Slashdot Mirror
AMD/ATI Video Drivers: Unsafe At Any Speed
An anonymous reader writes "CERT/CC has called out AMD for having insecure video drivers. AMD/ATI video drivers are incompatible with system-wide ASLR. 'Always On' DEP combined with 'Always On' ASLR are effective exploit mitigations. However, most people don't know about 'Always On' ASLR since Microsoft had to hide it from EMET with an 'EnableUnsafeSettings' registry key — because AMD/ATI video drivers will cause a BSOD on boot if 'Always On' ASLR is enabled."
first prost formula 1
This isn't very surprising AMD/ATI have always had crappy drivers. I wish their fan base would stop apologising for them and demand AMD put more effort into their products.
Acronym Overload Detected. A summary is supposed to summarize but I couldn't tell what this story is about unless I already know.
Live today, because you never know what tomorrow brings
...because it crashes before any malware can do any damage.
The story is about DEP and ASLR effectiveness at blocking exploits. IT has nothing to do with the title or the ATI/AMD aspect.
Have a nice day!
Nothing is secure. Man can make it, man can break it. This is yet another proof of that concept.
To think otherwise is sheer stupidity.
Oh, wait, this is CERT we're talking about. Stupidity comes from them in spades. Let's audit all of their systems, bet you 10,000,000:1 they're just as insecure as the stuff they're claiming is insecure.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
Oops, My mistake, ignore that post.
Have a nice day!
Nearly four months ago, I noticed that my internet connection was very sluggish. Eventually getting fed up with it, I began to seek out software that would speed up the gigabits in my router. After an hour of searching, I found what at first appeared to be a very promising piece of software. Not only did it claim it would speed up my internet connection, but that it would overclock my power supply, speed up my gigabits, and remove any viruses from my computer! "This is a fantastic opportunity that I simply can't pass up," I thought. I immediately downloaded the software and began the installation, all the while laughing like a small child. I was highly anticipating a future where the speed of my internet connection would leave everyone else's in the dust.
I was horribly, horribly naive. Immediately upon the completion of the software's installation, various messages popped up on my screen about how I needed to buy software to remove a virus that I wasn't aware I had from a software company I'd never once heard of. The strange software also blocked me from doing anything except buying the software it was advertising. Being that I was a computer whiz (I had taken a computer essentials class in high school that taught me how to use Microsoft Office, and was quite adept at accessing my Facebook account), I was immediately able to conclude that the software I'd downloaded was, in fact, a virus, and that it was slowing down my gigabits at an exponential rate. "I can't let this insanity proceed any further," I thought.
As I was often called a computer genius, I was confident at the time that I could get rid of the virus with my own two hands. I tried numerous things: restarting the computer, pressing random keys on the keyboard, throwing the mouse across the room, and even flipping an orange switch on the back of the tower and turning the computer back on. My efforts were all in vain; the virus persisted, and my gigabits were running slower than ever! "This cannot be! What is this!? I've never once seen such a vicious virus in my entire life!" I was dumbfounded that I, a computer genius, was unable to remove the virus using the methods I described. Upon coming to terms with my failure, I decided to take my computer to a PC repair shop for repair.
I drove to a nearby computer repair shop and entered the building with my computer in hand. The inside of the building was quite large, neat, and organized, and the employees all seemed very kind and knowledgeable. They laughed upon hearing my embarrassing story, and told me that they saw this kind of thing on a daily basis. They then accepted the job, and told me that in the worst case, it'd be fixed in three days from now. I left with a smile, and felt confident in my decision to leave the computer repairs to the experts.
A week later, they still hadn't called back. Visibly angry, I tried calling them countless times, but not a single time did they answer the phone. Their negligence and irresponsibility infuriated me, and sent me into a state of insanity that caused me to punch a gigantic hole in the wall. Being that I would require my computer for work soon, I decided to head over to the computer repair shop to find out exactly what the problem was.
