eWeek Microsoft Watch
Advertisement
Advertisement
August 15, 2007 10:39 AM

ATI: Attack, Threat, Insecurity



It's bad enough that there aren't enough Vista drivers for all peripherals. Now, having some of those drivers is worse.

Apparently, preinstalled ATI drivers can open the Vista kernel to arbitrary memory writes.

The problem isn't limited to 32-bit Windows Vista, but also affects the 64-bit version, which kernel is supposed to sacrosanct. My eWEEK colleague Lisa Vaas' story goes into the gory, technical details, which I would rehash and more specifically comment on if I weren't out of the office this week.

Quick take: Microsoft moved the graphics subsystem into the kernel with Windows NT 4. I always thought that it was a bad idea to let graphics drivers write directly to the kernel. The change greatly improved NT 4 graphics performance compared to its predecessors, resolved ongoing graphics drivers problems and eventually opened up more gaming to NT 4 and its successors (which includes Windows Vista).

Vista 64-bit is, in part, Microsoft's attempt to right the kernel-write problem, which is much bigger than graphics. But Microsoft's approach in part relies on driver authentication. The buggy ATI, while signed, is flawed in such a way that criminals or hackers could load unsigned drivers directly to the kernel. The situation puts Microsoft between a rock and hard place because:

  • ATI graphics are so widely deployed on notebooks.
  • Revoking the signed ATI driver could cause chaos for end users.
  • The exploit reveals where are some of the weaknesses with Vista drivers.
  • Vista 64-bit, which kernel is supposed to be secure, is shown to be vulnerable to exploit.

The 64-bit versions of Windows XP and Vista also don't let security software write to the kernel. Does this approach make Windows 64-bit more or less secure? My opinion: Nothing should write to the kernel—or as little as possible. That approach is sensible if nothing really can write to the kernel. Exploits like this one reveal that Vista's 64-bit kernel is vulnerable and that's cause for re-examination of Microsoft's security approach as 64-bit desktop deployments increase. As for 32-bit Windows, hasn't it always been a shooting gallery? Hit or miss?

TrackBack

TrackBack

http://www.microsoft-watch.com/cgi-bin/mte/mt-tb.cgi/11528

Comments (42)

DCMonkey :

In case you weren't aware, the Windows Display Driver Model (WDDM) in Vista moves most of the graphics driver back into user-mode.

Here's a whitepaper (from ATI even) that explains it pretty well.

http://ati.amd.com/products/wp/ATIWDDMWhitepaperFinalV38.pdf

Ian Easson :

Not only are you unaware of the work on the Vista WDDM that invalidates most of what you said in your column, but you are also unaware that ATI released a new set of drivers that fixes the problem.

Do your homework!

Roger :

Joe is out of touch. Please forgive him.

Waethorn :

"ATI graphics are so widely deployed on notebooks"

Also please note that most notebook makers don't use ATI's reference Catalyst Mobility drivers. Of all of the notebook makers on the planet, there are only a handful that do, and the rest have their own version scheme that don't fall in line with Catalyst version numbering. Why do think so many games have sections in their README's saying "Notebook versions of desktop ATI and NVIDIA graphics chips are not supported"?

I been telling people lately that because of all of the driver problems with ATI and NVIDIA with Windows Vista, to just use the drivers listed in Windows Update UNLESS they have a problem with them, or if a specific game doesn't play. The drivers on Windows Update seem to be VERY stable, and fairly optimized for multimedia and general computer use. For those users with notebook manufacturers that don't support Catalyst Mobility and also subsequently won't update their own drivers, this option is likely their only choice. This advice is the opposite of what I would've said for Windows XP, where many versions of the ATI drivers on Windows Update end up leaving the user in a locked 16-colour mode. The NVIDIA drivers on Windows Update for XP were also equally hideous. That seems to have changed drastically in Windows Vista.

There is an alternative for those users with OEM-unsupported ATI notebook chips though, but I would only recommend this for advanced users that are playing games and know what they're doing - www.driverheaven.net/modtool
Be warned - because the drivers are left unsigned, Windows Vista x64 WILL HAVE PROBLEMS. This works equally well on XP [x32] and Windows Vista x32 though.

