A counterfeit LastPass Authenticator installer available on GitHub installs a Windows kernel driver that disables antivirus and other security applications before a password theft program executes, according to researchers from LastPass and Delphos Labs on September 17.
The driver is signed by Microsoft’s hardware compatibility program, received zero detections on VirusTotal during an August check by researchers, and is not included on Microsoft’s list of blocked drivers. LastPass asserts that none of its systems, services, or customer vaults were compromised, and that the attackers merely appropriated its name.
The bait is a fraudulent GitHub page (github.com/LastPass-Authenticator) that appears in search results for queries like “LastPass Authenticator download” and resembles a legitimate LastPass product page.
Clicking the download button redirects the user through multiple GitHub pages to an attacker’s server, which delivers a large ZIP file. The authentic LastPass Authenticator can be obtained from lastpass.com and official app stores, not GitHub.
Within the ZIP file is a renamed version of a genuine Microsoft debugging tool, vsdbg.exe, placed alongside a malicious file named vsdbg.dll. When the counterfeit installer is executed, Windows loads the attacker’s DLL from the same directory, utilizing a technique known as DLL side-loading. The loader then attempts three methods to obtain administrator privileges, ultimately achieving SYSTEM access, the highest level on a Windows system, and installs the kernel driver as a service.
The archives observed were 148 MB and 127.9 MB, filled with junk files to evade scanners with size limitations.
What the driver does, and why Windows accepts it
A kernel driver operates beneath the level where antivirus and endpoint detection and response (EDR) tools function. This particular driver, identified by researchers as Alinubx.sys, contains a list of 145 antivirus and security process names and terminates each one it detects as running.
It executes this from the kernel, below the level where security software operates, rendering those user-mode tools incapable of blocking or detecting the termination. Utilizing a legitimately signed but exploitable driver to gain such access is a recognized method known as bring your own vulnerable driver, or BYOVD, which has been previously reported by The Hacker News.
The driver is signed through the Microsoft Windows Hardware Compatibility Publisher chain, with a signing date of March 2023, well before this campaign. As the researchers noted, “Microsoft attestation confirms a driver has passed through a trust pipeline. It does not guarantee the driver is safe.”
The kill list is the only component of the driver that was active in this instance. Its code is also capable of hiding files, injecting into other applications, and redirecting web traffic, but these functions require a configuration file that the attackers did not provide, so they remained inactive.
What it did accomplish was sufficient. With security software disabled, the stealer gathered saved passwords from over two dozen browsers, cryptocurrency wallet files, and login sessions for Discord, Steam, and Telegram, in addition to the contents of Windows Credential Manager and files named “password,” “seed,” or “recovery.”
For Chrome and Edge, which utilize Google’s app-bound encryption to prevent this exact scenario, the stealer injects code into the browser and requests the browser’s own service to decrypt the passwords. The data is then compressed into a ZIP file and sent to an attacker’s server.
Why nothing detected it
The driver is a renamed version of CcProtect.sys, a driver from the Chinese disk-encryption software CnCrypt that is already cataloged on LOLDrivers as a process killer, with publicly available proof-of-concept code. The two share the same product name, version, and submitter; only the file name and description have changed.
This alteration reduced the file’s antivirus detections: the known original had 7 out of approximately 70 engines flagging it in August, while the renamed driver had none.
The blocklist presents a different issue. Microsoft’s vulnerable driver blocklist, which has been enabled by default since the Windows 11 2022 update, prevents listed drivers from loading. Delphos examined it on August 20 and found neither the renamed driver nor the known original listed.
Source: Original article
