Hackers are Exploiting an Old Intel Driver Flaw

Researchers from CrowdStrike say that hackers are actively exploiting a seven-year-old improper input validation vulnerability in the Intel Ethernet diagnostics driver for Windows. The attackers are using the flaw to deploy a malicious kernel driver.

Note

• The exploit requires administrative access to the system, often accomplished by a combination of credential capture (to include OTP tokens), and once on they take advantage of the loophole allowing BYOVD to work. In addition to applying current security fixes from Microsoft which are making this harder, also make sure your EDR solution is able to detect and block this activity. Read the CrowdStrike blog to both gather IOC’s for hunting, and the type of capabilities your EDR would leverage when you’re verifying that you are covered.
• Hackers will always be exploiting “old…flaws.” We should know by now that a significant number of instances of popular products will never be patched. Even if it was effective, patching is an inefficient way to attain quality.

Read more in

• SCATTERED SPIDER Exploits Windows Security Deficiencies with Bring-Your-Own-Vulnerable-Driver Tactic in Attempt to Bypass Endpoint Security
• CVE-2015-2291 Detail