Neil :

More FUD from Microsoft Watch !
Perhaps Joe you should start a weekly subject not only on FUD from Microsoft but from YOU as well !!

Waethorn :

"Perhaps Joe you should start a weekly subject not only on FUD from Microsoft but from YOU as well !"

funny kneel, but your buddy chips hasn't signed on yet.

Waethorn :

"Attack, Threat, Insecurity"

HEY! you stole that - that's chips' (and all his other alter-ego's) personal motto.

Eder :

FUD from Mr Joe Wilcox ...

Ron :

I think that the standard of IT journalism in dropping by every seconds.

Mr Joe Wilcox 's comments are based on his personal sentiment. He is emotional.

I wonder his postings are vetted through by Eweek's senior editor.

If Eweek is a paid service, I will cancel it immediately

Neil :

I feel that this shows more than just "FUD" from MW ... it shows that Microsoft Watch is actively trying to discredit Microsoft and that for once (actually it has happened before) they have caught out, and that people have not accepted all that they have been spoon fed.

Joe :

DCMonkey wrote: "In case you weren't aware, the Windows Display Driver Model (WDDM) in Vista moves most of the graphics driver back into user-mode."

You are correct. According to Microsoft: "At a technical level, WDDM display drivers have two components, a kernel mode driver (KMD) that is very streamlined, and a user-mode driver that does most of the intense computations. With this model, most of the code is moved out of kernel mode. That is, the kernel mode piece is now solely responsible for lower-level functionality and the user mode piece takes on heavier functionality such as facilitating the translation from higher-level API constructs to direct GPU commands while maintaining application compatibility. This greatly reduces the chance of a fatal blue screen and most graphics driver-related problems result in at worst one application being affected."

But not all the code is removed and Vista provides legacy kernel support for older drivers. Graphics drivers still write to the kernel. Maybe if they didn't, the buggy ATI driver wouldn't open way for malicious drivers to access the kernel.

Joe

Don :

We should organize a debate of the century featuring Mr Joe Wilcox (Anti-Microsoft)versus Ms Laura DiDo (Pro-Microsoft)

Manny :

Ron said: I think that the standard of IT journalism in dropping by every seconds.

Yeah, right. Shoot the messenger when he tells people of the rot that is in Vista. Real smart, guys.

Since when was any version of Windows secure? Microsoft stopped producing quality products a long time ago. That's what happens when innovation is dumped in favor of market share as a core value in the company.

Say it like it is, Joe!

Neil :

Without inovation there is no market share !
And you have also "skipped" the point made by "DCMonkey" regarding Joe's article very convienently.
Most of the the commentors are "waiting" still for Joe to say it properly is !!
Go to the link provided by DCMonkey and read it like it is !!

Joe, Thanks for the help.

I installed Vista as an upgrade on a brand new out of the box XP machine with PCcillin installed and everything updated online. Vista killed my video drivers, print drivers and my anti-virus.

I installed the video driver from the manufacturers disk. Three attempts at installing anti-virus software never worked so I took the machine off line. I started to observe it for virus activity by observing the growth in disk usage while off line and then searching for the newly created files.

Honest to God, I found a 2.8 MG file written in Chinese which was newly formed and modified.

Cathode :

"Graphics drivers still write to the kernel."

Of course they have to run some pieces in the kernel, otherwise how could you possibly talk directly to the hardware?

Regarding driver signing, I think it should not be understood as the way (or only way) of denying certain drivers kernel-mode, but rather as a way of identifying the piece of code, and possibly its author.

In my view, driver signing is just another layer. Running with reduced user privileges is still the most effective way of denying silent install of new code.

Anode :


"Graphics drivers still write to the kernel."
Of course they have to run some pieces in the kernel, otherwise how could you possibly talk directly to the hardware?

