[TPU]Drivers from Over 40 Manufacturers Including Intel, NVIDIA, AMD Vulnerable to Privilege Escalation Malware Attacks - Overclock.net - An Overclocking Community

Forum Jump: 

[TPU]Drivers from Over 40 Manufacturers Including Intel, NVIDIA, AMD Vulnerable to Privilege Escalation Malware Attacks

Reply
 
Thread Tools
post #1 of 22 (permalink) Old 08-11-2019, 10:36 AM - Thread Starter
⤷ αC
 
AlphaC's Avatar
 
Join Date: Sep 2012
Posts: 11,111
Rep: 904 (Unique: 590)
[TPU]Drivers from Over 40 Manufacturers Including Intel, NVIDIA, AMD Vulnerable to Privilege Escalation Malware Attacks

https://www.techpowerup.com/258175/d...alware-attacks
Quote:
Cybersecurity research firm Eclypsium published a report titled "Screwed Drivers," chronicling a critical flaw in the design of modern device driver software from over 40 hardware manufacturers, which allows malware to gain privilege from Ring 3 to Ring 0 (unrestricted hardware access). The long list of manufacturers publishing drivers that are fully signed and approved by Microsoft under its WHQL program, includes big names such as Intel, AMD, NVIDIA, AMI, Phoenix, ASUS, Toshiba, SuperMicro, GIGABYTE, MSI, and EVGA. Many of the latter few names are motherboard manufacturers who design hardware monitoring and overclocking applications that install kernel-mode drivers into Windows for Ring-0 hardware-access.

► Recommended GPU Projects: [email protected] , [email protected] (FP64) (AMD moreso) ► Other notable GPU projects: [email protected] (Nvidia), GPUGrid (Nvidia) ► Project list


AlphaC is offline  
Sponsored Links
Advertisement
 
post #2 of 22 (permalink) Old 08-11-2019, 11:31 AM
New to Overclock.net
 
Heuchler's Avatar
 
Join Date: Mar 2012
Posts: 1,910
Rep: 257 (Unique: 187)
If only there was a better way. Time for me to switch.




VFIO - Update! w/Pop!_os -- PCIe Passthrough even with identical graphics cards
https://forum.level1techs.com/t/vfio...h-draft/142287





Master seems to be the go-to for a Ryzen 3000 high-end, Linux, and VFIO motherboard
https://forum.level1techs.com/t/aoru...ettings/145081

Overclocking History (Click to show)
Intel 386DX/16 @ 20 MHz
CX486SLC/50 @ 50 MHz
AM486DX2/80 @ 100 MHz
AM486 DX4-100 @ 120 MHz
AK5x86-P75 [email protected] 160 MHz
Pentium 90 @ 120 Mhz
IBM 6x86L P166+ [email protected] 160 MHz
Celeron 300a @ 454 MHz
Pentium 3 700 @ 933 MHz
Athlon XP 1400+ @ 1600 MHz
Athlon XP 1800+ @ 2088 MHz
Athlon XP 2500+ @ 2200 MHz
Athlon 64 3000+ @ 2603 MHz
Athlon X2 BE2300 @ 1900 MHz
Athlon X2 4200+ @ 2210 MHz
Athlon X2 5000+ @ 2600 MHz
Core 2 Duo E4300 @ 3000 MHz
Core 2 Duo E6750 @ 3600 MHz
Core 2 Duo E8400 @ 4000 MHz
Xeon C2Q L5408 @ 3200 MHz
Xeon C2Q X5450 @ 3300 MHz
Xeon C2Q E5440 @ 3400 MHz
Xeon C2Q E5450 @ 3600 MHz
Phenom2 X4 B50 @ 3700 MHz
Phenom2 X6 1045T @ 4050 MHz
Core i5-2500K Sandy @ 4500 MHz
X5650 6-Core Westmere @ 3982 MHz
AMD FX 8320E Black Edition

