News for hackers. Stuff that matters.

A comment on Microsoft admits to signing rootkit malware in supply-chain fiasco. Parent comment

Re:Microsoft admits to signing rootkit malware in supply-cha... by ryukafalz on Saturday June 26, 2021 @11:10AM (#27642528)
Whoa, that's a really scary example that would be great to point people to to show why this stuff is so bad. Can you link to more info about this?
[ Parent | on HN ]
Re:Microsoft admits to signing rootkit malware in supply-cha... by meibo on Saturday June 26, 2021 @11:20AM (#27642634)
Here's a PoC for it on GitHub, you can read the code, it's pretty much just an IOCTL for each operation. Check Driver/MhyProt2.cs.

https://github.com/kagurazakasanae/Mhyprot2DrvControl

[ Parent | on HN ]
Re:Microsoft admits to signing rootkit malware in supply-cha... by ryukafalz on Saturday June 26, 2021 @11:42AM (#27642822)
Yikes! Thank you!
[ Parent | on HN ]