Upon entering the building, I was shocked by the state of its interior; it looked as if a tornado had tore through the entire building! Countless broken computers were scattered all about the floor, desks were flipped over, the walls had holes in them, there was a puddle of blood on the floor, and worst of all, I saw that my computer was sitting in the middle of the room laying on its side! Absolutely unforgivable! I soon noticed one of the employees sitting behind one of the tipped over desks (the one that had previously had the cash register on top of it); he was shaking uncontrollably and sobbing. Despite being furious about my computer being tipped over, seeing him in that state still managed to make me less unforgiving. I decided to ask him what happened.
A few moments passed where the entire r
MAC IS 4 GURLZ!!!11
A Little Heavy on the Ancronyms Don't You Think?
As a long time AMD/ATI user of CPU/GPUs, this sounds ominous.
If true, either AMD/ATI has to kill it, or we will have to kill AMD/ATI.
The CERT article mentions it, and it mentions it in that you cannot use the DEP/ASLR protections (in the kernel) because ATI/AMD make an incompatible driver. And since graphics drivers are kernel things, loading them means the kernel must disable DEP/ASLR, making your machine just that much less secure because of it.
Insecure means not confident, not safe is unsecure.
But it's damn close !!
call the next ati card the pinto.
Preventing yesterday's attacks, tomorrow.
"Flyin' in just a sweet place,
Never been known to fail..."
When a problem with their chosen product is pointed out, they try to deflect it with criticism of the product offered by someone else. Happens all the time with videocards. The two camps have some really rabid fans who cannot accept any criticism of their chosen card and if it happens they instantly start screaming about the other vendor.
I'd been using AMD cards for years. Most recently a 5850 2GB(Rare, I know) and then a pair of 6870s in a crossfireX configuration.
The complaints about crashes and BSODs are old, guys really. Almost as old as the IBM 'Deathstar' complaints. (You realize that was over a decade ago, right? You also know that IBM no longer makes the drives, right? And still you won't shut the fuck up. God damn people, get a life)
I do, however, have other issues with AMD's drivers and it was one of the reasons I just picked up a new nvidia 670 a few days ago. (That, and the new nvidia kelper GPUS are absolute monsters. You know you've reached a milestone when the latest Elder Scrolls game runs near 120fps on fully cranked settings - Yeah I've got a 120hz display No, I don't use it for 3D)
1. Crossfire - Crossfire is great in theory, and it's great when it works.. But it works inconstantly, and suffers performance problems in certain situations on certian systems and absolutely no one can tell you why. It's also often takes months after a game release, and updates from both AMD and the game dev to get things working properly. Not worth the trouble. The clincher for me was Skyrim and Max Payne 3 at launch day. When turning off crossfire and dropping to a single card triples your performance, you know something is wrong.
2. Driver installer - Whoever writes the core of the drivers is doing fine. The installer, however, is just plain braindead. Most enthusiasts recommend a manual clean-out of old driver files-settings every time you update. For good reason.
3. UI - The control panel is just a bad UI experience, and does not have many useful controls anyway. Most serious tweaking happens in third party unities.
4. Connectivity features. Nvidia's devices just have better handling of various settings for video out. You have finer grain control over port settings, refresh rates, display settings, HDMI settings, etc. AMDs' drivers also completely shit themselves if you've got a device that reports bad EDID information (Lots of HDTVs), whereas Nvidia drivers can hack around it by forcing an output setting.
All of the above issues really aren't about the drivers themselves, but the installer, UI, and configuration tools. The userland end of the experience.
As the MS blog in the second link stated, DEP + ASLR is already being exploited and that blog post is two years old at this point.
Still wish AMD/ATI would improve their drivers.
Don't know something? Look it up. Still don't know? Then ask.
I am using an old laptop with Windows 8 to type this with an ati chipset. I noticed Windows 8 kept freezing and having issues until ATI came out with an experimental driver.
I used Regedit and found nothing with EMIT and UnsafeSettings in the registry as Windows 8 enables this by default. Now I know why it had so many issues before.