FX-8320E @4.5GHz, X5650 @ 4.0GHz, X6 1045T @4.0GHz, i7 [email protected]
Thinkpad T420p with i7-2720QM overclocked because this is OCN
Heuchler is offline  
post #3 of 22 (permalink) Old 08-11-2019, 12:20 PM
professional curmudgeon
 
looniam's Avatar
 
Join Date: Apr 2009
Posts: 9,572
Rep: 778 (Unique: 446)
https://eclypsium.com/2019/08/10/scr...led-delivered/
Quote:
Our analysis found that the problem of insecure drivers is widespread, affecting more than 40 drivers from at least 20 different vendors – including every major BIOS vendor, as well as hardware vendors like ASUS, Toshiba, NVIDIA, and Huawei. However, the widespread nature of these vulnerabilities highlights a more fundamental issue – all the vulnerable drivers we discovered have been certified by Microsoft. Since the presence of a vulnerable driver on a device can provide a user (or attacker) with improperly elevated privileges, we have engaged Microsoft to support solutions to better protect against this class of vulnerabilities, such as blacklisting known bad drivers.
i'm sure if anyone has owned an nvidia card knows that MS's WHQL program is a joke but this is ridiculous.

btw,
Quote:
List of Affected Vendors
ASRock
ASUSTeK Computer
ATI Technologies (AMD)
Biostar
EVGA
Getac
GIGABYTE
Huawei
Insyde
Intel
Micro-Star International (MSI)
NVIDIA
Phoenix Technologies
Realtek Semiconductor
SuperMicro
Toshiba
can anyone name a mother vendor that isn't there?

DFI, where are you?

Remember the golden rule of statistics: A personal sample size of one is a sufficient basis upon which to draw universal conclusions.
Upload the computer to Dropbox and provide a link to it so others may download it to examine and give advice for repairs.
loon 3.2
(18 items)
CPU
i7-3770K
Motherboard
Asus P8Z77-V Pro
GPU
EVGA 980TI SC+
RAM
16Gb PNY ddr3 1866
Hard Drive
PNY 1311 240Gb
Hard Drive
1 TB Seagate
Hard Drive
3 TB WD Blue
Optical Drive
DVD DVDRW+/-
Power Supply
EVGA SuperNova 750 G2
Cooling
EKWB P280 kit
Cooling
EK-VGA supremacy
Case
Stryker M [hammered and drilled]
Operating System
Win X
Monitor
LG 24MC57HQ-P
Keyboard
Ducky Zero [blues]
Mouse
corsair M65
Audio
SB Recon3D
Audio
Klipsch ProMedia 2.1
▲ hide details ▲


looniam is offline  
Sponsored Links
Advertisement
 
post #4 of 22 (permalink) Old 08-11-2019, 12:48 PM
What should be here ?
 
huzzug's Avatar
 
Join Date: Jun 2012
Posts: 5,222
Rep: 357 (Unique: 256)
Quote: Originally Posted by looniam View Post
Quote:
we have engaged Microsoft to support solutions to better protect against this class of vulnerabilities, such as blacklisting known bad drivers.
Does that mean MS was actively spreading these vulnerable drivers through it's update services and hence, a case be made for them to stop that stupidity?

#2 their debt is insane, even for a "diverse field" company. They cannot even afford to service the debt maintenance let alone make an actual dent in the debt itself. - Internet Stranger
huzzug is offline  
post #5 of 22 (permalink) Old 08-11-2019, 12:55 PM
New to Overclock.net
 
skupples's Avatar
 
Join Date: Apr 2012
Location: Fort Lauderdale
Posts: 18,140
Rep: 540 (Unique: 306)
I wanna know if they were KNOWINGLY certifying shart... you know, like junk bonds for $32428934239472834

this affects every single system in my work environment

R.I.P. Zawarudo, may you OC angels' wings in heaven.
If something appears too good to be true, it probably is.
skupples is offline  
post #6 of 22 (permalink) Old 08-11-2019, 12:55 PM
professional curmudgeon
 
looniam's Avatar
 
Join Date: Apr 2009
Posts: 9,572
Rep: 778 (Unique: 446)
Quote: Originally Posted by huzzug View Post
Does that mean MS was actively spreading these vulnerable drivers through it's update services and hence, a case be made for them to stop that stupidity?
that might be a stretch to permaban that though i completely despise them pushing hardware drivers out.

it would be prudent to suspend that "service" until they get this sorted - hopefully with third party help.

