Saturday, May 28, 2005
Device Drivers: a hidden worm threat?
One of the more interesting security articles of late, Device drivers filled with flaws, threaten security from Security Focus, discusses the potential for device drivers to be exploited, due to many lurking buffer overflow defects. The article discusses Windows and Linux as examples, although presumably any platform which depends upon many 3rd party device drivers could be subject to the same issues. Drivers that listen on a network, such as network card drivers, would of course be vulnerable to remote exploits. People tend to think of device drivers as part of "the system", and the article points out that many if not most of the drivers people use are created by 3rd parties, not by the vendor of the operating system, and typically not by the core kernel developers. The article mentions that the authors of device drivers tend to have wildly varying skill levels, and that many drivers amongst a sample inspected appear not to be properly reviewed for security implications. Of course that's too kind. My own experience has been that device drivers for hardware often appear to be an afterthought of a hardware company in most cases. The article doesn't discuss mystery drivers -- I don't know if there is an industry standard term for these things. I won't point fingers, but I've been surprised a few times by a software package that installs device drivers when the need for a device driver in the application architecture wasn't really clear. Hardware drivers for peripherals and certain root level services like VPN software make sense, given the general system architecture of most contemporary operating systems. The bottom line of course is that drivers today include plenty of buffer overflows lurking. Those which can be remotely exploited provide worm fodder, while the rest provide opportunity for local privilege escalation. Exploit chaining techniques could see worms come in through non-privileged exploits, and then up the voltage through a device driver defect. At that point of course they are free to do all the keystroke logging, email spamming, trojan downloading and rootkit installing that any other administrator level worm can do. But then, one really doesn't see all that many non-privileged remote exploits on Windows. Since the system architecture demands Administrator privileges for so many things, it virtually guarantees that a remote exploit is also fully authorized from the get go.