The vulnerability of a validated and authorized driver leading to potential risks – Weekly Security Highlights with Tony Anscombe

Video

An alleged ad blocker promoted as a security measure exploits a Microsoft-approved driver, inadvertently exposing individuals to hazardous risks

21 Jul 2024

This week, ESET researchers have published their discoveries regarding HotPage, a browser injector utilizing a driver created by a Chinese firm and validated by Microsoft.

The malicious software pretends to be an “Internet café security tool” with ad-blocking features. In actuality, it showcases game-related advertisements and can alter or substitute the content of a requested page, reroute the user to another page, or launch a new page in a fresh tab under specific circumstances.

Moreover, it inadvertently creates opportunities for additional threats to execute code at the top privilege level in Windows – the SYSTEM account.

Observe as Tony delves into the narrative and clarifies why misuse of certificates remains a burning concern.

Connect with us on Facebook, Twitter, LinkedIn and Instagram.