Theoretically, a driver could make a call to the kernel to access the hardware on its behalf. The kernel would then verify the driver's request and all parameters, make the call, and report the results back to the driver. If the driver wanted direct access to the hardware, the kernel would set up the communications, again checking bounds and whatever else, and then returning when the hardware was finished streaming/block-copying/whatever.

Lawrence D'Oliveiro :

This whole debacle makes a complete mockery of the idea that driver signing was in some way supposed to improve Dimdows security. In fact it is worse than useless, because it misleads people into believing they have a more secure system when they don't.

Neil :

Fatsavage
I went to your blog...and lo and behold what you stated you did is different to what you posted here!
You did not state on your blog that it killed your video drivers??
Also on your blog you never stated about this 2.8 meg file at all.
As for virus protection ... you had none and you had it online (the home of viruses) and lastly you never updated your PC-Cillin so that it would work on Vista.
And you never stated here that you did an aborted install previously either.
And you never used Vista's "Upgrade Advisor" either, so as to "iron out" any potential troubles that you may have encountered, instead you went in like "storm trooper" and then wondered why things didn't work properly.

Neil :

Lawrence
Did you follow DCMonkey's link ??
http://ati.amd.com/products/wp/ATIWDDMWhitepaperFinalV38.pdf
I suggest that you read it !!

RON :

I run an ASUS P5B motherboard with ASUS NVdia 8400GT Graphic card with 2GB RAM and a Samsung 19" LCD wide-screen monitor

Before the installation , I do my homework by checking and downloading various drivers for Vista. I study the installation manual of the ASUS motherboard and I read some Vista articles

Needless to say , my installation run without any problem at all.

I love my Vista. I love my ASUS as it carries 8 USB ports with wonderful 8-channel sound ouput. I burn using Nero premium with execellence speed

I don't understand why you all have some much problems and start to blame around. Your bad experience may cause by your shallow knowledge in fixing stuff in an un-organized way.

Some of you already have a negative feeling towards Vista in mind before installing and fixing it. With the additional of all these rumours and bad stories around , your venture into the new Vista is already doomed before you try to start anything

Frankly , I think Joe know how to use a pen but not screwdriver

In short : little knowledege is dangerous

Neil :

Ron
Thank you for that, I am glad that the "silent majority" are now starting to speak.
And thank you FUD Watch, oh ..sorry ... that should have been Microsoft Watch, or should it ??

Joe :

Ron wrote: "In short : little knowledege is dangerous."

True enough, Ron.

I've been using Windows Vista on a regular basis since February 2006--and leaked builds as far back as 2003 (when it was Longhorn).

The average buyer shouldn't need a screwdriver or do the homework that you did. That you had to download drivers before installation is indicative of what's wrong with the Vista user experience.

Should new car buyers have to be mechanics straight out of the auto dealer's lot? Nor should Vista users have to be techies. I expect Linux users to download special drivers and to tinker under the hood. Windows is supposed be better.

Joe

RON :

Joe ,

My experince refered to the installation of a motherboard with other parts and components, which is equivalent to the analogy of an amatuer mechanic who try to fix a car by

You put your example of a new car buyers which should be having an analogy to buying an OEM Vista PC that have all the drivers installed perfectly. New car buyers don't install additional stuff to the engine by themsleves.

Your draw a wrong analogy to argue ....

This is a brave new world with vast knowledge around us, even a new car buyer should own certain mechianic's knowledge in oder not to be cheated by auto salesman, or perhaps not to be cheated by journalist

maddog :

Neil wrote: Without innovation there is no market share!

Simply not true. Getting market share is all about clever marketing and economics. History is full of examples of inferior products or methods that grabbed market share. A few years ago, most of the US cellular providers used analog tecghnology despite the clear advantages offered by digital systems (which had been available for nearly a decade).

Looking at it from the other side, innovation does not guarantee market share either. The Ford Edsel had innovative engineering ideas in it, but was a total flop. Same with OS/2. Mac OS X is far better than Windows any day of the week, but does it have the same market share?

Microsoft keeps market share by sheer momentum and monopolistic business practices, not through innovation.

