Does anybody know if these “channel files” are signed and verified by the CS driver? Because if not, that seems like a gaping hole for a ring 0 rootkit. Yeah, you need privileges to install the channel files, but once you have it you can hide yourself much deeper in the system. If the channel files can cause a segfault, they can probably do more.

Any input for something that runs at such high privilege should be at least integrity checked. That’s the basics.

And the fact that you can simply delete these channel files suggests there isn’t even an anti-tamper mechanism.