Intel searches for Windows kernel-mode vulnerabilities, finds little to write home about

If hackers were able to exploit a vulnerability in a kernel mode driver for any operating system, they'd essentially end up with control of the entire system.  But, according to a story by News.com's Joris Evers, not only did Intel's exhaustive hunt for Windows kernel-mode driver vulnerabilities came up pretty much empty. Wrote Joris:

The operating system requires driver software for it to be able to run the hardware that is built-in or connected to the PC. A buggy driver can cause a lot of trouble. In particular, errors in the kernel-mode drivers, which run hardware such as network interface cards and hard disk drives, can cause fatal crashes that result in the famous "blue screen of death.".....The search came up almost empty....."It was difficult to find something that was useful for us," [said] David Schulhoff, a senior information security specialist at Intel.....many of issues found were old flaws in third-party software.  "Actually getting the vulnerable code proved to be impossible".......the exploits for kernel-mode drivers that do exist have proven to be very unstable because of the challenge of writing code at that level. "You can't stray very far from the path of what needs to happen within the kernel, or you're going to end up crashing the system rather than being able to gain access to it," Schulhoff said.

Not only that, score 1 in the security column for Microsoft.  The software giant is apparently ahead of the game in terms of anticipating such drivers as a potential target and is acting now to ensure they remain as invulnerable as possible:

....driver flaws have been getting more attention recently. Microsoft, for example, is readying tools for driver developers to scan their code for common vulnerabilities. The Redmond, Wash., software giant is worried that insecure drivers might end up hurting systems running Windows.

More reasons I think that Microsoft is finally getting that handle on OS-security that, for the longest time, it didn't appear to have.

• Also: Microsoft plugs 21 security holes - News.com (6/13/2006)