Because of leaked data linked to an Nvidia hack by a group calling itself Lapsus$, stolen code-g certificates are being used to gain remote access to unsuspecting machines, and otherwise deploy malicious software.
According the Techpowerup, the certificates are being used to "develop a new breed of malware," and BleepingComputer lists Cobalt Strike beacons, Mimikatz, backdoors, and Remote Access Trojans (RATs) as just some of the malware being deployed by this means.
If you're not aware, a code-g certificate is something devs use to sign off executable files and drivers before rolling them out to the public. It's a more secure way for Windows and prospective s to the ownership of the original file. Microsoft requires kernel-mode drivers to be code signed, otherwise the OS will refuse to open the file.
If some hooligan signs off malware with a genuine code from Nvidia, your PC may not be able to catch the malware before it unpacks, and wreaks havoc on your system.
The recent digital siege of Nvidia saw Lapsus$ next-gen GeForce GPU names.
As part of the #NvidiaLeaks, two code g certificates have been compromised. Although they have expired, Windows still allows them to be used for driver g purposes. See the talk I gave at BH/DC for more context on leaked certificates: https://t.co/UWu3AzHc66 pic.twitter.com/gCrol0BxHdMarch 3, 2022
Best PC controller: sit back, relax, and get your game on
Of course, it didn't take long for the leaked certificate codes to the arsenal for hackers lurking around the web, who pounced on the potential to hide behind Nvidia's genuine codes in order to carry out their malevolent plans.
Now the codes are being used to sign certificates for Windows drivers, along with Quasar RATs, as VirusTotal shows currently, "46 security vendors and 1 sandbox flagged this file as malicious."
BleepingComputer, thanks to the keen reporting of security researchers Kevin Beaumont and Will Dormann, notes the following serial numbers as those to look out for:
- 43BB437D609866286DD839E1D00309F5
- 14781bc862e8dc503a559346f5dcc518
Both codes are effectively expired Nvidia signatures, but your OS will still let them just the same. Just something to keep an eye on if you're thinking of ing a file you think may have been tampered with.
There are ways to tell Windows not to allow these signed codes through, but may well be awkward to implement if you don't have a history in IT. They may also be a pain when you actually come to install a legitimately signed Nvidia driver.
As always, stay safe out there.
