Slashdot Mirror
Windows' Patchguard Hinders Security Vendors
eldavojohn writes "Windows' PatchGuard seems to be upsetting third party security vendors such as Symantec, Sana Security and Agnitum. It sounds like the 'black hats' will be able to bypass this security feature (which will be in all copies of Vista) but force security software companies to give up developing software for Windows. From the article: 'PatchGuard will make it harder for third parties, particularly host intrusion-prevention software, to function in Vista,' said Yankee Group analyst Andrew Jaquith. 'Third parties have two choices: continue to petition Microsoft to create an approved kernel-hooking interface so products like theirs can work, or use "black hat" techniques to bypass the restrictions.' Apparently, using these techniques is not a difficult trick."
"Oh noes, windows has security! What'll we do?"
C'mon, get a grip. Despite the fact that this is a dupe, it still angers me that the 'major' pc protection companies can't deal with windows actually securing itself. They would actually consider using blackhat techniques instead of the provided methods? They'd be fools, too. Any blackhat technique they use would be immediately patched by Microsoft. Doesn't take a genius to see that.
"If you make people think they're thinking, they'll love you; But if you really make them think, they'll hate you." - DM
"Window's (sic) patchguard hinders security vendors"
My window's patchguard (namely iron bars) damn well better keep out "security vendors" trying to "hook into" my house.
Does this mean there will be a new day of the week devoted to patching the patchguard?
Where were you when the voynix came?
I can see why microsoft would want to stop people. It is probably an attempt to stop malware. However, I think there should be a way for this security software to exist, other than resorting to "black hat" techniques. I would say this could be described as Microsoft shooting itself in the foot. Trying to stop rootkits is good and everything, but not in a way that blocks my antivirus from protecting me.
Waffles rock.
"Window's PatchGuard" should be an optional feature. If you dont' want to use it, (like me!), you should be able to NOT include it when installing etc. Being able to do what you want is the best way, forcing users only pisses them off.
I remember something about the entire kernel becomming a "protected process" under an MS implementation of TCPA/TCG/Palladium/(insert name of the week meant to spoof drm watchers here).
This was meant to be an "effective" means to stop viruses, but it served more to force licensing fees out of companies which provide security solutions and to stop independent tinkerers (also known as "good" hackers) from providing cool kernel mods for power users.
VLC FOR MAC IS DYING! IF YOU DEVELOP, PLEASE SAVE IT!!
Urging consumers and computer makers to stick with Win2k/XP.
it's written, but if you even a little bit of the linked-to article, you will see that
this is for x64, but no mention about i386 bits i.e. the great majority of PC. My guess is
that this will be similar for i386 as well, though.
Providing Microsoft decides not to provide a better means for other software companies to run security products within Vista, I'm sure a large law suit will develop within the near future... in which case, MS will be handing over a good chunk of change... seems they always lose.
If they were smart, they would turn it into a way for them to make money. License the "technology" (for a "small" fee of course) to the software vendors so that they can attempt to provide a security solution.
Obviously if "security software" can bypass the restrictions, then so can malicious programs. There isn't any fundamental difference between software and malicious software that Windows can detect (one computer's virus is another computer's formatting software).
HRESULT WinAPIGetSystemProcessThreadMetricsMenu...
LibraryVolumeModuleHandlePtrEx(PHSPTMMLVM PHndl);
What? Did you run out of kayak stories ??? What sort of place is this anyway ?
Microsoft want you to pay them a monthly fee to get the Microsoft anti-malware stuff. Every obstacle they can toss in the way of cheaper alternatives is (for them) a good thing.
The rule is: If you are in the business of doing X - then Microsoft announce that they are getting into doing X - then you'd better find a way to do Y instead. In the absence of government intervention, an illegal monopoly can do pretty much whatever they heck they like.
www.sjbaker.org
It is fascinating that TFA explains how if a boot routine can initialize a "debugger attached" flag, the PatchGuard system is not initialized. From this aspect alone, I'd say MS should start playing more nicely with the vendors, since any malicious code worth it's salt should set this value permanently and then replace kernal routines on disk as necessary.