I do hope this issue is resolved as I always correct XP loyalists trolls on Slashdot saying how secure Win 7 is for these reasons. ASLR and DEP cut malware in half in any enterprise that migrates ... well except if they have ATI chipsets or cards. THis really blows for me as I refuse to run Metro garbage on my main work desktop and will not void my warranty by ditching my ATI card.
http://saveie6.com/
The two camps have some really rabid fans who cannot accept any criticism of their chosen card and if it happens they instantly start screaming about the other vendor.
What's wrong with "Sure, my card has problems, but your card also has problems, and here's how your card's problems are more noticeable in practice"? If bad isn't allowed to complain about worse, that's the perfect solution fallacy.
Yes it does.
ATI's drivers to me are lower quality but there hardware is higher quality and it is a tradeoff as I have had NVidia cards fail before going all ATI at home. It is part of the product whether you like it or not.
I am an AMD fan too, but I am glad it is brought up as I am irritated at this and need to know this to make sure work pcs do not come with ati products that can raise TCO and increase malware. DEP and ASLR is the main and pretty much only reason why I can justify a Windows 7 migration over XP. If the desktops have this disabled then what is the point?
AMD's latest driver for Windows 8 does not have the issues as I just checked the registry. Maybe the driver can be backported to Windows 7 ... hopefully.
I am not trying to be a troll here but to me this is serious. I am sick and tired of malware and this erases years of progress at Microsoft.
http://saveie6.com/
It's not a proof that there are no provable statements, which would be self-contradictory.
Yes, that would be self-contradictory, but a statement that "most interesting statements are unprovable" would not be self-contradictory. Most statements about computer programs, for example, are undecidable as a consequence of the halting problem's undecidability.
ATI has had broken drivers since the 90's. And they made it as hard as possible to find and download the correct drivers for the multiple versions of their cards. Even today AMD/ATI doesn't make it easy to update. I got as far away from them as soon as I could once the nVidia Riva 128 came out. Even with memory tricks it smoked any ATI and most Voodoo cards. And the drivers just worked, every time. nVidia has kept the same philosophy ONE driver for ALL. love that.
The reason AMD's drivers suck is that they only have to be as good as nVidia's, which these days is a very low bar to meet. It used to be nVidia made good drivers and that was the main reason to purchase a nVidia card, but sadly that doesn't seem to be true any longer. Instead of forcing AMD to come up to nVidia's level, nVidia chose to sink to AMD's level.
suddenly all these anti AMD stories get run, funny that ain't it.
Microsoft is constantly telling people that they won't sign their drivers unless they pass strict quality and certification standards. MS should just deny that to drivers as buggy as these are reported to be.
Oh wait... that would mean MS Is actually committed to quality as opposed to just needing an excuse to deny the little guy who wants to write some driver-level code.
While that is correct, Slashdot just got a bunch of money from nVidia, so the opportunity to create that appearance just couldn't go unutilized.
When I bought my laptop with ATI Radeon 4 years ago I thought I would have a continuous development of the open source driver, and I was happy to get rid of the nVidia dependence. nVidia stops to develop the driver after some point and you have to live with the open source, which is not supported by the nVidia team anyways and does not have accelaration. You have to either keep an old kernel, move to the open source or trash your ~3 years old hardware. AMD/ATI pretend to have open source drivers at the same time they keep their closed source drivers. The open source drivers will always compile and run in the latest kernel, which is great. This is the spirit of GNU/Linux. But the closed source ones don't. They stop to develop the closed source driver like nVidia does. From that point your driver may or may not run against the latest kernels. It would be great if they open the source code of their drivers, instead they start to develop a new crappy open source with lots of features missing, mainly 3D accelaration, which really sucks. Thanks AMD/ATI for your double standard. I will be moving on to Intel in the future.
... you failed to mention that. Oh, right. Your goal was to be sensational. Carry on.
So to GPL fanatics, intellectual property = being raped in the ass?
Yeah, sounds like a pretty dumb ideology to me.
