An unpatched flaw in an ATI driver was at the center of the mysterious Purple Pill proof-of-concept tool that exposed a way to maliciously tamper with the Windows Vista kernel.
Purple Pill, a utility released by Alex Ionescu and yanked an hour later after the kernel developer realized that the ATI driver flaw was not yet patched, provided an easy way to load unsigned drivers onto Vista — effectively defeating the new anti-rootkit/anti-DRM mechanism built into Microsoft’s newest operating system.
In an interview, Ionescu confirmed his tool was exploiting a vulnerability in an ATI driver — atidsmxx.sys, version 3.0.502.0 — to patch the kernel to turn off certain checks for signed drivers. This meant that a malicious rootkit author could essentially piggyback on ATI’s legitimately signed driver to tamper with the Vista kernel.
...
Ionescu said he discussed the issue with Microsoft and will likely re-release the tool after a patch is released.
A spokesman for Microsoft said the company is aware that an ATI driver might be “potentially vulnerable.”
“Microsoft is in contact with ATI to help address this issue and once fixed we will assist in getting it to our customers,” he said. “To the best of our knowledge, Purple Pill was a proof of concept demonstration tool that was available for a very limited time and is no longer available.”
Ionescu said the tool was available for about 78 minutes and was downloaded 39 times.
No comments:
Post a Comment