Slashdot Log In
ATI Driver Flaw Exposes Vista Kernel to Attackers
Posted by
CowboyNeal
on Fri Aug 10, 2007 06:34 AM
from the sneaking-in dept.
from the sneaking-in dept.
Shack0ption writes "An unpatched flaw in an ATI driver was at the center of the mysterious Purple Pill proof-of-concept tool that exposed a way to maliciously tamper with the Windows Vista kernel. The utility, released by Alex Ionescu and yanked an hour later after the kernel developer realized that the ATI driver flaw was not yet patched, provided an easy way to load unsigned drivers onto Vista — effectively defeating the new anti-rootkit/anti-DRM mechanism built into Microsoft's newest operating system. Ionescu confirmed his tool was exploiting a vulnerability in an ATI driver — atidsmxx.sys, version 3.0.502.0 — to patch the kernel to turn off certain checks for signed drivers. This meant that a malicious rootkit author could essentially piggyback on ATI's legitimately signed driver to tamper with the Vista kernel."
Related Stories
Submission: ATI Driver Flaw Exposes Vista Kernel to Attackers by Anonymous Coward
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
trusted computing (Score:3, Insightful)
so windows vista trusts ATI.
ATI trusts themselves.
I don't trust no one, especially closed-source drivers from ATI.
shouldn't they simply replace their "fglrx" with "ati", in their xorg.conf?
So I read it right? (Score:5, Funny)
Re: (Score:2, Insightful)
Linux does NOT stand for free software. It happens to have a (now old and relatively flawed) free software license. The main direction for Linux comes from a guy who likes Tivoisation (ie, DRM), and is of the opinion that politics like Freedom issues don't matter; he just wants to create tools.
If you want a Free Software kernel, that guarantees you'll still be able to use it at version 11.6, you'll need to look further afield.
You could argue that kernels don't
Re: (Score:3, Interesting)
So, why doesn't Linux have a HAL? I can tell you the answer in one word - Tradition. The Linux kernel emanates from kernel.org, which essentially produces a white box OS, supporting x86/IA-32 compatible CPUs. With that Wintel architecture, things like code compatibility, BIOS, and chipsets come together to form what I call the PC/AT "virtual machine." Linux, like Windows, leverages basic knowledge about this platform, so that booting a
That's why microkernels are useful (Score:3, Interesting)
Re:That's why microkernels are useful (Score:4, Interesting)
Even Microsoft Research [microsoft.com] is looking into making microkernel [wikipedia.org] operating systems with their Singularity project [microsoft.com].
Of course, the Minix 3 Project [minix3.org] has been doing this for awhile, supposedly even having a fully POSIX compliant product at this point.
The major design factor of Microkernels [wikipedia.org] is that it's bad practice to have a trusted path from any driver or system service in kernelspace to any other driver or system service in kernelspace. Just because you're "in" doesn't mean that anything else that's "in" should trust you.
The largest hurdle microkernels have to overcome, however, is the problem of DMA [wikipedia.org]. As long as a malicious ATI video card (nevermind the driver) has direct access to all memory locations via DMA, it could easily just patch the driver's memory at runtime every time via hardware. That's why microkernel development is going to have to go hand-in-hand with tools like IOMMU [wikipedia.org], for controlling access to critical areas of memory.
Of course, critics often complain about Inter-process Communication (IPC) [wikipedia.org] as being another limitation to microkernels, but at this point, it's really just an implementation hurdle as there are several ways to get processes that are in different memory spaces to communicate with high performance, especially as Moore's Law brings CPUs faster and faster.
Parent
Re: (Score:3, Insightful)
Absolutely correct and imho correct for all types of kernels. As long as hardware uses system memory to function, and the location of memory is not properly restricted, this problem will persist. Drivers openly developed could easily be developed to restrict specific device types to specific memory areas.
Re: (Score:3, Interesting)
They might as well do something more innovative and useful, after all I heard they were running out of ideas on what to do with all those transistors, and resorting to stuff like more cores and more cache.
Should sit down with the O/S, DB etc people, and brainstorm some stuff that will make doing things the "right" way easier (or even just possible). Sure there's often no real right way, but
Kernel Type (Score:2, Interesting)
Re: (Score:2)
Re:Kernel Type (Score:5, Informative)
Parent
Re: (Score:3, Insightful)
Re:Kernel Type (Score:5, Informative)
From the article:
Parent
Re: (Score:2)
Rules of the Road (Score:4, Interesting)
YOUR VIDEO CARD NEEDS NEW DRIVERS: CLICK NEXT!!!!!
Re: (Score:2)
Bug or feature? (Score:2, Informative)
Re: (Score:3, Insightful)
Re: (Score:3, Insightful)
Ah, you kids have it easy... (Score:5, Insightful)
ATI will patch this (Score:5, Insightful)
Seems like the real concern is not that ATI's code opens a security hole. You know ATI will patch it. A more important question is, how many other securely-signed drivers, etc., have similar holes? How many drivers are there in a typical Windows Vista system, anyway?