After owning half a dozen ATI cards over the years (currently using an AMD 7970 in my main rig), I had no idea how crappy AMD drivers were. Just because I've had more trouble with nVidia drivers on the 3 GTX275s and 2 GTX570s I currently use for GPU computing doesn't mean a thing, because that's just anecdotal evidence...right?
Luckily I came across this thread with all the hard data on AMD vs nVidia driver quality before it was too late. Thanks Slashdot!
ps - would it be possible for one of you fine Slashxperts to link to documentation on how many times this blatant deficiency in AMD driver quality has been exploited? (shouldn't be too difficult, since it's been 5+ years since ASLR was implemented in MS operating systems)
Heh. my thoughts exactly. This is the second such article in like a week. Something fishy about it all. Im not saying that AMDs drivers are perfect but i cant say ive had any problems with them in the last 10 years. The last time i remember them crashing was like 7 years ago while using the old radeon 8500. Crashed during counterstrike. It wasnt even a BSOD just a driver restart. Miraculously once the picture was back i was still alive. :)
The drivers used to be bad but that was during the rage3d era. Im sure half of slashdot users are too young to even remember that those cards existed.
I dont know why Nvidia is regarded so highly. During the vista era the majority of BSODs were because of their drivers. Thats pretty bad considering the amount of drivers running on a computer.
Cant say ive had much trouble personally with nvidia as well. My old 6600gt worked okayish. BSOD once a month. Annoying but bearable. My Nvidia ION based HTPC also works most of the time. A lot of problems with their HDMI audio drivers. I have to reinstall the damn driver once a month because it just stops working. Since ive figured it out that i should just run the install again and it works then its not much of a problem anymore.
Because of this deficiency in AMD driver, windows kernel cannot use ASLR. So pretty every virus/malware that depends on Address Location could have been prevented. And lot of virus and malware do.
After owning half a dozen ATI cards over the years (currently using an AMD 7970 in my main rig), I had no idea how crappy AMD drivers were. Just because I've had more trouble with nVidia drivers on the 3 GTX275s and 2 GTX570s I currently use for GPU computing doesn't mean a thing, because that's just anecdotal evidence...right?
Funny, I have the opposite experience.
Using nVidia cards for years which worked mostly fine (the odd shitty release that caused BSODs) but had lots of features and was very fast, easy to use and highly compatible with most games. I switched to AMD after nVidia decided selling resistive heaters as GPUs (Fermi) was the way forward and have been thoroughly disappointed with graphical glitches in games (bad Z ordering, lighting flicker, shader effects only applying every 2nd frame), desktop lag (seriously, the fucking desktop in Windows 7 suffers frame-rate drop), a shitty control panel that is painfully slow (i7-920 CPU, opening Catalyst takes 5 seconds for that pig to page itself in then uses 150MiB RAM, lags an additional 1-2secs when switching pages) and they only just recently added per-application profiles (and the UI for that is horrible, designed by retarded monkeys on a 5 minute deadline apparently).
The best thing I can say is that in 1.5 years, the drivers have only blatantly crashed twice ("Windows detected that the graphics driver was not responding and restarted it"). I get the impression that half the Catalyst team knows what they are doing (good ideas here and there, mostly behind the scenes stuff though) but the rest are morons (especially whoever is responsible for the UI parts) and they're managed by idiots.
ps - would it be possible for one of you fine Slashxperts to link to documentation on how many times this blatant deficiency in AMD driver quality has been exploited?
Constantly. ASLR was designed to disable existing malware and buffer overflow shellcodes, requiring that new, smarter malware be written from scratch. Effectively, disabling ASLR ensures that the legacy of simple Win95-compatible hacks will continue to function correctly on Windows 7.
Because of this deficiency in AMD driver, windows kernel cannot use ASLR. So pretty every virus/malware that depends on Address Location could have been prevented. And lot of virus and malware do.
I understand/agree with your point, but when I see a headline like the one made in the OP, I think someone's trying to convince someone else that the sky is falling.
