Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

Security Flaws Discovered in 40 Microsoft-Certified Device Drivers

Attackers can use vulnerable drivers to escalate privilege and execute malicious code in every part of the system.

Attackers have learned that vulnerabilities can hide in the gaps: gaps between components of a system or gaps in a process or procedure. A researcher last week at DEF CON in Las Vegas showed that device drivers — the small utility applications that allow particular pieces of hardware to work with an operating system — can bridge critical gaps for legitimate hardware and malicious hackers alike.

Jesse Michael and Mickey Shkatov, both of Eclypsium, based their research on the fact that while drivers allow communication between software and hardware, they also facilitate communication between the so-called user mode and the OS kernel. And since they operate at the permission level of the kernel, they indeed can be very powerful tools.

Malware that exploits drivers isn't new, and the simple fact that a driver vulnerability is being exploited isn't novel. There have been numerous campaigns, most recently last year's LoJax malware ascribed to Sednit, which employed driver exploits.

In Michael and Shkatov's research, though, they found more than 40 drivers from at least 20 vendors — including every major BIOS vendor — had vulnerabilities. More important than the basic number was that every vulnerable driver they discovered was certified by Microsoft, nullifying one of the most basic protection mechanisms in place for Windows systems.

Each of the vulnerabilities found facilitate privilege escalation from Ring 3 to Ring 0: at this privilege level, attackers can perform kernel virtual memory access, physical memory access, MMIO access, MSR access, control register access, PCI device access, SMBUS access, and much more.

In their presentation, the researchers showed several attack scenarios, from exploiting a driver that exists on the system but is not yet loaded, to malware that brings its own drivers with counterfeit signatures. In each of these cases, the drivers, once loaded, can carry malicious kernel patches, illicit reads and writes of specific memory locations, modifications to Unified Extensible Firmware Interface (UEFI) and device firmware, and other actions that would facilitate complete system takeover.

The researchers pointed out that an attacker would need access to the system prior to exploiting a driver vulnerability. Once the initial infection is accomplished, however, the driver exploit could be a very persistent method for privilege escalation and exploit execution.

Michael and Shkatov first reported their findings to Microsoft and other vendors. Microsoft and some of the affected vendors already have issued patches for known issues, while others have not responded to the researchers.

Whether a particular vendor has patched their drivers or not, Michael and Shkatov pointed out, Windows will still allow older, unpatched drivers to run on a system, leaving risk in place until the latest version of Windows 10 is running with its new drivers.

Related Content:

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
tdsan
50%
50%
tdsan,
User Rank: Ninja
8/13/2019 | 12:11:07 PM
This is the key - "need access to the device"
If users bring in their own equipment (BYOD), this is going to be a problem. Even if the system is not connected to the private/domain network, this still gives the actor the ability to exploit the network by allowing the device to communicate with the outside world like a "Zombie" or they can utilize a cable that connects to a machine with malware (KnowBe4 showed this in an earlier video, found on youtube). It seems we may have to move our solutions to be more Linux centric but that did not help either (maybe ChromeOS, does not allow to install unknown software), not sure what the answer is here except to keep the systems update-to-date (patching), this is interesting.

It seems MS needs to do a better job of validating the drivers before stating they have been certified.

T
GitHub Named in Capital One Breach Lawsuit
Dark Reading Staff 8/14/2019
The Mainframe Is Seeing a Resurgence. Is Security Keeping Pace?
Ray Overby, Co-Founder & President at Key Resources, Inc.,  8/15/2019
The Flaw in Vulnerability Management: It's Time to Get Real
Jim Souders, Chief Executive Officer at Adaptiva,  8/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-5034
PUBLISHED: 2019-08-20
An exploitable information disclosure vulnerability exists in the Weave Legacy Pairing functionality of Nest Cam IQ Indoor version 4620002. A set of specially crafted weave packets can cause an out of bounds read, resulting in information disclosure. An attacker can send packets to trigger this vuln...
CVE-2019-5035
PUBLISHED: 2019-08-20
An exploitable information disclosure vulnerability exists in the Weave PASE pairing functionality of the Nest Cam IQ Indoor, version 4620002. A set of specially crafted weave packets can brute force a pairing code, resulting in greater Weave access and potentially full device control. An attacker c...
CVE-2019-5036
PUBLISHED: 2019-08-20
An exploitable denial-of-service vulnerability exists in the Weave error reporting functionality of the Nest Cam IQ Indoor, version 4620002. A specially crafted weave packets can cause an arbitrary Weave Exchange Session to close, resulting in a denial of service. An attacker can send a specially cr...
CVE-2019-8103
PUBLISHED: 2019-08-20
Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds read vulnerability. Successful exploitation ...
CVE-2019-8104
PUBLISHED: 2019-08-20
Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds read vulnerability. Successful exploitation ...