Also, given the fact that MS intends to making patching the standard for releasing a secure OS, the vendors can't really do this kernal checking themselves. Thus, I think it's safe to say from the perspective of this article, the OS's kernel is patchable by anyone.
Um, how is this security if its easily bypassed? Isn't the point behind any security layer to make it so nobody can bypass it? Seems to me that if its that easy to circumvent, Microsoft is just spinning its wheels, and there will be plenty of market for companies like Symantec/McAffee to compete in. Its not like the virus/trojan/malware writers give a single shit about any layer of security that they can bypass. Easily.
Symantec should be glad that Vista will have this ineffective security layer, so they can sell software to patch it.
A few years ago in office 2000 Microsoft dictated what attachments you could receive and what you could not. It sounds like Microsoft is attempting to create a business model of "If you want security you get it from us." and "We know better, you do it our way." Does the phrase duck and cover mean anything to anybody?
-- I am the NRA, enough said...
Oh, say does that Star-Spangled Banner entwine / The myrtle of Venus with Bacchus's vine?
1) Company creates horribly insecure OS.
2) New multi-billion $$ industry sprouts for the sole purpose of securing said OS.
3) Insecure OS company institutes blatantly obvious absolutely worthless security "features".
4) No longer new multi-billion $$ industry complains because new BS security measures are worthless & the new features steal their pennies.
4.5) Linux zealot chimes in on how these issues are not issues under their chosen OS.
5) Horribly insecure OS company forms new multi-billion $$ industry to secure their horribly insecure OS in a proprietary fashion.
6) Balmer covers the $1 he owes Gates for the bet they made on whether or not they can steal the billions from the industry that wouldn't exist had it not been for them & their lax attitude toward secure coding practices while blaming the whole fiasco on Google & Linux all the while creating a brand spanking new completely worthless multi-billion $$ proprietary industry. (Thank you Mortimer, er I mean Balmer)
This may be a stupid question, but why do anti-virus applications need kernel access? Do these programs need kernel access to simply scan for viruses?
"Microsoft want you to pay them a monthly fee to get the Microsoft anti-malware stuff. Every obstacle they can toss in the way of cheaper alternatives is (for them) a good thing."
Do you have anything to actually back this up, or is this just your speculation??
"But this one goes to 11!"
They would actually consider using blackhat techniques instead of the provided methods?
The entire problem is that Microsoft is providing inadequate "provided methods" to these security companies for them to do their jobs. This makes sense, since Microsoft is now in direct competition with some of these same security companies-- why would it provide "provided methods" which match the power of what is potentially available to internal development teams?
This isn't security, it's the illusion of security...
They'll typically hook the APIs that open files and redirect them to their scan routine before returning control to the OS. This requires admin privileges.
I'm wondering how copy protections like starforce (which really mess around with the windows kernel) will handle this. I'm guessing they'll just "blackhat" their way through it like they've always done.
They would have done a lot of things way differenty a long time ago.
/. many, many times. Apparently, MS employees are too busy shilling to actually read posts.
.EXE extension to execute! No more .SCRs, for example. They're getting worse rather than better about this; I downloaded the AOL antivirus to try it out (OT rant about it follows) and the download had a .MSI extension. It confused me for a minute; is this like .ISO when it's really not an ISO but you have to rename it to get through the firewall? No, it just ran, and installed AOL's software.
-Active X is a stupid, stupid security risk. Any Windows user with Active X shut off is safer. If MS were serious about security they'd have gotten rid of it long ago.
-Mixing code and data is stupid. Keep the data separate from the code! Of course, keeping code and data sepatate makes DRM harder to impliment, but why should DRM matter to Microsaoft - except for the fact that they value Sony-BMG more than they value their own customers.
-Have stuff default to "off" rather than "on". This has been discussed at
-STOP HIDING EXTENSIONS!!! Christ, it's incredibly STUPID that I can write a virus named NakedLady.JPG.exe and it will show up in most peoples' computers as NakedLady.JPG.
