ATI Driver Flaw Exposes Vista Kernel to Attackers 248
Shack0ption writes "An unpatched flaw in an ATI driver was at the center of the mysterious Purple Pill proof-of-concept tool that exposed a way to maliciously tamper with the Windows Vista kernel. The utility, released by Alex Ionescu and yanked an hour later after the kernel developer realized that the ATI driver flaw was not yet patched, provided an easy way to load unsigned drivers onto Vista — effectively defeating the new anti-rootkit/anti-DRM mechanism built into Microsoft's newest operating system. Ionescu confirmed his tool was exploiting a vulnerability in an ATI driver — atidsmxx.sys, version 3.0.502.0 — to patch the kernel to turn off certain checks for signed drivers. This meant that a malicious rootkit author could essentially piggyback on ATI's legitimately signed driver to tamper with the Vista kernel."
trusted computing (Score:3, Insightful)
so windows vista trusts ATI.
ATI trusts themselves.
I don't trust no one, especially closed-source drivers from ATI.
shouldn't they simply replace their "fglrx" with "ati", in their xorg.conf?
So I read it right? (Score:5, Funny)
Re: (Score:2, Insightful)
Linux does NOT stand for free software. It happens to have a (now old and relatively flawed) free software license. The main direction for Linux comes from a guy who likes Tivoisation (ie, DRM), and is of the opinion that politics like Freedom issues don't matter; he just wants to create tools.
If you want a Free Software kernel, that guarantees you'll still be able to use it at version 11.6, you'll need to look further afield.
You could argue that kernels don't
Re: (Score:3, Interesting)
So, why doesn't Linux have a HAL? I can tell you the answer in one word - Tradition. The Linux kernel emanates from kernel.org, which essentially produces a white box OS, supporting x86/IA-32 compatible CPUs. With that Wintel architecture, things like code compatibility, BIOS, and chipsets come together to form what I call the PC/AT "virtual machine." Linux, like Windows, leverages basic knowledge about this platform, so that booting a
Re: (Score:2)
Dependencies
Linux kernel 2.6.15 (or later)
That's why microkernels are useful (Score:3, Interesting)
Re:That's why microkernels are useful (Score:4, Interesting)
Even Microsoft Research [microsoft.com] is looking into making microkernel [wikipedia.org] operating systems with their Singularity project [microsoft.com].
Of course, the Minix 3 Project [minix3.org] has been doing this for awhile, supposedly even having a fully POSIX compliant product at this point.
The major design factor of Microkernels [wikipedia.org] is that it's bad practice to have a trusted path from any driver or system service in kernelspace to any other driver or system service in kernelspace. Just because you're "in" doesn't mean that anything else that's "in" should trust you.
The largest hurdle microkernels have to overcome, however, is the problem of DMA [wikipedia.org]. As long as a malicious ATI video card (nevermind the driver) has direct access to all memory locations via DMA, it could easily just patch the driver's memory at runtime every time via hardware. That's why microkernel development is going to have to go hand-in-hand with tools like IOMMU [wikipedia.org], for controlling access to critical areas of memory.
Of course, critics often complain about Inter-process Communication (IPC) [wikipedia.org] as being another limitation to microkernels, but at this point, it's really just an implementation hurdle as there are several ways to get processes that are in different memory spaces to communicate with high performance, especially as Moore's Law brings CPUs faster and faster.
Re: (Score:3, Insightful)
Absolutely correct and imho correct for all types of kernels. As long as hardware uses system memory to function, and the location of memory is not properly restricted, this problem will persist. Drivers openly developed could easily be developed to restrict specific device types to specific memory areas.
Re: (Score:3, Interesting)
They might as well do something more innovative and useful, after all I heard they were running out of ideas on what to do with all those transistors, and resorting to stuff like more cores and more cache.
Should sit down with the O/S, DB etc people, and brainstorm some stuff that will make doing things the "right" way easier (or even just possible). Sure there's often no real right way, but
Kernel Type (Score:2, Interesting)
Re: (Score:2)
Re:Kernel Type (Score:5, Informative)
Re: (Score:3, Insightful)
Re:Kernel Type (Score:5, Informative)
From the article:
Re: (Score:2)
Rules of the Road (Score:4, Interesting)
YOUR VIDEO CARD NEEDS NEW DRIVERS: CLICK NEXT!!!!!
