Over 40 Drivers Could Let Hackers Install Persistent Backdoor On Windows PCs

If you own a device, or a hardware component, manufactured by
ASUS, Toshiba, Intel, NVIDIA, Huawei, or other 15 other vendors
listed below, you’re probably screwed.

A team of security researchers has discovered high-risk security
vulnerabilities in more than 40 drivers from at least 20 different
vendors that could allow attackers to gain most privileged
permission on the system and hide
malware^[1] in a way that remains
undetected over time, sometimes for years.

For sophisticated attackers, maintaining persistence after
compromising a system is one of the most important tasks, and to
achieve this, existing hardware vulnerabilities sometimes play an
important role.

One such component is a device driver, commonly known as a driver
or hardware driver, a software program that controls a particular
type of hardware device, helping it to communicate with the
computer’s operating system properly.

Since device drivers sit between the hardware and the operating
system itself and in most cases have privileged access to the OS
kernel, a security weakness in this component can lead to code
execution at the kernel layer.

This privilege escalation attack can move an attacker from user
mode (Ring 3) to OS kernel-mode (Ring 0), as shown in the image,
allowing them to install a persistent backdoor in the system that a
user would probably never realize.

Discovered by researchers at the firmware and hardware
security firm Eclypsium, some of the new vulnerabilities could
allow arbitrary read/write of kernel memory, model-specific
registers (MSRs), Control Registers (CR), Debug Registers (DR), and
physical memory.

Since malware running in the user space can simply scan for a
vulnerable driver on the victim machine to compromise it, attackers
don’t have to install their own vulnerable driver, installing which
otherwise requires system administrator privileges.
All the vulnerable drivers, as listed below, uncovered by the
researchers, have been certified by Microsoft.

• American Megatrends International (AMI)
• ASRock
• ASUSTeK Computer
• ATI Technologies (AMD)
• Biostar
• EVGA
• Getac
• GIGABYTE
• Huawei
• Insyde
• Intel
• Micro-Star International (MSI)
• NVIDIA
• Phoenix Technologies
• Realtek Semiconductor
• SuperMicro
• Toshiba

The list also includes three more hardware vendors which
researchers did not name yet, as they are “still under embargo due
to their work in highly regulated environments and will take longer
to have a fix certified and ready to deploy to customers.”

Device driver flaws can be more dangerous than other application
vulnerabilities because it allows an attacker access to the
“negative” firmware rings that lie beneath the operating system and
maintain persistence on the device, even if the operating system is
completely reinstalled, just like in case of LoJax malware.

Researchers have reported these vulnerabilities to the affected
vendors, of which some, including Intel^[4] and Huawei^[5], have already released
patch updates and issued a security advisory.

Besides this, researchers have also promised to soon release a
script on
GitHub^[6] that would help users
find wormhole drivers installed on their systems, along with
proof-of-concept code, video demonstrations, and links to
vulnerable drivers and tools.

^[3]