I guess what I was trying to get at was: is there data that supports the claim made in the headline? In particular, has it been shown that AMD equipped systems have higher rates of becoming compromised than non-AMD systems? If such a premise was demonstrably proven, I think AMD might move ASLR compatibility up their priority list.
And frankly, I'm sick of people claiming one manufacturer's drivers suck and the other's don't based on their own personal experience. Amazing that so many don't realize how stupid they sound.
TFA basically gives AMD a downmod (consider it a +1 Sucks) because they do not care about supporting simple security features (which some of other posters extrapolate, along with their personal experiences to, they suck worse than Nvidia). Making code compatible with ASLR is not complicated or time consuming at all (I have been involved in linux driver programming), it is just that they have not bothered with it. The result is a simple and effective shield that ASLR and DEP provide is broken.
Funny, I have the opposite experience.
Which is exactly the point I was trying to make. Your experience or my experience or the sum of /. experience doesn't mean squat. In the end, it's all anecdotal.
ps - would it be possible for one of you fine Slashxperts to link to documentation on how many times this blatant deficiency in AMD driver quality has been exploited?
Constantly. ASLR was designed to disable existing malware and buffer overflow shellcodes, requiring that new, smarter malware be written from scratch. Effectively, disabling ASLR ensures that the legacy of simple Win95-compatible hacks will continue to function correctly on Windows 7.
If you can point me to data showing AMD-equipped systems have higher rates of becoming compromised than non-AMD systems, please do so.
While I would agree that AMD system are more vulnerable to attack because of ASLR incompatibility, I'm certainly not convinced AMD systems are more "unsafe" than others.
Couldn't agree more. To be clear, I'm not defending AMD on this. They've owned ATI for long enough to have addressed the issue. But IMO, the claim made in the headline doesn't pass my sniff test. Smells like FUD to me.
EMET is a tool Microsoft releases to enable specific settings, then they hide stuff like the "AlwaysOn" behind a registry setting they term unsafe.
Nowhere does it on any of the linked Microsoft pages say that this "unsafe" is hidden because of AMD, unlike what the article boldly suggests. Microsoft would be unlikely to grant WHQL status to drivers violating something it actually wants on by default.
Nobody gets the EMET settings "by default". You have to download and run it, many options you have to enable per-program, and many programs don't work with it.
The article they link to says Skype, Microsoft's own Silverlight, and World of Warcraft all don't work with the EAF option (everything is enabled by default for a program you select).
Nobody is getting, or would get, any of these protections "by default". So saying that AMD drivers "are making your computer less secure" is ridiculous, given that even if it's still an issue (the only linked mention hasn't been updated in over a year), it's limiting the maximum POSSIBLE security, which you would have to enable and run yourself...turn on settings that Microsoft deems unsafe, and knowingly risk making your machine unbootable. All for having ALSR "potentially" work for binaries that don't deem themselves compatible? Great...
Microsoft's own documentation says that all binaries can opt-in to ALSR (same as they have to opt in to DEP by default), but it has nothing to do with system drivers. Out of all of the processes running on my system, only two (an IM client, and a mouse hook service) don't have ALSR. These days, on VS2010, binaries are compiled with the ALSR and DEP flags set by default. You have to specifically opt out.
EMET's own user manual says that it uses a different, conflicting ALSR implementation than what the system natively does...might explain why fewer things are compatible with it.
TLDR: There is no evidence whatsoever that AMD drivers would make your system "actually less secure". There's one note that it "could" make your system less secure, if Microsoft were pushing a security option that it doesn't support.
People should focus on actual issues, instead of inventing imaginary ones just to try to make themselves more relevant and "in the news". I'm disgusted by CERT's behavior. I would've thought they'd at least stick to the actual facts of the case, instead of acting like the dime-a-dozen "don't need no fact checking" bloggers.
Disclaimer: I currently have an AMD card, have used both Nvidia and AMD cards since the late 90s with varying success.
