A new sophisticated BYOVD attack is being carried out by malicious actors who exploit vulnerabilities in vsdatant.sys, a kernel-level driver used by ZoneAlarm antivirus .
See also: Signal phishing attacks target Ukrainian military
This Checkpoint driver, originally released in 2016 , was targeted by a Bring Your Own Vulnerable Driver (BYOVD) attack , allowing attackers to elevate their privileges and bypass critical Windows security features, such as Memory Integrity , as well as extract sensitive data from compromised systems, according to a new report from Venak Security shared with Cyber Security News.
The vsdatant.sys driver, which runs with elevated kernel, contains several vulnerabilities related to insufficient parameter validation, which have been documented since at least 2007.
These vulnerabilities could allow local users to gain elevated privileges via specially crafted Interrupt Request Packets (IRPs) and potentially execute arbitrary code.
The driver does not perform proper validation of parameters before passing them to function handlers of the connected System Service Descriptor Table (SSDT).
See also: Denmark warns of serious cyberattacks on telecommunications
The “ Bring Your Own Vulnerable Driver ” (BYOVD) technique has gained increasing popularity among cybercriminal groups .
This attack method involves loading legitimate but vulnerable driver programs onto targeted systems and then exploiting them to perform malicious actions.
«Hackers are abusing digitally signed but vulnerable drivers by bringing them onto systems and using them to terminate critical AV or EDR processes, allowing them to operate undetected in a compromised environment.».
These drivers operate in Ring 0, the most privileged level of the operating system, giving them direct access to critical memory, CPU functions, and other fundamental resources. Since security software trusts these legitimately signed drivers, they are not flagged or blocked, allowing attackers to operate with minimal detection.
See also: 100 car dealerships hit by supply chain attack
BYOVD (Bring Your Own Vulnerable Driver) attacks , such as the one affecting Checkpoint, refer to a type of cyberattack that exploits vulnerabilities in driver programs used by the operating system to control communication with computer hardware . In the case of a BYOVD attack, the attacker uses a vulnerable or malicious driver to bypass the operating system's security and gain executive privileges or other capabilities for malicious actions.
Source: cybersecuritynews
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