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
I assume it's easy to boot checked builds into a mode that acc
Re: (Score:2)
You can also just use the OEM Test Certificate to test-sign your driver, then use it on a regular Vista "free" build. The only caveat is that a driver using the OEM Test Certificate will cause the system to put "OEM Test" or some such text in the background. This is so driver writers can test their driver outside the checked environment - there are a number of things that dif
Re: (Score:2)
Bug or feature? (Score:2, Informative)
Re: (Score:3, Insightful)
Re: (Score:3, Insightful)
Ah, you kids have it easy... (Score:5, Insightful)
Re: (Score:2)
You had me when you clicked OK.
ATI will patch this (Score:5, Insightful)
Seems like the real concern is not that ATI's code opens a security hole. You know ATI will patch it. A more important question is, how many other securely-signed drivers, etc., have similar holes? How many drivers are there in a typical Windows Vista system, anyway?
At least Microsoft can say (with some truth) that it's not THEIR software which introduces the problem! (it actually is, of course, but not directly)
Re: (Score:2)
And how will ATI ensure that all people using the flawed drivers upgrade to the newest ones? How will the average Vista/ATI user even know that they are at risk of this flaw? Unless all those flawed systems are patched this will remain a fairly big hole to be exploited by the unscrupulous.
Re: (Score:2)
PATCHES DO SHIT (Score:2)
That's a really naive attitude. I think Bruce Schneier put it best [schneier.com]: "Once you stop thinking about security backward, you immediately understand why the current software security paradigm of patching doesn't make us any more secure. If vulnerabilities are so common, finding a few doesn't materially reduce the quantity remaining. A system with 100 patched vulnerabilities isn't more secure than a system with
Re: (Score:2)
To quote from the Schneier column you mention: "A patched buffer overflow doesn't mean that there's one less way attackers can get into your system; it means that your design process was so lousy that it permitted buffer overflows, and there are probably thousands more lurking in your code."
Well, Bruce, it means BOTH things: it's one less way attackers can get into the system AND the design process was lousy.
You suggested that my attitude was that patches will fix everything. Not hardly. Read the contex
Re: (Score:2)
I assume your question is rhetorical. So an abnormal amount of Xbox 360s have problems. Microsoft, to resolve this issue, extended the warranty for every Xbox 360 to three years for free. That's a lot of commitment to their customers, above and beyond what the vast majority of the industry does when hardware defects arise. (You mention Apple; they're a good exception also. Their replacement program for faulty iBooks
Re: (Score:2)
No shit (Score:2)
(BTW, that's one of the reasons drivers need to be signed to run on Windows Vista x64.)
Break the signing (Score:2)
This whole business of "signing" is ridiculous. It's no safer than the current model. Perhaps even less safe, as it gives both the OS programmers and the end-users a false sense of security. "You can trust a signed driver."
No, you can't.
The only way I can see to make a truly safe system is to run each driver in its own VM, and create a virtual network between the drivers and the core OS. Each user-end program would also run in its own VM, and IPC would occur via the
Re: (Score:2)
That's how it's much much harder for moronic script kiddies to release kernel-level Trojan horses for Vista x64. Because we (or at least the police) would be able to find out their names and addresses.
Re: (Score:2)
At best we can hope that MS learns a few more things to add to their toolbox for refusing to sign off on kernel level drivers.
Re: (Score:2)
Re: (Score:3, Interesting)
That it exploits a flaw in 3rd party software does not change the fact that the system is currently breakable. Signing simply makes it harder, which is certainly a good thing. It does not confer complete trust, which is what absolute statemen
Re: (Score:2)
Re: (Score:2)
(BTW, that's one of the reasons drivers need to be signed to run on Windows Vista x64.)
Re: (Score:2)
"The point is that an author of a malicious kernel-level Trojan horse wants to stay anonymous, but can't. The certificate authorities (Verisign etc) need to verify your identity first before they issue a code signing certificate for you.
That's how it's much much harder for moronic script kiddies to release kernel-level Trojan horses for Vista x64. Because we (or at least the police) would be able to find out their
Re: (Score:2)
The problem isn't that the certificate issuing process is flawed. The problem is that a properly signed driver had a security hole that could be exploited. The GP was not asking what the process for issuing a vendor certificate was, but what the process for certifying the driver (i.e. making sure that it didn't have security holes) was.
