Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

Security Flaws Discovered in 40 Microsoft-Certified Device Drivers

Attackers can use vulnerable drivers to escalate privilege and execute malicious code in every part of the system.

Attackers have learned that vulnerabilities can hide in the gaps: gaps between components of a system or gaps in a process or procedure. A researcher last week at DEF CON in Las Vegas showed that device drivers — the small utility applications that allow particular pieces of hardware to work with an operating system — can bridge critical gaps for legitimate hardware and malicious hackers alike.

Jesse Michael and Mickey Shkatov, both of Eclypsium, based their research on the fact that while drivers allow communication between software and hardware, they also facilitate communication between the so-called user mode and the OS kernel. And since they operate at the permission level of the kernel, they indeed can be very powerful tools.

Malware that exploits drivers isn't new, and the simple fact that a driver vulnerability is being exploited isn't novel. There have been numerous campaigns, most recently last year's LoJax malware ascribed to Sednit, which employed driver exploits.

In Michael and Shkatov's research, though, they found more than 40 drivers from at least 20 vendors — including every major BIOS vendor — had vulnerabilities. More important than the basic number was that every vulnerable driver they discovered was certified by Microsoft, nullifying one of the most basic protection mechanisms in place for Windows systems.

Each of the vulnerabilities found facilitate privilege escalation from Ring 3 to Ring 0: at this privilege level, attackers can perform kernel virtual memory access, physical memory access, MMIO access, MSR access, control register access, PCI device access, SMBUS access, and much more.

In their presentation, the researchers showed several attack scenarios, from exploiting a driver that exists on the system but is not yet loaded, to malware that brings its own drivers with counterfeit signatures. In each of these cases, the drivers, once loaded, can carry malicious kernel patches, illicit reads and writes of specific memory locations, modifications to Unified Extensible Firmware Interface (UEFI) and device firmware, and other actions that would facilitate complete system takeover.

The researchers pointed out that an attacker would need access to the system prior to exploiting a driver vulnerability. Once the initial infection is accomplished, however, the driver exploit could be a very persistent method for privilege escalation and exploit execution.

Michael and Shkatov first reported their findings to Microsoft and other vendors. Microsoft and some of the affected vendors already have issued patches for known issues, while others have not responded to the researchers.

Whether a particular vendor has patched their drivers or not, Michael and Shkatov pointed out, Windows will still allow older, unpatched drivers to run on a system, leaving risk in place until the latest version of Windows 10 is running with its new drivers.

Related Content:

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
tdsan
50%
50%
tdsan,
User Rank: Ninja
8/13/2019 | 12:11:07 PM
This is the key - "need access to the device"
If users bring in their own equipment (BYOD), this is going to be a problem. Even if the system is not connected to the private/domain network, this still gives the actor the ability to exploit the network by allowing the device to communicate with the outside world like a "Zombie" or they can utilize a cable that connects to a machine with malware (KnowBe4 showed this in an earlier video, found on youtube). It seems we may have to move our solutions to be more Linux centric but that did not help either (maybe ChromeOS, does not allow to install unknown software), not sure what the answer is here except to keep the systems update-to-date (patching), this is interesting.

It seems MS needs to do a better job of validating the drivers before stating they have been certified.

T
GitHub Named in Capital One Breach Lawsuit
Dark Reading Staff 8/14/2019
The Mainframe Is Seeing a Resurgence. Is Security Keeping Pace?
Ray Overby, Co-Founder & President at Key Resources, Inc.,  8/15/2019
The Flaw in Vulnerability Management: It's Time to Get Real
Jim Souders, Chief Executive Officer at Adaptiva,  8/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-4483
PUBLISHED: 2019-08-20
IBM Contract Management 10.1.0 through 10.1.3 and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X...
CVE-2019-4484
PUBLISHED: 2019-08-20
IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 generates an error message that includes sensitive information that could be used in further attacks against the system. IBM X-Force ID: 164068.
CVE-2019-4485
PUBLISHED: 2019-08-20
IBM Emptoris Sourcing 10.1.0 through 10.1.3, IBM Contract Management 10.1.0 through 10.1.3, and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 generates an error message that includes sensitive information that could be used in further attacks against the system. IBM X-Force ID: 164069.
CVE-2019-7593
PUBLISHED: 2019-08-20
Metasys? ADS/ADX servers and NAE/NIE/NCE engines prior to 9.0 make use of a shared RSA key pair for certain encryption operations involving the Site Management Portal (SMP).
CVE-2019-7594
PUBLISHED: 2019-08-20
Metasys? ADS/ADX servers and NAE/NIE/NCE engines prior to 9.0 make use of a hardcoded RC2 key for certain encryption operations involving the Site Management Portal (SMP).