vaccination efforts across the country. It claimed to have stolen 50TB worth of data, before deleting them from the MoH’s servers.

In the Nvidia attack, the group claims to have taken login information, and other sensitive data on tens of thousands of Nvidia employees. It also says the data helped it build a tool to eliminate the hash rate limiter for the RTX 3000 GPU, which can be used to mine Ether with just 50% of capacity.

It also released 190GB of sensitive data stolen from Samsung which, if proven authentic, could be one of the more damaging data leaks to occur this year.

Via: BleepingComputer

TOPICS

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

Read more
A computer being guarded by cybersecurity.
Huge cyberattack found hitting vulnerable Microsoft-signed legacy drivers to get past security
An American flag flying outside the US Capitol building against a blue sky
US military and defense contractors hit with Infostealer malware
A digital representation of a lock
Security experts are being targeted with fake malware discoveries
Pirate skull cyber attack digital technology flag cyber on on computer CPU in background. Darknet and cybercrime banner cyberattack and espionage concept illustration.
Huge cybercrime attack sees 390,000 WordPress websites hit, details stolen
A white padlock on a dark digital background.
Developers targeted by malicious Microsoft VSCode extensions
Pirate skull cyber attack digital technology flag cyber on on computer CPU in background. Darknet and cybercrime banner cyberattack and espionage concept illustration.
Microsoft reveals over a million PCs hit by malvertising campaign
Latest in Security
Data Breach
Thousands of healthcare records exposed online, including private patient information
China
Juniper patches security flaws which could have let hackers take over your router
Representational image depecting cybersecurity protection
GitLab has patched a host of worrying security issues
Ai tech, businessman show virtual graphic Global Internet connect Chatgpt Chat with AI, Artificial Intelligence.
AI agents can be hijacked to write and send phishing attacks
China
Volt Typhoon threat group had access to American utility networks for the best part of a year
Abstract image of cyber security in action.
MassJacker malware targets those looking for pirated software
Latest in News
Three iPhone 16 handsets on show
Apple could launch an iPhone 17 Ultra this year – but we've heard these rumors before
Super Mario Odyssey
ChatGPT is the ultimate gaming tool - here's 4 ways you can use AI to help with your next playthrough
Ray-Ban smart glasses with the Cpperni logo, an LED array, and a MacBook Air with M4 next to ecah other.
ICYMI: the week's 7 biggest tech stories from Twitter's massive outage to iRobot's impressive new Roombas
Brad Pitt looks over his right shoulder with &#039;F1&#039; written behind him
Apple Original Films will take you behind-the-scenes of a racing cockpit in this new thrilling F1 movie trailer
AI writer
Coding AI tells developer to write it himself
Reacher looking down at another character from the Prime Video TV series Reacher
Reacher season 3 becomes Prime Video’s biggest returning show thanks to Hollywood’s biggest heavyweight