Neil :

Maddog
I do not agree !
To use your mobile phone analogy when there was a provider who "did" offer digital, what happened everyone went for it and demand was created !
Which is exactly my point proven by you ... thank you !!
If in the case of microsoft if the other OS's were really that much better the same thing would have occured, but it hasn't.
Microsoft lead the way with "windows" and has continued to lead as there is nothing available on the market that is superior by the "country mile". So people stay with windows.
Not to say that microsoft has not inovated since the delivery of any of the updated versions of windows, it has delivered something each time, and so it's opposition. But microsoft's upgrades are always better than it's oppositions upgrades.
As for your statement that "Microsoft keeps market share by sheer momentum and monopolistic business practices".
The momentum started in 1995, they must have done something really good to have that continue for 12 YEARS !!
And as for business practices, you tell me who doesn't or wouldn't do the same if they could??
NO ONE THAT'S WHO !!
Haven't you ever heard of the saying "nothing personal ...just business", they don't say that when they are being nice to someone do they ?
And as far as the computer software industry is concerned I would highly surprised if it was any different.
What about Adobe taking over Macromedia? What about the fight between Intel and AMD?
Your going to tell me that rivals play by the rules ....NEVER !!

evan :

Joe wrote:
The average buyer shouldn't need a screwdriver or do the homework that you did. That you had to download drivers before installation is indicative of what's wrong with the Vista user experience.
This is true Joe. However, how much of this is Microsoft's fault? Microsoft has given well in advanced the API's to the Hardware Vendors to come up with quality drivers for Vista. Some of them did not make it on time and their drivers were not included on the Vista CD and thus the difficulty with some devices to work with Vista out of the box. This will improve as hundrends of new drivers for Vista are coming out every day and will be included in SP1. This weakness of Windows of relying on hardware vendors to do the right thing, is also a major strength of the OS in comparison with other OS's.

Neil :

Evan
I totally agree... well said.
The way how Joe talks there would be even less people with reasonable computer knowledge, I myself was self taught and read book after book in order to help my kids with theirs, now my daughter is doing an "Advanced Diploma of IT" and the smartest girl in the whole course, and the boys refer to her as "The Cisco Godess". Naturally I am very proud of her accomplishments.
But if Joe had his way, people like Joe would never be questioned due their extreme knowledge and the rest of us would be just "newbs".

Mister Bee :

It's almost safe for VCSY to come out of hiding!

would "illegal shorting" be a tactic used by bigger companies to put smaller companies out of business?? hmmmmmm

Now let's use Microsoft as an example: Let's just say they've been using someone else's patents in their products(for the sake of arguement-we'll say their .NET Framework) for years.
If the smaller company mysteriously went bankrupt, then the bigger company(Microsoft) would have free reign to keep using that patent without recourse. imo
It also seems coincidental that CDC/Ross(a Microsoft partner) intentionally dragged on a lawsuit for 4 years with VCSY/Now Solutions and it wasn't till the presiding judge was removed that the new judge(Solomon) resolved the case with a "Direct Verdict" in favor of VCSY. VCSY shareholders are curious to what was with that first judge(Lowe) on the case(who was removed). It's probably unheard of that judges could be bought, but judge Lowe was removed and immediately after a "Direct Verdict" was awarded in VCSY/Now Solutions favor. I also find it interesting that just 2 days after the CDC/Ross settlement, VCSY announced it's lawsuit with Microsoft.

? Microsoft hit with patent suit from Vertical Computer
at MarketWatch (Fri, Apr 20)

? Now Solutions Successfully Resolves Its Lawsuit Against Ross Systems
PrimeNewswire (Wed, Apr 18)

Neil, The reason I write is partially for entertainment and partially for knowledge.

I have failed to do an adequate installation of Vista 4 times and have more stories to write about than I can reasonably post in a day. I will eventually get to the 2.8 MG Chinese file and perhaps even post it on line in the same form I got it.

However I am more likely to write about their screwing up the solitaire game because its funnier or the inability to find a compatible anti virus except for there own which is poorly rated because it relates to privacy and security.