Re:No shit (Score:5, Funny)
It will not work. Ever. (Score:5, Insightful)
Let's take a look at the inner workings of the system. Yes, MS has full access to the source code, so their drivers will probably not leak. They also have no "real" competition on the OS market (yes, there's Linux, there's MacOS, but what company would switch?). They can take their time to proof and perfect their drivers until you can be certain that they don't leak.
Do third party vendors have the source? No. Do they have tight schedules and competition breathing down their neck? You bet. Will they prefer performance or security? Well, what of those two is tested on pages like THG?
Worse yet, what if such a driver actually allows a user to "crack open" his system and use it as he pleases? Could you see people buy a cheap ATI card just for the purpose of disabling the DRM? I mean, there have been really, really crappy games for some consoles that sold surprisingly well, because they contained a bug that allowed disabling certain security measures. Save-game exploits were quite popular for a while.
Could you see that this "security" bug could actually be a selling argument FOR the hardware rather than against it?
Re: (Score:2)
Ernie Ball [com.com]
Wotif.com [zdnet.com.au]
Burlington Coat Factory [computerworld.com]
Peugeot [europa.eu]
Just to name a few.
And of course IBM and Novell, but they don't count, as they are strong GNU/Linux players.
Of course, Siemens was a bit off [newsforge.com] in their prediction of 20% market share by 2008. But I'd say there's the chance we might make 20% some day.
I see... (Score:3, Funny)
Linux fglrx module possibly also exploitable (Score:2, Interesting)
I always wondered if this could be turned into a more dangerous security exploit. And now I wonder how much code is shared between fgl
Re: (Score:2)
And this is why (Score:3)
*Still rather upset That there is no linux acceleration driver for the ATI Rage Mobility in the original iBook, I would much rather run Linux on it than OS X or OS 9.
There's always the Intel drivers. (Score:2)
Re: (Score:2)
Re: (Score:2)
My understanding was that video runs in ring 3 (Score:4, Interesting)
Because WPF is largely written in managed code on the common language runtime, it never ran in kernel mode. There are elements of WPF (called the MIL) that are written in unmanaged code, but that code also largely runs (and always has run) in user mode. Insofar as WPF needs to touch kernel mode stuff (e.g., drivers), it interacts with them through the existing DirectX APIs. The user mode and kernel mode aspects of the WPF architecture haven't changed.
http://arstechnica.com/news.ars/post/20051216-578
So what did Microsoft gain with the Vista GDI changes?
Enjoy,
Re: (Score:3, Informative)
Vista supports two displa
purple pill? O.o (Score:4, Funny)
Now, seriously, what's "purple pill"?
Re: (Score:2)
That's different to the purple pill one I heard:
RegardselFarto
Windows drivers worse then Linux drivers? (Score:2)
HA-HA! (Score:2)
Re: (Score:2)
Re: (Score:2)
I never understand why we have to insist on having X, a desktop
Re: (Score:2)
I never understand why we have to insist on having X, a desktop environment, AND a window manager for average desktop systems. I would absolutely kill for an all-in-one system geared for home use. No choice, no thousand and one options. I also wouldn't mind a distro to be tuned for at most 4 users at once.
The fact that the X server, the window manager, the window decorator, the compositor, the selection manager, and the `desktop environment' (which is really a big compositum of many many parts) are separate pieces is rather irrelevant for `home use' or for mostly any other use apart from developing them. Windows does separate some of those roles too (you can change the window manager, for example)
Most of the popular distros of the day do not really present a huge number of options. If you install Fedora,
Re: (Score:2)
Simply enough, hilight/middle-click works on every X-Windows application. If it's a gnome app, works. If it's a kde app, it works. If it's a motif (egads), it works.
It just works.
Re: (Score:2)
Linux is rooted ROUTINELY. It just rarely gets reported on in
There was just a giant BSD root festival reported on yesterday.
"Shit like this" happens everywhere and ignoreing it or pretending it doesn't exist on Linux is just plain ignorant.
