Nvidia leaked Code Signing certificates Abused
Share this:
Threat actors are utilizing the stolen NVIDIA code signing certificates to sign malware to make it appear legitimate and allow malicious drivers to be loaded in Windows.
NVIDIA has confirmed that they suffered a cyberattack that allowed threat actors to steal employee credentials and proprietary data.
The extortion group, known as Lapsus$, states that they stole 1TB of data during the attack and began leaking the data online after NVIDIA refused to negotiate with them.The leak includes two stolen code-signing certificates used by NVIDIA developers to sign their drivers and executables.
A code-signing certificate allows developers to digitally sign executables and drivers so that Windows and end-users can verify the file’s owner and whether they have been tampered with by a third party. Microsoft requires kernel-mode drivers to be code signed before the operating system will load them for enhanced security.
According to the samples, the stolen certificates were used to sign various malware and hacking tools, such as Cobalt Strike beacons, Mimikatz, backdoors, and remote access trojans.
While both stolen NVIDIA certificates are expired, Windows will still allow a driver signed with the certificates to be loaded in the operating system.
Using these stolen certificates, threat actors gain the advantage of making their programs look like legitimate NVIDIA programs and allowing malicious drivers to be loaded by Windows.
To prevent known vulnerable drivers from being loaded in Windows, configure Windows Defender Application Control policies to control what NVIDIA drivers can be loaded. On other side this may have an effect of blocking the legitimate drivers.
