Stories
Slash Boxes
Comments

SoylentNews is people

posted by Fnord666 on Sunday August 11 2019, @01:13PM   Printer-friendly
from the can't-drive-a-manual-either dept.

Submitted via IRC for AnonymousCoward

Driver Disaster: Over 40 Signed Drivers Can't Pass Security Muster

An insecure driver can be just what a hacker needs to get its foot in the door to a Windows environment. Compromised drivers are at the heart of massive security headaches ranging from recent Slingshot APT campaigns and LoJax malware. That’s why researchers at Eclypsium are sounding the alarm over what it sees as a dire security problem of insecure drivers digitally signed by reputable firms such as Microsoft.

At a session here at DEF CON on Saturday, Eclypsium’s principal researcher Mickey Shkatov was joined by researcher Jesse Michael and both shed light on research that showed that the problem of insecure drivers is widespread, affecting more than 40 drivers from at least 20 different vendors – all drivers being certified by Microsoft.

“These vulnerabilities allow the driver to act as a proxy to perform highly privileged access to the hardware resources and move an attacker from user mode to OS kernel mode,” researchers noted. They added that the vulnerabilities are widespread, impacting major BIOS vendors, as well as hardware sold by ASUS, Toshiba, NVIDIA and Huawei.

Researchers said they first pinpointed the issue in April when they culled 40 insecure drivers representing 20 vendors. They then gave offending companies a 90-day window to mitigate the issues. All 40 drivers are unique and 64-bit and signed by two separate vendors, researchers said.

“Some of the most dangerous [insecure driver attack scenarios] are arbitrary read/write of kernel memory, arbitrary read/write of model specific registers (MSRs), and arbitrary read and write of physical memory as these can all be used to achieve arbitrary code execution within the Windows kernel,” researchers told Threatpost.

Shkatov added that arbitrary hardware access via an insecure driver can allow malicious modification of firmware components, resulting in persistent subversion of existing Windows AV protection. Such was the case in March when Huawei MateBook systems included a rogue driver that let unprivileged users create processes with superuser privileges.


Original Submission

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 3, Informative) by AthanasiusKircher on Sunday August 11 2019, @08:44PM

    by AthanasiusKircher (5291) on Sunday August 11 2019, @08:44PM (#878971) Journal

    Assuming you're not just trolling...

    I installed Ubuntu MATE 18 on my x64 desktop.

    That's your problem, right there. Ubuntu's promise was always "just works." I'll admit I bought into that when I downloaded Ubuntu for the first time maybe 12-13 years ago. That was when I decided to finally go whole hog and abandon Windows completely. (I'd been using Linux here and there and doing some dual-boot since maybe 1998 or so.)

    Ubuntu took a little tweaking, but from my previous experience getting Linux distros going, I was used to that. Then I upgraded to the next version 6 months later, and everything broke. Then I fixed it. Then I upgraded 6 months later, and everything broke -- but mostly different things than were broken before. After it happened a third time, I quit Ubuntu (which at that point seemed more obsessed with making sure "wobbly windows" were working rather than actually having basic functionality) and went back to Debian for my primary machine. There -- everything pretty much just worked. It was old, but it worked.

    A year or two later, after a bunch of distro hopping to try to find a better solution, I got a recommendation about Mint. So I tried it, and everything just worked. I installed it on two other machines (including a rather non-standard laptop), and everything pretty much just worked. I haven't looked back, and I was happy I switched when I did, because then a little while later Ubuntu switched to Unity and annoyed the heck out of most users.

    Jesus christ, what happened to Linux?! It was doing quite well for awhile. Now you have to be fucking Rain Man just to install it!

    Don't get me wrong -- I enjoy tweaking things and playing around sometimes. Heck, one of my favorite distros years ago was Gentoo. But when I want something that "just works," or I have to recommend something to a friend new to Linux, I recommend Mint. I've converted probably a half dozen people to Linux users over the past few years by recommending Mint when they complain their machine is getting old or running slow and Windows sucks. Ubuntu has had greater stability at times (so I've heard), but then weird crap happens again. I don't have time for that.

    YMMV.

    Starting Score:    1  point
    Moderation   +1  
       Informative=1, Total=1
    Extra 'Informative' Modifier   0  
    Karma-Bonus Modifier   +1  

    Total Score:   3