What is your vested interest in defending Vista - why not give Gonzo Journalism a try. Instead of trying to tell me what others know, try something yourself and tell me what you learned.

Neil :

Mister Bee
This time you are accusing microsoft of bribery (and of a Judge no less).
What are going to accuse Microsoft of next ...murder !
You have seen "The conspiracy Theory" ?? Because you would have a field day if you saw that !!
Fatsavage
I have no vested interest in either microsoft or Vista. I tell you what I have learned ...and that is as far as anti virus software goes for Vista you just haven't done any homework at all have you ??
You just keep going on about PC-Cillin ! What is your vested interest in PC-Cillin ?? You do know that there are plenty of much better anti virus program than just that one ??
Why didn't you use the windows vista "Upgrade Advisor" before you tried doing the upgrades???
It could have saved you a lot of angst ...oh ...sorry ...I forgot you WANTED a lot of angst so that you could blame it on Vista :)

Joe Almeida :

Evan, your comment that MS had given API drivers well in advance to hardware makers hides a very import fact regarding Vista. Vista had rewritten much of the graphics and audio subsystems for the simple purpose of enforcing DRM. Companies such as ATi and NVidia complained to MS regarding this because of the added complexity that would have to be added to the drivers and chipsets. The API's themselves were moving targets as MS started having problems trying to implement DRM enforcement. Do yourself a favour and look up Peter Gutmann's analysis of Vista's DRM features on Google. Even if in the end MS implements only a partial list of the DRM capabilites, what you have in the end is needless complexity, which means needless code, which means more probability of security risk.

Joe Almeida :

Here's the link to Peter Gutmann's analysis. Take a look:

http://www.cs.auckland.ac.nz/~pgut001/pubs/vista_cost.html

Darn Neil, you got me thinking. The reason I use PCcillin is because it has the best Microsoft Vulnerability tester I have yet to find as part of their virus scan. They catch vulnerabilities that Microsoft has not yet discovered a patch for and they even catch unnamed vulnerabilities. Microsoft does not publicly do that so I use PCcillin as a vulnerability checker. (Usually after I know I have a bug that made it past my current anti virus protection.)

I wonder, does anybody know of another program that has an excellent vulnerability checker so I can get the information I need and still have the best available anti virus.

Waethorn :

"Here's the link to Peter Gutmann's analysis."

Sorry, but that has already been categorized as FUD many times over by several analysts. Gutmann even stated that he hadn't even used Windows Vista and was going on other people's opinions. He, likewise, has absolutely no proof of his claims. The "truth" is telling.

Here's the real truth:

blogs.zdnet.com/Ou/?p=673

Here's a followup about Guttman's "objectivity" too:

blogs.zdnet.com/Bott/?p=284

Waethorn :

Here's another followup too:

blogs.zdnet.com/Bott/?p=286

chips :

To Fatsavage;

On customers Vista computers I have sometimes been asked to install free antivirus programs. While AVG worked to some extent, on the last Vista computer I tried it on, the virus shield was disabled. So I don't recommend AVG free.

However, I was able to get the free version (Avira AntiVir PersonalEdition Classic) of the very top rated avira antivir working. Certainly a far better product than the $50 a year OneCare from M$.

http://www.free-av.com/

Waethorn :

"I don't recommend AVG free"

I don't either. I've seen too many XP machines that don't detect viruses with AVG's real-time engine. Some of those viruses sit dormant on the person's hard drive, and only a full scan will detect them. So one has to ask: How can AVG possibly be offering protection if the virus was able to be stored on the hard drive?! (answer: it isn't)

"very top rated avira antivir working"

Sorry, but that's just sad. Same deal with Avira as with AVG - too many viruses getting by, and too many false positives. It doesn't even protect against email viruses.

In the last few years, I've seen systems come in with spyware and viruses almost every day. Very infrequently now, but that's likely because people are getting educated as to what NOT to do online ie. P2P downloading, and pirated software from WAREZ/Bittorrent sites. Most of the free antivirus products end up being the culprit - they just DON'T WORK! The only one I've actually found to be fairly reliable was Avast, but I wouldn't recommend it. It does come in a Vista x64 compatible version though - Avira doesn't.