At least Microsoft can say (with some truth) that it's not THEIR software which introduces the problem! (it actually is, of course, but not directly)
Re: (Score:2)
And how will ATI ensure that all people using the flawed drivers upgrade to the newest ones? How will the average Vista/ATI user even know that they are at risk of this flaw? Unless all those flawed systems are patched this will remain a fairly big hole to be exploited by the unscrupulous.
No shit (Score:2)
(BTW, that's one of the reasons drivers need to be signed to run on Windows Vista x64.)
Re:No shit (Score:5, Funny)
Parent
Re: (Score:3, Interesting)
That it exploits a flaw in 3rd party software does not change the fact that the system is currently breakable. Signing simply makes it harder, which is certainly a good thing. It does not confer complete trust, which is what absolute statemen
It will not work. Ever. (Score:5, Insightful)
Let's take a look at the inner workings of the system. Yes, MS has full access to the source code, so their drivers will probably not leak. They also have no "real" competition on the OS market (yes, there's Linux, there's MacOS, but what company would switch?). They can take their time to proof and perfect their drivers until you can be certain that they don't leak.
Do third party vendors have the source? No. Do they have tight schedules and competition breathing down their neck? You bet. Will they prefer performance or security? Well, what of those two is tested on pages like THG?
Worse yet, what if such a driver actually allows a user to "crack open" his system and use it as he pleases? Could you see people buy a cheap ATI card just for the purpose of disabling the DRM? I mean, there have been really, really crappy games for some consoles that sold surprisingly well, because they contained a bug that allowed disabling certain security measures. Save-game exploits were quite popular for a while.
Could you see that this "security" bug could actually be a selling argument FOR the hardware rather than against it?
I see... (Score:3, Funny)
And this is why (Score:3)
*Still rather upset That there is no linux acceleration driver for the ATI Rage Mobility in the original iBook, I would much rather run Linux on it than OS X or OS 9.
My understanding was that video runs in ring 3 (Score:4, Interesting)
Because WPF is largely written in managed code on the common language runtime, it never ran in kernel mode. There are elements of WPF (called the MIL) that are written in unmanaged code, but that code also largely runs (and always has run) in user mode. Insofar as WPF needs to touch kernel mode stuff (e.g., drivers), it interacts with them through the existing DirectX APIs. The user mode and kernel mode aspects of the WPF architecture haven't changed.
http://arstechnica.com/news.ars/post/20051216-578
So what did Microsoft gain with the Vista GDI changes?
Enjoy,
Re: (Score:3, Informative)
Vista supports two displa
purple pill? O.o (Score:4, Funny)
Now, seriously, what's "purple pill"?
Re: (Score:2, Insightful)
What are Microsoft going to do now? Revoke the key they used to sign drivers with? How many copies of Vista wich verify drivers with the now-revoked pubkey have already been sold? How many devices were sold in retail with drivers which will no longer JustWork(tm)? Will Micros
Re:Let's blame Microsoft (Score:5, Insightful)
Well, one thing to consider is this -- how different are other OSes like Linux? With Linux, a root exploit in a kernel module gains you access to the whole system as well, especially when you consider that it uses a monolithic kernel. IOW, kernel modules directly patch the Linux kernel, live, in memory. Now consider that the ATI drivers for Linux are based at least in part on the ATI drivers for Windows.
Mind you that some things like SELinux might help to mitigate some of this in some scenarios, but not in all.
Parent
Re: (Score:3, Informative)
Re:Let's blame Microsoft (Score:4, Insightful)
Parent
Re: (Score:3, Funny)
Heck, that solution is even cross-platform!
Re:Let's blame Microsoft (Score:5, Insightful)
It's a local exploit.
did I mention that finding another bug in another driver signed with the new key will mean the whole process must be repeated?
Third parties write crap, exploitable code and it's MS's fault? You can write exploitable kernel modules for Linux as well, yet somehow I don't think you'd be blaming that on Linus. If anything, this is an argument for open source drivers, not against MS's scheme - although how many people actually have the skill to audit the code they run, let alone auditing it?
did I mention that if someone finds such a bug and sits on it, they have root to any Vista system in existence
Every Vista install that uses the exploitable driver, you mean. Just as an exploitable driver for Linux would open every Linux install that uses that driver. For example, I have an NVidia card; as and when I upgrade to Vista, I won't be vulnerable to this particular exploit.
Try to tone the hyperbole down a little, it's not very becoming.
Parent
Re: (Score:3, Interesting)
It is a lot easier and more reliable to test a driver for stability than it is to test it for security. There is so much crap hardware with flakey drivers floating around which causes stability problems, Windows has an undeservedly bad reputation for stability. Everyone blames Microsoft when the see a BSOD, but in many cases they should be blaming the manufacturer of their $10 SATA adapter.
I'm posting this from an Ubuntu b
Re:Let's blame Microsoft (Score:5, Funny)
You must be new here, so I'll try and enlighten you.
