SFV can now read or change any file on any drive, or steal information from any other software currently running on your computer. To make matter worse, the driver then “disables supervisor-mode execution protection and then runs the arbitrary code passed in through the ioctl buffer with kernel permissions.”Īnother redditor, Oxidopamine, offered this excellent summary of what this rootkit is capable of:īasically, the highest possible level of access you could grant any piece of software.
“A driver that didn't set up basic security when creating its device should perform security checks when opening the device,” writes extrwi. “It also doesn't specify any security, so any user at any privilege level can attempt to open and control the device.”Įxtrwi goes on to write that it sets up a few custom handlers for opening the device object, however, Capcom for reasons unbeknownst to us made a critical blunder.
That's kind of suspicious,” writes extrwi. “The driver first registers itself using a pseudo-randomly generated name. The update puts capcom.sys in your System32 directory and in essence provides backdoor access to your PC, allowing a non-privileged user to run code. Redditor LoGicMoTion issued a warning to gamers that the latest update for the Windows version of the game was attempting to gain kernel level access to the operating system.
Gamers that downloaded the latest update for Capcom’s Street Fighter V are getting quite a bit more than they bargained for - an unsecured rootkit.
0 kommentar(er)
