ATI driver flaw exposes Vista kernel

[W1zzard]

An unpatched flaw in drivers from ATI creates a means to smuggle malware past improved security defences in the latest version of Windows and into the Vista kernel.

Microsoft is working with ATI on an update which security watchers warn might be far from straightforward to roll-out.

The existence of the security flaw in ATI's driver came to light after developer Alex Ionescu released a proof-of-concept tool called Purple Pill that created an easy way to load and unload unsigned (potentially malicious) drivers on Vista. The utility circumvented new anti-rootkit defences built into Vista by turning off checks for signed drivers.

Ionescu pulled the utility hours after its release after realising that the ATI driver flaw Purple Pill uses, which he learned about in a presentation by Vista kernel security expert Joanna Rutkowska at Black Hat last week, is yet to be patched.

Source: The Register

[WarEagleAU]

Sounds like Vistas super security isnt super secure. I doubt anyone would use an ATI driver flaw to do something like this, but at least its worth noting and they are working on fixing it.

[wiak]

Originally Posted by WarEagleAU

Sounds like Vistas super security isnt super secure. I doubt anyone would use an ATI driver flaw to do something like this, but at least its worth noting and they are working on fixing it.

everything is unsecure, dont think you ARE secure, just look at Blu-Ray Disc and HD DVD, and the (un)brackable AACS

"the history has thought use that"