Remember the golden rule of statistics: A personal sample size of one is a sufficient basis upon which to draw universal conclusions.
Upload the computer to Dropbox and provide a link to it so others may download it to examine and give advice for repairs.
loon 3.2
(18 items)
CPU
i7-3770K
Motherboard
Asus P8Z77-V Pro
GPU
EVGA 980TI SC+
RAM
16Gb PNY ddr3 1866
Hard Drive
PNY 1311 240Gb
Hard Drive
1 TB Seagate
Hard Drive
3 TB WD Blue
Optical Drive
DVD DVDRW+/-
Power Supply
EVGA SuperNova 750 G2
Cooling
EKWB P280 kit
Cooling
EK-VGA supremacy
Case
Stryker M [hammered and drilled]
Operating System
Win X
Monitor
LG 24MC57HQ-P
Keyboard
Ducky Zero [blues]
Mouse
corsair M65
Audio
SB Recon3D
Audio
Klipsch ProMedia 2.1
▲ hide details ▲


looniam is offline  
post #7 of 22 (permalink) Old 08-11-2019, 12:55 PM
Performance is the bible
 
Join Date: Apr 2009
Posts: 6,736
Rep: 436 (Unique: 300)
Good way now to force people to upgrade. Old motherboard? No new drivers. Either replace or you are on the risk.
If you add MS to blacklist certain drivers, than you are in the risk of your OS not getting updated or not working at all.


Defoler is offline  
post #8 of 22 (permalink) Old 08-11-2019, 01:09 PM
New to Overclock.net
 
Imouto's Avatar
 
Join Date: Mar 2012
Posts: 1,914
Rep: 217 (Unique: 102)
Linux Master Race.

#EnthusiastLivesMatter
Imouto is offline  
post #9 of 22 (permalink) Old 08-11-2019, 03:14 PM
Official Luddite of OCN
 
SoloCamo's Avatar
 
Join Date: Sep 2012
Location: Florida, USA
Posts: 5,378
Rep: 413 (Unique: 214)
Quote: Originally Posted by Imouto View Post
Linux Master Race.
Thing that I mock about this type of drivel is that if Linux (whatever millionth distro of the month we are talking here) had the same market share it would have the same amount of efforts into attacking it.

Quote: Originally Posted by looniam View Post
https://eclypsium.com/2019/08/10/scr...led-delivered/


i'm sure if anyone has owned an nvidia card knows that MS's WHQL program is a joke but this is ridiculous.

btw,


can anyone name a mother vendor that isn't there?

DFI, where are you?
"IWill" - my old s478 socket board that I had paired with a 2.53ghz p4 + 512mb rambus PC800 + GF4 ti4200. Good times. That motherboard was also crap to say the least but I didn't know better at the time.