-Make programs have an
There are a whole lot more I can't think of off the top of my head; *nix's way of specifying whether a file is executable or not makes a whole lot of sense to me, MS's way makes no sense at all.
OT about AOLAV - ZoneAlarm gives me strong indications that there is something very, very fishy about this program. When the PC boots, the first thing AOL/Kaspersky's program does is try to access the internet. Ok, maybe it's looking for more updated virus sigs. But the SECOND thing it does is try to act as a server. WHY?
>Microsoft want you to pay them a monthly fee to get the Microsoft anti-malware stuff. Nope, Microsoft want to charge you $49.95 for three PCs for a year, other than the free AV products, I don't of any "cheaper alternatives" care to elaborate?
Users of 32 bit windows expect backwards compatibility. Redesigning the driver interface to plug all of the security holes would break this compatibility.
However, 64 bit windows is incompatible with 32 bit kernel mode drivers (the speed penalty would be too great). Users and vendors know that at least recompilation will be necessary, and this gives Microsoft an excuse to redesign the relevant APIs.
IIRC, linux driver developers know that binary compatibility is, at best, a nice bonus. This understanding allows the kernel developers more freedom to fix bugs.
There are lots of locations that only SYSTEM account has access to, so yes.
I would suspect it's about being able to spot the fingerprints of well hidden & stealthy root kits that may not be visible without being inside the kernel.
Am I getting this wrong, or have they actually removed the possibility of using hooks? Or are they just talking about creating a special hook interface for the security software vendors? Anyway, both cases would be obnoxious; removing hooks to improve security would break a lot of software, and creating a special hook interface for security software would be idiotic! Why leave a backdoor wide open?! It's like Greenpeace whining about too many whales in the ocean...
The only Windows box in our house is my wife's laptop, and we'll be keeping XP on that until XP is no longer supported. By the time that happens, I think it's likely she'll be using a Mac - so if we need Windows for anything (which would be her sewing machine software) we can run it without internet access.
#DeleteChrome
To do the job properly they need to intercept file accesses before the rest of the system and to do that they use a filter driver (which needs a reboot to install - hah!)
So, app or whatever request a file. The OS gets it off disc and the AV software reads it and approves it (or bins it) before the app gets it.
Filter drivers are inserted directly into the kernel I believe a bit like a module under Linux et al. Sadly they seem unable to make these things properly dynamic. You are probably patching the running kernel or something else equally daft but I am not a kernel hacker (Win or otherwise)
To be fair if you were going to do the same under Linux or anything else for that matter the above still applies. To get there first you have to run your AV scanner at the kernel level to intercept the calls transparently unless your file system driver has a built in mechanism to filter things through userspace.
that wasn't flamebait, it was insightful.
"if only i had known i would have been a locksmith." -albert einstein
The linked webpage contains a bunch of "techniques" which are mostly
"If we find a bug in this system call, PatchGuard will be worthless!"
along with a few
"This disables PatchGuard in the current beta build of Vista!"
This doesn't surprise me in the least. PatchGuard is obviously designed to eliminate third-party competition, not stop hackers.
If Microsoft intends to have its own anti-virus software/mechanism they must feel they're capable of doing this without the kernel hooks requested by Norton and ilk. The only thing I would take issue with is if Microsoft uses an undocumented API in order to get an unfair advantage over the third party vendors. When that happens, wake me up and I'll get back up on my anti-Microsoft $oapbox. Until then... bleh.
Check out my lame java blog at www.javachopshop.com
Windows Live OneCare service?
Many people knock windows for being insecure, but it's not like Microsoft WANTS it to be that way. No, the people who want it to be that way are the "security" companies. Anti-virus companies have profitted from security flaws and viruses alike for many years now, and it has begun a rather booming business and the focal business model for companies like McAffee and Symantec. These companies have a vested interest in maintaining security flaws and the propagation of virues out on the internet.
Lets say the un-imaginable does happen: Windows impliments some radical change to secure the OS. What happens to these companies? They stand up and try and present themselves as our saviours against these "evil black hats" but aren't they the ones with the most to gain from the current business model? By making windows secure, they will effectively end a decade long business model for these security companies by making them obsolete. Thats a good thing for users, but a bad thing for them.