Revoke ATI's certificate (Score:2)
Re: (Score:2, Insightful)
What are Microsoft going to do now? Revoke the key they used to sign drivers with? How many copies of Vista wich verify drivers with the now-revoked pubkey have already been sold? How many devices were sold in retail with drivers which will no longer JustWork(tm)? Will Micros
Re:Let's blame Microsoft (Score:5, Insightful)
Well, one thing to consider is this -- how different are other OSes like Linux? With Linux, a root exploit in a kernel module gains you access to the whole system as well, especially when you consider that it uses a monolithic kernel. IOW, kernel modules directly patch the Linux kernel, live, in memory. Now consider that the ATI drivers for Linux are based at least in part on the ATI drivers for Windows.
Mind you that some things like SELinux might help to mitigate some of this in some scenarios, but not in all.
Re: (Score:3, Informative)
Re: (Score:2)
Re:Let's blame Microsoft (Score:4, Insightful)
Re: (Score:2)
But let's say for the sake of argument you are right, what media file you can play, when, where, and how, shouldn't be something an OS kernel should be limiting. An OS's kernel should not be in t
Re: (Score:3, Funny)
Heck, that solution is even cross-platform!
Re:Let's blame Microsoft (Score:5, Insightful)
It's a local exploit.
did I mention that finding another bug in another driver signed with the new key will mean the whole process must be repeated?
Third parties write crap, exploitable code and it's MS's fault? You can write exploitable kernel modules for Linux as well, yet somehow I don't think you'd be blaming that on Linus. If anything, this is an argument for open source drivers, not against MS's scheme - although how many people actually have the skill to audit the code they run, let alone auditing it?
did I mention that if someone finds such a bug and sits on it, they have root to any Vista system in existence
Every Vista install that uses the exploitable driver, you mean. Just as an exploitable driver for Linux would open every Linux install that uses that driver. For example, I have an NVidia card; as and when I upgrade to Vista, I won't be vulnerable to this particular exploit.
Try to tone the hyperbole down a little, it's not very becoming.
Re: (Score:2)
It is when they've been espousing this whole "we check signed drivers to make sure they're good!" thing.
People do once they've been included in an official release of the kernel, which is equivalent to saying "we checked the driver to make sure it's good!".
Re: (Score:2)
Then they shouldn't state directly in their literature [microsoft.com] that the point of the signed driver is to ensure quality:
Re: (Score:2)
Re: (Score:2, Insightful)
Re: (Score:2)
Um yes.
They've made the offer, including agreeing to NDAs. http://www.kroah.com/log/2007/01/29/#free_drivers [kroah.com]
My God... has logical reasoning gone completely out of the window???
That has to be the gayest line I've ever seen on Slashdot.
Re: (Score:2)
They could just blacklist the ati driver in question. Of course that alone would probablly cause a LOT of customer upset.
Re: (Score:2)
Re: (Score:3, Interesting)
It is a lot easier and more reliable to test a driver for stability than it is to test it for security. There is so much crap hardware with flakey drivers floating around which causes stability problems, Windows has an undeservedly bad reputation for stability. Everyone blames Microsoft when the see a BSOD, but in many cases they should be blaming the manufacturer of their $10 SATA adapter.
I'm posting this from an Ubuntu b
Re:Let's blame Microsoft (Score:5, Funny)
You must be new here, so I'll try and enlighten you.
You see, Microsoft is a lot like the smelly kid in 3rd grade that
used to drop a load in his shorts and not say anything while
everyone wandered around trying to figure out what died, where.
After a few of these episodes, whenever there was a strange smell,
it would come to pass that the smelly kid dropped another load.
Now, to make matters worse for the smelly kid, imagine him running
around telling everyone that he has solved the problem*. People are
relieved for a while until, guess what? The smelly kid drops another
load. How can this happen, isn't this supposed to be fixed?
This insane cycle of disappointment/re-assurance causes people to
get cynical very quickly and as a result, causes people to start complaining
very quickly.
[*] - http://news.com.com/Allchin+Buy+Vista+for+the+sec
Re: (Score:3, Insightful)
It is impossible to prove that any piece of software is 100% bug free. Impossible. Regardless of your operating system, if you trust kernel-level drivers (you actually want to *do* something useful with your system?), chances are that somewhere there is an exploitable flaw. It's just that no-one may have found it yet. There is no such thing as a 100% secure system.