"A Goddess rarely smiles for she is forced by others to be an island unto herself." - Zephiris
Where did you read that AMD drivers make your system "actually less secure" ? Neither the linked article or the summary state this. The blog title is: "AMD video drivers prevent the use of the most secure setting for Microsoft's Exploit Mitigation Experience Toolkit (EMET)"
And the conclusion at the end states: "Microsoft Windows systems that have an AMD or an ATI video chip cannot be secured as well as systems with video chips that have ASLR-compatible drivers. "
Both of which very clearly convey the idea that a system that uses AMD drivers cannot be locked down as much (system-wide ASLR) as one with ASLR-compatible video drivers. In other words, the use of an AMD driver limits the maximum possible security settings that a user can enable his or her self.
Hardly seems sensational to me.
P.S. Out of the entire set of modules on your system, what percentage would you say are compiled with VS2010 or later? You don't have to answer that. Just think about it.
what exactly does this mean for me and my radeon hd?
I have had so many piss poor nvidia cards in the last few years that I switched to AMD
Wait. You're basing build quality on the designers?!?
I have a pile of broken 2xx cards in my desk that I am looking at right now. They seem to last a few months to a year.
Now you're basing build quality on 1 persons experiences (and from these explanations I'm guessing that person isn't very competent).
RMA'd cards from MSI and asus always come back and work for a few more months before failing to POST or creating graphics errors.
Really? That's quite the exceptional experience. How many BBB cases do you have? Which consumer protection agencies did you contact? How many lemon-law refunds did you get? Did you go to small claims court?
Or did you do none of those things because in all likelihood you are the source of your own problems?
No one gives a fuck about your bitcoin mining problems. You must be a special kind of retard to have problems with nvidia drivers, nothing could be simpler. Don't buy shit motherboards perhaps? I don't know....except that I do. Zero problems here, ever, going all the way back to the original TNT. The same can not be said about ATI/AMD. You want to talk about heat/power problems? Fine, explain the Thunderbird to us all.
No one gives a fuck about your bitcoin mining problems. You must be a special kind of retard to have problems with nvidia drivers, nothing could be simpler. Don't buy shit motherboards perhaps? I don't know....except that I do. Zero problems here, ever, going all the way back to the original TNT. The same can not be said about ATI/AMD.
I don't mine bitcoins. If I did, I certainly wouldn't use nVidia GPUs. nVidia's architecture just isn't well suited for that type of workload. I participate in GPUGRID (CUDA) and World Community Grid (CPU/OpenCL). Please consider volunteering some of your excess CPU/GPU capacity to these worthy BOINC based projects.
As far as motherboards go, I'm currently running 6...all of which have been crunching DC projects 24/7 for about the last 2 years. Doesn't that indicate my motherboards aren't shitty? Or am I still being retarded?
You want to talk about heat/power problems? Fine, explain the Thunderbird to us all.
Uh, no...no I don't want to talk about heat/power problems. But you seem to, and I'd love to read your musings on the topic. I would only read, because I would never presume to engage in a debate with someone of your intellectual capacity. In any case, thanks for taking the time to grace me with your wisdom and experience. I truly feel smarter after reading your post. You must be part of Slashdot's special retard enlightenment task force.
Right now, you have two choices in AMD/ATI drivers on Linux:
-Catalyst (closed source, fast, but has the aforementioned problems with the changing kernel interfaces and a general reputation for crappiness)
-and the open source driver (much less complaints from users, but much weaker performace).
I'm following the Linux graphics driver development via Phoronix.com, where Michael Larabel frequently publishes benchmarks of the latest open source driver versions. And progress is definitely there, but so far it is mostly in the "correctness" department:
Up to maybe a year ago, many benchmark results were incomplete because the open source driver would crash on some games. Or significant parts of the graphics were missing. Today, such gaps in the results are rare. But progress on the performance front is slow and when a new optimization comes in, it is usually like "great, instead of 25% of Catalyst performance we have now 30%"
C - the footgun of programming languages