4k box
(23 items)
Oculus Box
(6 items)
CPU
4790k at 4.6ghz
Motherboard
Gigabyte GA-Z97X-Gaming 7
GPU
Sapphire Vega 64 1667mhz core / 1100 mem (reference air cooler)
RAM
G.Skill Trident X 16gb DDR3 2400mhz (2x8gb)
Hard Drive
Crucial M4 128gb
Hard Drive
Crucial MX100 256gb
Hard Drive
Crucial M500 480gb
Hard Drive
Crucial MX500 500gb
Hard Drive
Hyundai Sapphire 240gb
Hard Drive
Hyundai Sapphire 120gb
Optical Drive
LG Blu Ray RW
Power Supply
NZXT Hale82 850w
Cooling
Noctua NH-U12S
Case
Rosewill Thor V2 (Black)
Operating System
Windows 10 Pro
Monitor
ASUS PB287Q (4k)
Monitor
Dell Ultrasharp 1908FP
Keyboard
Corsair K55 RGB
Mouse
Fenek Swift Gaming Mouse - PMW 3360 Sensor
Mousepad
Steelseries QCK+
Audio
Creative SoundBlaster Z
Audio
Logitech Z-623
Audio
Sennheiser HD 280 PRO
CPU
FX-9590
Motherboard
Asus Crosshair V Formula Z
GPU
Sapphire Pulse Vega 56 1590core/945mem
RAM
16gb DDR3 1866 cas9 (two dimms)
Cooling
AMD FX Watercooler (came with 9590)
Operating System
Win10 pro 64bit
CPU
Xeon E5450
CPU
Xeon E5450
Motherboard
Dell T7400 stock
GPU
XFX DD 7970Ghz Edition
RAM
32gb DDR2 667mhz Quad Channel (4gb x8)
Hard Drive
Hyundai Sapphire 240gb SSD
Power Supply
Dell T7400 stock 1000w PSU
Operating System
Win 10 Pro
▲ hide details ▲

Last edited by SoloCamo; 08-11-2019 at 03:19 PM.
SoloCamo is offline  
post #10 of 22 (permalink) Old 08-11-2019, 03:17 PM
Official Luddite of OCN
 
SoloCamo's Avatar
 
Join Date: Sep 2012
Location: Florida, USA
Posts: 5,378
Rep: 413 (Unique: 214)
dp, sorry


4k box
(23 items)
Oculus Box
(6 items)
CPU
4790k at 4.6ghz
Motherboard
Gigabyte GA-Z97X-Gaming 7
GPU
Sapphire Vega 64 1667mhz core / 1100 mem (reference air cooler)
RAM
G.Skill Trident X 16gb DDR3 2400mhz (2x8gb)
Hard Drive
Crucial M4 128gb
Hard Drive
Crucial MX100 256gb
Hard Drive
Crucial M500 480gb
Hard Drive
Crucial MX500 500gb
Hard Drive
Hyundai Sapphire 240gb
Hard Drive
Hyundai Sapphire 120gb
Optical Drive
LG Blu Ray RW
Power Supply
NZXT Hale82 850w
Cooling
Noctua NH-U12S
Case
Rosewill Thor V2 (Black)
Operating System
Windows 10 Pro
Monitor
ASUS PB287Q (4k)
Monitor
Dell Ultrasharp 1908FP
Keyboard
Corsair K55 RGB
Mouse
Fenek Swift Gaming Mouse - PMW 3360 Sensor
Mousepad
Steelseries QCK+
Audio
Creative SoundBlaster Z
Audio
Logitech Z-623
Audio
Sennheiser HD 280 PRO
CPU
FX-9590
Motherboard
Asus Crosshair V Formula Z
GPU
Sapphire Pulse Vega 56 1590core/945mem
RAM
16gb DDR3 1866 cas9 (two dimms)
Cooling
AMD FX Watercooler (came with 9590)
Operating System
Win10 pro 64bit
CPU
Xeon E5450
CPU
Xeon E5450
Motherboard
Dell T7400 stock
GPU
XFX DD 7970Ghz Edition
RAM
32gb DDR2 667mhz Quad Channel (4gb x8)
Hard Drive
Hyundai Sapphire 240gb SSD
Power Supply
Dell T7400 stock 1000w PSU
Operating System
Win 10 Pro
▲ hide details ▲
SoloCamo is offline  
Reply

Quick Reply
Message:
Options

Register Now

In order to be able to post messages on the Overclock.net - An Overclocking Community forums, you must first register.
Please enter your desired user name, your email address and other required details in the form below.
User Name:
If you do not want to register, fill this field only and the name will be used as user name for your post.
Password
Please enter a password for your user account. Note that passwords are case-sensitive.
Password:
Confirm Password:
Email Address
Please enter a valid email address for yourself.
Email Address:

Log-in



Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Thread Tools
Show Printable Version Show Printable Version
Email this Page Email this Page


Forum Jump: 

Posting Rules  
You may post new threads
You may post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are Off