Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

Security Flaws Discovered in 40 Microsoft-Certified Device Drivers

Attackers can use vulnerable drivers to escalate privilege and execute malicious code in every part of the system.

Attackers have learned that vulnerabilities can hide in the gaps: gaps between components of a system or gaps in a process or procedure. A researcher last week at DEF CON in Las Vegas showed that device drivers — the small utility applications that allow particular pieces of hardware to work with an operating system — can bridge critical gaps for legitimate hardware and malicious hackers alike.

Jesse Michael and Mickey Shkatov, both of Eclypsium, based their research on the fact that while drivers allow communication between software and hardware, they also facilitate communication between the so-called user mode and the OS kernel. And since they operate at the permission level of the kernel, they indeed can be very powerful tools.

Malware that exploits drivers isn't new, and the simple fact that a driver vulnerability is being exploited isn't novel. There have been numerous campaigns, most recently last year's LoJax malware ascribed to Sednit, which employed driver exploits.

In Michael and Shkatov's research, though, they found more than 40 drivers from at least 20 vendors — including every major BIOS vendor — had vulnerabilities. More important than the basic number was that every vulnerable driver they discovered was certified by Microsoft, nullifying one of the most basic protection mechanisms in place for Windows systems.

Each of the vulnerabilities found facilitate privilege escalation from Ring 3 to Ring 0: at this privilege level, attackers can perform kernel virtual memory access, physical memory access, MMIO access, MSR access, control register access, PCI device access, SMBUS access, and much more.

In their presentation, the researchers showed several attack scenarios, from exploiting a driver that exists on the system but is not yet loaded, to malware that brings its own drivers with counterfeit signatures. In each of these cases, the drivers, once loaded, can carry malicious kernel patches, illicit reads and writes of specific memory locations, modifications to Unified Extensible Firmware Interface (UEFI) and device firmware, and other actions that would facilitate complete system takeover.

The researchers pointed out that an attacker would need access to the system prior to exploiting a driver vulnerability. Once the initial infection is accomplished, however, the driver exploit could be a very persistent method for privilege escalation and exploit execution.

Michael and Shkatov first reported their findings to Microsoft and other vendors. Microsoft and some of the affected vendors already have issued patches for known issues, while others have not responded to the researchers.

Whether a particular vendor has patched their drivers or not, Michael and Shkatov pointed out, Windows will still allow older, unpatched drivers to run on a system, leaving risk in place until the latest version of Windows 10 is running with its new drivers.

Related Content:

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
tdsan
50%
50%
tdsan,
User Rank: Ninja
8/27/2019 | 11:39:26 AM
Re: Need Access? Not hard to do if it's built in your country...
I agree with that point whole-heartedly, the supply chain process has to be improved in order to validate and verify if the existing solution has been compromised. I do think there needs to be baseline supplied by the OEM (vendor), when the system deviates from one micron or determine if there is something communicating with the outside world, then it needs to be re-examined. That will take a major budget at the very beginning to ensure the devices are measured to the nth degree before they are distributed to the public or utilize robotics to help with the measuring process.

I think we need to learn from the residual effects "Super-Micro" had on the economy - Bloomberg Article



The key will be the supply chain after we get a handle on that, then we will be able to move forward, but until then, we are just guessing.

T
Jon M. Kelley
50%
50%
Jon M. Kelley,
User Rank: Moderator
8/26/2019 | 11:12:48 AM
Need Access? Not hard to do if it's built in your country...
Access to the hardware could be hard to achieve at scale for a typical hacker or even hacking team, but within a country that builds many of the motherboards currently in use worldwide, it could easily be part of the cost of running the business. 
tdsan
50%
50%
tdsan,
User Rank: Ninja
8/13/2019 | 12:11:07 PM
This is the key - "need access to the device"
If users bring in their own equipment (BYOD), this is going to be a problem. Even if the system is not connected to the private/domain network, this still gives the actor the ability to exploit the network by allowing the device to communicate with the outside world like a "Zombie" or they can utilize a cable that connects to a machine with malware (KnowBe4 showed this in an earlier video, found on youtube). It seems we may have to move our solutions to be more Linux centric but that did not help either (maybe ChromeOS, does not allow to install unknown software), not sure what the answer is here except to keep the systems update-to-date (patching), this is interesting.

It seems MS needs to do a better job of validating the drivers before stating they have been certified.

T
Navigating Security in the Cloud
Diya Jolly, Chief Product Officer, Okta,  12/4/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19551
PUBLISHED: 2019-12-06
In userman 13.0.76.43 through 15.0.20 in Sangoma FreePBX, XSS exists in the User Management screen of the Administrator web site. An attacker with access to the User Control Panel application can submit malicious values in some of the time/date formatting and time-zone fields. These fields are not b...
CVE-2019-19552
PUBLISHED: 2019-12-06
In userman 13.0.76.43 through 15.0.20 in Sangoma FreePBX, XSS exists in the user management screen of the Administrator web site, i.e., the/admin/config.php?display=userman URI. An attacker with sufficient privileges can edit the Display Name of a user and embed malicious XSS code. When another user...
CVE-2019-19620
PUBLISHED: 2019-12-06
In SecureWorks Red Cloak Windows Agent before 2.0.7.9, a local user can bypass the generation of telemetry alerts by removing NT AUTHORITY\SYSTEM permissions from a malicious file.
CVE-2019-19625
PUBLISHED: 2019-12-06
SROS 2 0.8.1 (which provides the tools that generate and distribute keys for Robot Operating System 2 and uses the underlying security plugins of DDS from ROS 2) leaks node information due to a leaky default configuration as indicated in the policy/defaults/dds/governance.xml document.
CVE-2019-19627
PUBLISHED: 2019-12-06
SROS 2 0.8.1 (after CVE-2019-19625 is mitigated) leaks ROS 2 node-related information regardless of the rtps_protection_kind configuration. (SROS2 provides the tools to generate and distribute keys for Robot Operating System 2 and uses the underlying security plugins of DDS from ROS 2.)