PSA If you haven't focused on the #Nvidialeaks and you work with any defense in depth teams, please take the time to today
For ones it appears Nvidia driver signing controls & certs were leaked & private API that allows for potential abuse
Attackers already planning to use this
For ones it appears Nvidia driver signing controls & certs were leaked & private API that allows for potential abuse
Attackers already planning to use this
This will definitely go beyond anti cheat development.
My guess is ransomware teams will have this adapted later this week in their tools.
Depending on their scrum master and sprint status of course
My guess is ransomware teams will have this adapted later this week in their tools.
Depending on their scrum master and sprint status of course
As of now it seems anti cheat software have actually rolled out protection for it faster than antivirus and edr.
Funny how when a company's actual livelihood is affected how fast they will roll out mitigation
Funny how when a company's actual livelihood is affected how fast they will roll out mitigation
Things to look for in upcoming malware releases:
- Stolen/abused Nvidia certs
- packaging/distributing Nvidia files to leverage API abuse
- Nvidia detection and scanning for API to abuse
Further down the road we can expect some privilege elevation attacks likely.
- Stolen/abused Nvidia certs
- packaging/distributing Nvidia files to leverage API abuse
- Nvidia detection and scanning for API to abuse
Further down the road we can expect some privilege elevation attacks likely.
Driver signing using certs is exactly the scenario I was thinking as @BillDemirkapi said.
Ensure you block both certificates and keep your eyes peeled for NVIDIA signed files being deployed outside of %AppData%, %Program Files%.
Attackers can use %temp% - which might be valid
Ensure you block both certificates and keep your eyes peeled for NVIDIA signed files being deployed outside of %AppData%, %Program Files%.
Attackers can use %temp% - which might be valid
• • •
Missing some Tweet in this thread? You can try to
force a refresh
