3

There are lot of signed drivers (signed by Microsoft) that don't affect the Windows OS. If an unsigned driver is installed in a Windows machinehow can it affect the stability of the operating system, ie. what are all the things it can do to affect/crash the OS? I heard that uninstalling the unsigned drivers may create some problems in the OS.

5

Memory Protection and More

Drivers have very deep system access which they often require, as they need full hardware access. Where normal applications are not able to access arbitrary memory locations and hardware, a driver usually can. Wikipedia has an excellent article explaining the different protection rings. This also bypasses all kinds of permission control.

A crashing application will just crash and possibly corrupt what it's currently working on, especially not crash other applications. A crashing driver will possibly crash the whole operating system. Blue screen usually occur because of hardware failures or crashed drivers ourdays; the Windows kernel itself is pretty mature and robust.

Crashing Drivers

This is also the reason starting with Windows Vista (one of its great enhancements under the cover) Microsoft took out the graphics drivers from the kernel mode, and put it into user land. This costs some performance for the so-called context and mode switches when drawing on the screen, but strongly enhanced robustness. Ever seen the message "your graphics driver crashed and is being restarted" and your screen flickering? Before Windows Vista, this would have been a blue screen instead.

In "earlier days", (I claim) most blue screens of death were triggered by bad driver software, especially with home user devices: graphics cards, sound cards, TV tuners. But end users don't blame the periphery company for this (most aren't even able to understand what the blue screen says), but Microsoft.

Why Does Signing Drivers Help With This?

  • If Microsoft signs a driver, they perform some automated tests to verify at least some basic quality of the driver software. What and how this is performed is very deeply technical and far beyond a superuser answer – join the appropriate advanced computer sciences lecture if you're interested.

    These tests will help at finding some programming mistakes, and probably also search for bad behavior (regarding security).

    While one might argue that a vendor could do this on his own, far too much don't or didn't. Microsoft enforces more robust driver software – a vendor has to provide reasonable ones now if he wants the broad majority of customers being able to use his devices.

  • By only allowing signed drivers to be loaded, malware that bypassed other security measures cannot just install a device driver.
  • The signature helps you as the user at putting trust into driver software. For example, the signature allows you to verify the driver really is distributed by the vendor claiming to do so, and was not for example exchanged by some attacker.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.