LAS VEGAS – An insecure driver can be just what a hacker needs to get its foot in the door to a Windows environment. Compromised drivers are at the heart of massive security headaches ranging from recent Slingshot APT campaigns and LoJax malware. That’s why researchers at Eclypsium are sounding the alarm over what it sees as a dire security problem of insecure drivers digitally signed by reputable firms such as Microsoft.
At a session here at DEF CON on Saturday, Eclypsium’s principal researcher Mickey Shkatov was joined by researcher Jesse Michael and both shed light on research that showed that the problem of insecure drivers is widespread, affecting more than 40 drivers from at least 20 different vendors – all drivers being certified by Microsoft.
“These vulnerabilities allow the driver to act as a proxy to perform highly privileged access to the hardware resources and move an attacker from user mode to OS kernel mode,” researchers noted. They added that the vulnerabilities are widespread, impacting major BIOS vendors, as well as hardware sold by ASUS, Toshiba, NVIDIA and Huawei.
Researchers said they first pinpointed the issue in April when they culled 40 insecure drivers representing 20 vendors. They then gave offending companies a 90-day window to mitigate the issues. All 40 drivers are unique and 64-bit and signed by two separate vendors, researchers said.
“Some of the most dangerous [insecure driver attack scenarios] are arbitrary read/write of kernel memory, arbitrary read/write of model specific registers (MSRs), and arbitrary read and write of physical memory as these can all be used to achieve arbitrary code execution within the Windows kernel,” researchers told Threatpost.
Shkatov added that arbitrary hardware access via an insecure driver can allow malicious modification of firmware components, resulting in persistent subversion of existing Windows AV protection. Such was the case in March when Huawei MateBook systems included a rogue driver that let unprivileged users create processes with superuser privileges.
What researchers said makes this problem particularly menacing is the assumption that firms such as Microsoft have their back when it comes to insecure drivers. “Vendors think Microsoft is looking for this and they’re not, and Microsoft thinks vendors are delivering secure code. No one is taking ownership of this issue,” Shkatov told Threatpost.
Public exploits of insecure drivers mentioned in the talk include an ASUS driver elevation of privilege vulnerability, a MSI local privilege escalation and another privilege escalation flaw found in Gigabyte hardware.
Why are there so many insecure drivers? “This is a common software design anti-pattern where, rather than making the driver only perform specific tasks, it’s written in a flexible way to just perform arbitrary actions on behalf of userspace. It’s easier to develop software by structuring drivers and applications this way, but it opens the system up for exploitation,” the researcher said.
They also stress that just because a driver is signed and certified does not mean it is safe.
“It is of particular concern that the drivers in question were not rogue or unsanctioned – in fact, just the opposite. All the drivers come from trusted third-party vendors, signed by valid certificate authorities, and certified by Microsoft,” they said.
Both Michael and Shkatov said the antidote is that Microsoft step up and take action by blacklisting insecure drivers in Windows for all users or specific CPU generations.
“We hope that the same actions that they took for the vulnerable Capcom driver can be taken with this batch of drivers we found,” Shkatov said.
Game maker Capcom released the popular Street Fighter V for PCs in 2016 with a secret rootkit that gave any installed application kernel-level privileges. It should also be noted, in the case of the Huawei MateBook systems, it was Microsoft that found the bad driver that opened systems to attack.
As part of their research, Michael and Shkatov published a report on their findings that included a partial list of affected vendors mentioned in their research:
- American Megatrends International (AMI)
- ASRock
- ASUSTeK Computer
- ATI Technologies (AMD)
- Biostar
- EVGA
- Getac
- GIGABYTE
- Huawei
- Insyde
- Intel
- Micro-Star International (MSI)
- NVIDIA
- Phoenix Technologies
- Realtek Semiconductor
- SuperMicro
- Toshiba
Black Hat USA 2019 has kicked off this week in Las Vegas. For more Threatpost breaking news, stories and videos from Black Hat and DEF CON, click here.
