The vulnerability exposed by an authorized and certified driver to potential threats – Security Week featuring Tony Anscombe

Video

A supposed ad blocker positioned as a security alternative capitalizes on a Microsoft-approved driver, unwittingly putting individuals at risk of perilous threats

21 Jul 2024

This current week, ESET analysts have unveiled their discoveries concerning HotPage, a browser plugin that employs a driver crafted by a Chinese organization and validated by Microsoft.

The malicious software disguises itself as an “Internet café protection mechanism” with ad-blocking functionalities. However, in actuality, it showcases ads related to games and can alter or substitute the content of a requested page, steer the user to an alternate page, or launch a new page in a fresh tab depending on specific circumstances.

Furthermore, it inadvertently creates an opportunity for other threats to execute commands at the highest privilege level in Windows – the SYSTEM account.

Observe as Tony delves into the narrative and elucidates on the persistence of certificate misuse as a critical dilemma.

Engage with us on Facebook, Twitter, LinkedIn, and Instagram.