You see, Microsoft is a lot like the smelly kid in 3rd grade that
used to drop a load in his shorts and not say anything while
everyone wandered around trying to figure out what died, where.
After a few of these episodes, whenever there was a strange smell,
it would come to pass that the smelly kid dropped another load.
Now, to make matters worse for the smelly kid, imagine him running
around telling everyone that he has solved the problem*. People are
relieved for a while until, guess what? The smelly kid drops another
load. How can this happen, isn't this supposed to be fixed?
This insane cycle of disappointment/re-assurance causes people to
get cynical very quickly and as a result, causes people to start complaining
very quickly.
[*] - http://news.com.com/Allchin+Buy+Vista+for+the+sec
Parent
Re: (Score:3, Insightful)
It is impossible to prove that any piece of software is 100% bug free. Impossible. Regardless of your operating system, if you trust kernel-level drivers (you actually want to *do* something useful with your system?), chances are that somewhere there is an exploitable flaw. It's just that no-one may have found it yet. There is no such thing as a 100% secure system.
Re: (Score:3, Funny)
No, he will dump a core in his shorts.
Comforting, in a way... (Score:5, Funny)
All those years of trying to get fglrx to work, avenged!
So, is that what you call passive aggression?
Parent
Re:Let's blame Microsoft (Score:5, Informative)
From the article:
Parent
Re: (Score:3, Informative)
You do realize that the kernel does not do any signing, that's Verisign's job, right?
Even that's wildly inaccurate, and just demonstrates that you're confused as to how digital signature systems (and other things based on a PKI too) work.
Verisign just signs the driver author's certificate, and even then just to say "these guys are who they say they are, and they're doing code signing with the key matching this certificate". They most certainly say nothing at all about the correctness of the drivers; that's up to the driver author (and maybe Microsoft too).
Re: (Score:3, Informative)
VeriSign can sign only SSL certs and certain less-well-known types of keys for you.
Re:lol wut (Score:5, Interesting)
What does it matter? Neither of them bother with proper overlay any more.
My last nVidia card was simply without overlay hardware. My last ATi card's overlay dropped resolution when a high refresh rate was used. At least the nVidia card could play a video at full res without resorting to GL.
It's not all about the 3D...
You do have a point about the drivers, though. While closed, nVidia's Linux module hasn't provided nearly as much heartache as ATi's... abomination.
Parent
Re: (Score:3, Funny)
Re:Really cleaning up the Internet (Score:4, Insightful)
By expanding the meaning of the term, the government has been able to greatly expand its power at the expense of its citizens. It certainly is important to catch and prosecute cyber-criminals, but discuss it rationally and pass appropriate, targeted laws to deal with the problem. More importantly, enforce the ones that already exist.
2. In most cases, a non-anonymous network would probably be fine, as long as encryption was used to keep data private. Unfortunately, we live in a world where, in some places, using encryption will get you tossed in jail, regardless of the content. In other words, it can be important to hide not only what you sent, but the fact that you sent it. A concrete example would be blogging in China. Given recent events with the NSA, I wouldn't be surprised if the U.S. government starts to take a more active role in discouraging personal strong encryption. How do we solve that problem?
3. Guantanamo is one of the worst violations of human rights in recent history. Even the basest criminals are entitled to due process. That's what makes our system justice and not revenge. The United States is NOT the world police. There is a process to be followed to enforce change in other countries. The lack of serious international backing is part of our problem in Iraq. The U.S., despite being the last world superpower, does not have the resources to fight every battle and prosecute every crime that other countries won't deal with.
You are right that we need effective computer crime laws and effective enforcement of them. The way to do it is to lobby other countries for this and establish treaties with them. Use diplomacy and sanctions where necessary. It isn't impossible; if we can get intellectual property laws perverted across the globe, surely we can expend the effort needed to reach cyber-criminals where ever they choose to hide.
4. The government is supposed to work for us, but it needs watching. One of the most important lessons of modern history is that we have to be active and mistrustful of government, in order for it to function correctly. The Bay of Pigs was the first warning and the Watergate scandal made this manifest. The Iraq war, NSA wiretapping, and the PATRIOT Act are examples of what happens when we fail to perform our role of government watchdog. I'm not going to trust the government on who the bad guys are. I want the FBI, the CIA, Interpol, etc. to gather evidence and arrest criminals and bring them before the appropriate judicial authority and prove their case before the public.
You are correct that this is a serious international problem and needs serious international intervention, but it also has to be done right.
Parent
Re: (Score:3, Insightful)
In a way, is there any point in ranking
Partly correct (slightly OT) (Score:3, Informative)
Considering the lousy reviews, it seems that Windows Vista is indeed "just a hack" on top of XP.
But it is no longer correct that it is a hack based on DOS. Parallel to Windows 9x, Microsoft introduced the Windows NT line. Windows 2000, XP and Vista are based on that.
In a direct comparison of Windows 2000 to Windows 98 (ye