"Certainly a far better product than the $50 a year OneCare"

Considering the amount of false positives that Avira brings up, and the fact that it doesn't protect against email viruses, I'd still recommend OneCare. Also, considering that Norton and McAfee are complete bloatware, OneCare still offers more bang for the buck. Not all other companies are offering multi-PC licensing, but this is where Microsoft shot the bullet in their competitors foreheads - 3 PC's for $50/yr is a relative bargain considering the price of other commercial products. OneCare 2.0 will add some new multi-PC management features and includes the Vista-styled wireless protection to XP users as well as Vista x64 support, and ALL USERS will get the free upgrade to 2.0 (you DON'T have to buy every time a new version comes out, unlike Norton or McAfee, just keep paying your annual service subscription).

For corporate customers using Windows server, there are better products, like Trend Micro's Client Server Messaging Security for SMB, which works great on Windows Small Business Server, and supports Windows Vista. Licensing costs are much lower than most other products for that market too.

Neil :

Fatsavage
You keep on saying about PC-Cillin and I quote: "The reason I use PCcillin is because it has the best Microsoft Vulnerability tester I have yet to find as part of their virus scan."
My question to you is: How does Pc-Cillin correct these (so called) vulnerabilties?
I can tell you already ... it can't !!! Only microsoft can do that.
So PC-Cillin doesn't actually do a thing as far as that is concerned, it is just the same as any other I.S. Suite, it has a firewall and an antivirus.
You cannot fix a vulnerability with either of those.

Neil

You are missing the point. There is Military Strength Malware out there that made it past a hardwired firewall and then past my Norton Internet Security Pro. I knew the machine was damaged because of altered video drivers and the appearance of browser and search bar hijacks.Yet my Norton anti-virus and widows update kept on telling me everything was OK. When I did an off line install of PCcillin it showed 83 MS vulnerabilities.

You are correct, I could not update PCcillin online nor could I correct the vulnerabilities. But at least, I identified the magnitude of the problem. As the press is currently beginning to discuss domestic spying is real and it doesn't much matter if the AV companies cooperate or not because the Military Strength Malware is simply more powerful.

It's just nice to have a tool to measure it to prove you have something wrong with your machine.

By the way a tool that only caches 80% of Virsus in controlled tests is not even worth $50 for 3 machines.

Marco :

Some truths about Vista and One Care:
PC Pro (Sept 2007-correspond to August 2007-)

Antivirus Test (free and pay for:)

1- Kaspersky (98%)
2-F-Secure Internet (93%)
3-Antivir (92%) ...I use it! and say that it is excellent.
....go on...
12-One Care-MS-(66%) penultimate.
13-Panda (60%)

Some PC Pro's quotes about Vista's security:
“Out of 126 executable items of malware, Windows Defender spotted just three.”
“Having established that Vista does very little to prevent malware getting onto your system”

“almost all of the failing items launched and shut down without Vista's security features realising their nefarious intent.”
“Worse, of the 42% of malware that did run, less than half caused Vista to present a UAC prompt or a Firewall alert: most working items got their teeth firmly into our system without raising alarm”.

I think it clears out some doubts about the pretended “super secure” Vista

Also, here only an ignorant (or a mercenary) will allege that “PC-Pro” is against MS.
That's why we should all beware Vista.
ista.

Maddog :

Niel wrote: Which is exactly my point proven by you ... thank you !!

Uh, no. Your point was that there can be no market share without innovation. That is different from saying that innovation can bring market share. Please review your basic logic before posting such nonsense.

Market share does not prove that a product is better. It only proves that a product has better marketing or the existenc eof monopolistic practices. Again, your logic is faulty. Re-take Logic 101.

Post a Comment

 
 
RSS Syndication

Advertisement
Advertisement
Microsoft Watch     Contact Us | Advertise | Site Map
Ziff Davis Enterprise