Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

Security Flaws Discovered in 40 Microsoft-Certified Device Drivers

Attackers can use vulnerable drivers to escalate privilege and execute malicious code in every part of the system.

Attackers have learned that vulnerabilities can hide in the gaps: gaps between components of a system or gaps in a process or procedure. A researcher last week at DEF CON in Las Vegas showed that device drivers — the small utility applications that allow particular pieces of hardware to work with an operating system — can bridge critical gaps for legitimate hardware and malicious hackers alike.

Jesse Michael and Mickey Shkatov, both of Eclypsium, based their research on the fact that while drivers allow communication between software and hardware, they also facilitate communication between the so-called user mode and the OS kernel. And since they operate at the permission level of the kernel, they indeed can be very powerful tools.

Malware that exploits drivers isn't new, and the simple fact that a driver vulnerability is being exploited isn't novel. There have been numerous campaigns, most recently last year's LoJax malware ascribed to Sednit, which employed driver exploits.

In Michael and Shkatov's research, though, they found more than 40 drivers from at least 20 vendors — including every major BIOS vendor — had vulnerabilities. More important than the basic number was that every vulnerable driver they discovered was certified by Microsoft, nullifying one of the most basic protection mechanisms in place for Windows systems.

Each of the vulnerabilities found facilitate privilege escalation from Ring 3 to Ring 0: at this privilege level, attackers can perform kernel virtual memory access, physical memory access, MMIO access, MSR access, control register access, PCI device access, SMBUS access, and much more.

In their presentation, the researchers showed several attack scenarios, from exploiting a driver that exists on the system but is not yet loaded, to malware that brings its own drivers with counterfeit signatures. In each of these cases, the drivers, once loaded, can carry malicious kernel patches, illicit reads and writes of specific memory locations, modifications to Unified Extensible Firmware Interface (UEFI) and device firmware, and other actions that would facilitate complete system takeover.

The researchers pointed out that an attacker would need access to the system prior to exploiting a driver vulnerability. Once the initial infection is accomplished, however, the driver exploit could be a very persistent method for privilege escalation and exploit execution.

Michael and Shkatov first reported their findings to Microsoft and other vendors. Microsoft and some of the affected vendors already have issued patches for known issues, while others have not responded to the researchers.

Whether a particular vendor has patched their drivers or not, Michael and Shkatov pointed out, Windows will still allow older, unpatched drivers to run on a system, leaving risk in place until the latest version of Windows 10 is running with its new drivers.

Related Content:

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
tdsan
50%
50%
tdsan,
User Rank: Ninja
8/27/2019 | 11:39:26 AM
Re: Need Access? Not hard to do if it's built in your country...
I agree with that point whole-heartedly, the supply chain process has to be improved in order to validate and verify if the existing solution has been compromised. I do think there needs to be baseline supplied by the OEM (vendor), when the system deviates from one micron or determine if there is something communicating with the outside world, then it needs to be re-examined. That will take a major budget at the very beginning to ensure the devices are measured to the nth degree before they are distributed to the public or utilize robotics to help with the measuring process.

I think we need to learn from the residual effects "Super-Micro" had on the economy - Bloomberg Article



The key will be the supply chain after we get a handle on that, then we will be able to move forward, but until then, we are just guessing.

T
Jon M. Kelley
50%
50%
Jon M. Kelley,
User Rank: Moderator
8/26/2019 | 11:12:48 AM
Need Access? Not hard to do if it's built in your country...
Access to the hardware could be hard to achieve at scale for a typical hacker or even hacking team, but within a country that builds many of the motherboards currently in use worldwide, it could easily be part of the cost of running the business. 
tdsan
50%
50%
tdsan,
User Rank: Ninja
8/13/2019 | 12:11:07 PM
This is the key - "need access to the device"
If users bring in their own equipment (BYOD), this is going to be a problem. Even if the system is not connected to the private/domain network, this still gives the actor the ability to exploit the network by allowing the device to communicate with the outside world like a "Zombie" or they can utilize a cable that connects to a machine with malware (KnowBe4 showed this in an earlier video, found on youtube). It seems we may have to move our solutions to be more Linux centric but that did not help either (maybe ChromeOS, does not allow to install unknown software), not sure what the answer is here except to keep the systems update-to-date (patching), this is interesting.

It seems MS needs to do a better job of validating the drivers before stating they have been certified.

T
NSA Appoints Rob Joyce as Cyber Director
Dark Reading Staff 1/15/2021
Vulnerability Management Has a Data Problem
Tal Morgenstern, Co-Founder & Chief Product Officer, Vulcan Cyber,  1/14/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This is not what I meant by "I would like to share some desk space"
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-26252
PUBLISHED: 2021-01-20
OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.6, there is a vulnerability which enables remote code execution. In affected versions an administrator with permission to update product data to be able to store an executable file on the server ...
CVE-2020-26278
PUBLISHED: 2021-01-20
Weave Net is open source software which creates a virtual network that connects Docker containers across multiple hosts and enables their automatic discovery. Weave Net before version 2.8.0 has a vulnerability in which can allow an attacker to take over any host in the cluster. Weave Net is suppli...
CVE-2021-1235
PUBLISHED: 2021-01-20
A vulnerability in the CLI of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to read sensitive database files on an affected system. The vulnerability is due to insufficient user authorization. An attacker could exploit this vulnerability by accessing the vshell of an af...
CVE-2021-1241
PUBLISHED: 2021-01-20
Multiple vulnerabilities in Cisco SD-WAN products could allow an unauthenticated, remote attacker to execute denial of service (DoS) attacks against an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
CVE-2021-1247
PUBLISHED: 2021-01-20
Multiple vulnerabilities in certain REST API endpoints of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to execute arbitrary SQL commands on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.