Re: (Score:3, Funny)
No, he will dump a core in his shorts.
Re: (Score:2)
Comforting, in a way... (Score:5, Funny)
All those years of trying to get fglrx to work, avenged!
So, is that what you call passive aggression?
Re: (Score:2)
So, is that what you call passive aggression?
Re: (Score:2)
Re:Let's blame Microsoft (Score:5, Informative)
From the article:
Re: (Score:3, Informative)
You do realize that the kernel does not do any signing, that's Verisign's job, right?
Even that's wildly inaccurate, and just demonstrates that you're confused as to how digital signature systems (and other things based on a PKI too) work.
Verisign just signs the driver author's certificate, and even then just to say "these guys are who they say they are, and they're doing code signing with the key matching this certificate". They most certainly say nothing at all about the correctness of the drivers; that's up to the driver author (and maybe Microsoft too).
Re: (Score:3, Informative)
VeriSign can sign only SSL certs and certain less-well-known types of keys for you.
Re: (Score:2)
Actually about $250. Joanna Rutkowska has managed to sign her own driver intended to punch a hole in vista [invisiblethings.org], registered as microsoft partner and obtained the certificate.
She clearly competed with them in security business ;)
Re:lol wut (Score:5, Interesting)
What does it matter? Neither of them bother with proper overlay any more.
My last nVidia card was simply without overlay hardware. My last ATi card's overlay dropped resolution when a high refresh rate was used. At least the nVidia card could play a video at full res without resorting to GL.
It's not all about the 3D...
You do have a point about the drivers, though. While closed, nVidia's Linux module hasn't provided nearly as much heartache as ATi's... abomination.
Re: (Score:2)
Re: (Score:3, Funny)
Re: (Score:2)
Re: (Score:2, Funny)
Re:Really cleaning up the Internet (Score:4, Insightful)
By expanding the meaning of the term, the government has been able to greatly expand its power at the expense of its citizens. It certainly is important to catch and prosecute cyber-criminals, but discuss it rationally and pass appropriate, targeted laws to deal with the problem. More importantly, enforce the ones that already exist.
2. In most cases, a non-anonymous network would probably be fine, as long as encryption was used to keep data private. Unfortunately, we live in a world where, in some places, using encryption will get you tossed in jail, regardless of the content. In other words, it can be important to hide not only what you sent, but the fact that you sent it. A concrete example would be blogging in China. Given recent events with the NSA, I wouldn't be surprised if the U.S. government starts to take a more active role in discouraging personal strong encryption. How do we solve that problem?
3. Guantanamo is one of the worst violations of human rights in recent history. Even the basest criminals are entitled to due process. That's what makes our system justice and not revenge. The United States is NOT the world police. There is a process to be followed to enforce change in other countries. The lack of serious international backing is part of our problem in Iraq. The U.S., despite being the last world superpower, does not have the resources to fight every battle and prosecute every crime that other countries won't deal with.
You are right that we need effective computer crime laws and effective enforcement of them. The way to do it is to lobby other countries for this and establish treaties with them. Use diplomacy and sanctions where necessary. It isn't impossible; if we can get intellectual property laws perverted across the globe, surely we can expend the effort needed to reach cyber-criminals where ever they choose to hide.
4. The government is supposed to work for us, but it needs watching. One of the most important lessons of modern history is that we have to be active and mistrustful of government, in order for it to function correctly. The Bay of Pigs was the first warning and the Watergate scandal made this manifest. The Iraq war, NSA wiretapping, and the PATRIOT Act are examples of what happens when we fail to perform our role of government watchdog. I'm not going to trust the government on who the bad guys are. I want the FBI, the CIA, Interpol, etc. to gather evidence and arrest criminals and bring them before the appropriate judicial authority and prove their case before the public.
You are correct that this is a serious international problem and needs serious international intervention, but it also has to be done right.
Re: (Score:3, Insightful)
In a way, is there any point in ranking
Partly correct (slightly OT) (Score:3, Informative)
Considering the lousy reviews, it seems that Windows Vista is indeed "just a hack" on top of XP.
But it is no longer correct that it is a hack based on DOS. Parallel to Windows 9x, Microsoft introduced the Windows NT line. Windows 2000, XP and Vista are based on that.
In a direct comparison of Windows 2000 to Windows 98 (ye