Researchers find security flaws in 40 kernel drivers from 20 vendors

guest · Aug 10, 2019

Researchers find security flaws in 40 kernel drivers from 20 vendors
Affected vendors include the likes of Intel, AMD, NVIDIA, ASRock, AMI, Gigabyte, Realtek, Huawei, and more
August 10, 2019
https://www.zdnet.com/article/researchers-find-security-flaws-in-40-kernel-drivers-from-20-vendors/

At the DEF CON 27 security conference today in Las Vegas, security researchers from Eclypsium gave a talk about common design flaws they found in more than 40 kernel drivers from 20 different hardware vendors.

The common design flaws is that low-privileged applications can use legitimate driver functions to execute malicious actions in the most sensitive areas of the Windows operating system, such as the Windows kernel.

"There are a number of hardware resources that are normally only accessible by privileged software such as the Windows kernel and need to be protected from malicious read/write from userspace applications,"
Shkatov blames the issues he discovered on bad coding practices, which don't take security into account.
The Eclypsium researcher said he plans to publish the list of affected drivers and their hashes on GitHub, after the talk so users and administrators can block the affected drivers.
Click to expand...

Eclypsium: Screwed Drivers – Signed, Sealed, Delivered

Minimalist · Aug 12, 2019

HPE Silicon Root Of Trust ‘Protects Against’ Screwed Drivers’ Vulnerability: HPE Security Expert

Hewlett Packard Enterprise’s Silicon Root of Trust -- which is aimed at preventing compromised firmware code from executing -- “protects against” the ‘Screwed Drivers’ vulnerability highlighted by security researcher Eclypsium, said Hewlett Packard Enterprise Director of Server Software and Product Security For HPE Hybrid IT Bob Moore.
Click to expand...

https://www.crn.com/news/components...wed-drivers-vulnerability-hpe-security-expert

guest · Nov 13, 2019

Intel PMx driver flaw gave hackers 'near-omnipotent control' of devices
Other drivers also had deep access to system guts
November 13, 2019
https://www.theinquirer.net/inquirer/news/3083702/intel-pmx-driver-flaw

Intel has released an updated version of its PMx driver after it was revealed to be vulnerable to exploits that gave hackers "near-omnipotent control" over a targeted device.

Researchers from firmware security firm Eclypsium discovered the vulnerability in PMx after a deep dive into the state of security with a host of drivers and their interaction with the Windows kernel. Their research was disclosed in August, but the vulnerability was kept quiet as Intel worked to fix it.
The issue stems from how the driver, and indeed the other drivers detailed in its research back in August, interact with the Windows kernel and underlying hardware and firmware.

In the case of the PMx driver, Eclypsium's security smart folks noted it was "incredibly capable" in that it could read and write physical memory, read and write to debug registers, and arbitrarily gain access to I/O and PCI, among other highly-privileged hardware and firmware-level access.
Click to expand...

Intel has plugged the hole in its PMx driver, as have the vendors of other affected drivers. But Eclypsium said its research is ongoing, and thus we would expect other driver vulnerabilities to be flagged in the near future. It also had the following worrying message:

"There is no universally applicable way to prevent Windows from loading any of the bad drivers that have been identified thus far. Going forward, Microsoft is addressing the issue through their HVCI (Hypervisor-protected Code Integrity) technology. This will allow Microsoft to act as their own virtual firewall to protect the operating system kernel," said Eclypsium's researchers.
Click to expand...

Eclypsium: Mother of All Drivers – New Vulnerabilities Found in Windows Drivers

guest · Jun 30, 2020

Driver Vulnerabilities Facilitate Attacks on ATMs, PoS Systems
June 29, 2020
https://www.securityweek.com/driver-vulnerabilities-facilitate-attacks-atms-pos-systems

Eclypsium last year analyzed device drivers from major vendors and found that over 40 drivers made by 20 companies contained serious vulnerabilities that could be exploited to deploy persistent malware.
The firm now warns that the Windows drivers used in ATMs and PoS devices can be highly useful to threat actors targeting these types of systems.

According to Eclypsium, vulnerabilities affecting the drivers running on ATMs or PoS devices could allow attackers to escalate privileges and gain “deeper access” into the targeted system.

“By taking advantage of the functionality in insecure drivers, attackers or their malware can gain new privileges, access information, and ultimately steal money or customer data,” Eclypsium explained.
Click to expand...

As an example, the security firm described a vulnerability found by its researchers in a driver present on Diebold Nixdorf ATMs. The driver in question provides access to x86 I/O ports, which is fairly limited in terms of functionality compared to other drivers. Nevertheless, a driver that provides arbitrary access to I/O ports can be useful in the initial phases of an attack, as it could allow the attacker to obtain access to PCI-connected devices, including external devices and the SPI controller, which provides access to the system firmware.

On the other hand, these types of security flaws can pose a risk for an extended period of time as it typically takes the manufacturers of highly regulated devices much longer to release patches due to compliance requirements. For instance, in this case, Eclypsium says its research was completed in May 2019, but it could not disclose its findings until now.
Click to expand...

Eclypsium: Screwed Drivers Open ATMs to Attack

Windows Drivers Used in ATM, POS and Other Devices Allow Arbitrary Access to I/O Ports, Allow Attackers to Target Data to and from PCI-connected Devices
Click to expand...

Rasheed187 · Jul 4, 2020

mood said: ↑

Researchers find security flaws in 40 kernel drivers from 20 vendors
Affected vendors include the likes of Intel, AMD, NVIDIA, ASRock, AMI, Gigabyte, Realtek, Huawei, and more
August 10, 2019
https://www.zdnet.com/article/researchers-find-security-flaws-in-40-kernel-drivers-from-20-vendors/
Eclypsium: Screwed Drivers – Signed, Sealed, Delivered
Click to expand...

This is scary stuff, malware that can abuse leaky drivers. I wonder if M$ can tackle this problem.

Log in or Sign up

Researchers find security flaws in 40 kernel drivers from 20 vendors

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

Rasheed187 Registered Member

Log in or Sign up

Researchers find security flaws in 40 kernel drivers from 20 vendors

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

Rasheed187 Registered Member

Useful Searches