I find it appalling that they would consider Microsoft taking steps to secure their OS as being "anti-competetive" in nature. The "security" market in this case exists only due to flaws and vulnerabilities in Windows. Flaws, which Microsoft has stated time and time again they are trying to correct.
I think people underestimate the task put forth before Microsoft in making windows secure.
Take a look at MacOS. Crashed alot, lots of security flaws and viruses for being such a small marketshare at the time. Apple realized the problem, and understood that constantly applying bandaids to a broken OS wasn't working. They re-did the entire OS to get OSX. The problem, of course, is no OS9- programs run natively in OSX. They had an emulator for awhile, and alot of people struggled with the transition. Like a catapiller to a butterfly, they were reborn in a more evolved state.
Windows, on the otherhand, doesn't have that sort of luxary. If MS were to re-write their code so that no previous versions of software would work, and all developers had to start over from scratch and learn new methods to program, it would cause disasterous consequences both for MS, and potentially for the world over. Best case scenario would be apple releasing OSX x86 on non-apple hardware and taking over the entire market. This, of course, would be the virtual end of MS, which they have no desire to do.
Microsoft is faced with trying to secure a broken OS, without actually starting over (which isn't an option) or breaking the ability of developers to make software for the platform. I'd be curious (as I imagine MS would be too) if anybody can come up with a real solution to the problem? And if you can, can you do it while still allowing the current "security" companies to continue to cash-cow the general public?
Actually wouldn't it be Microsoft Windows or MS Windows? Can the term "Windows" be used by itself? Are you talking about XWindows, Windows as a general term about GUIs, or the view to the outside world in your house?
Jim
PatchGuard isn't present in the 32bit O/S, it's x64 only.
>Users and vendors know that at least recompilation will be necessary, and this gives Microsoft an excuse to >redesign the relevant APIs.
There has been absolutely zero change in the standard Windows driver model, so this statement is misleading. True, on 64bit Windows all drivers need to be 64bit, but this is (generally) a single afternoon activity (fix all the places where you cast your pointers to ULONGs and then go home early).
PatchGuard just takes some clever advantage of x64 SEH and uses a timer to periodically check the system for changes to certain structures, it's not a part of some master plan to redesign APIs to be more secure (whatever that might mean).
The problem is that viruses and rootkits can hook into the kernel too. If detectors are really to have a reasonable chance of detecting these sorts of malware, they need to play on equal footing, i.e. hook into the kernel too.
Without that ability, a well-written piece malware can hook into the routines that the anti-virus program uses and filter results or otherwise disable its detection mechanisms. Even if the anti-virus tries to hook the kernel, and is loaded after the malware, it's starting from a severe disadvantage.
But if the anti-virus is loaded, it can hook the routines that malware uses to install its hooks and use them as a detection point.
I'll say it again, Microsoft has no incentive in providing a reasonably secure OS. (ex. your favorite distro) Like every version that's come before Longwait, it's a coordinated message to make the PHB's buy it because they "fixed security" in longwait.
Mom & Pop buyers will be okay with this because they'll pay MS every month like they pay a cable tv bill. The software monoculture pretty much dictates that their machine will be zombies anyway.
This works out great for me because I will have -plenty- of work baby sitting these things.
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
If PatchGuard was optional, the first thing malware would do after getting into your computer is turn it off. (Of course, this is only a problem for people who want it turned on.) The only solution is to make security that can't be turned off.
The whole "PatchGuard" concept shows how broken Microsoft's approach to an OS has become. The whole concept is to catch changes made by programs which already have full access to kernel space. By checking every five or ten minutes for a change, no less. That's inherently a futile exercise. It may break some current exploits, but it won't break new ones. Any program that has access to kernel space can take over the machine. It could load a whole new OS if it wanted to.
The whole concept of add-on programs having access to kernel memory is so insecure that it has to go. UNIX and Linux limit it to loadable drivers, and the serious microkernels like QNX and IBM's VM don't allow it at all. But the Microsoft world, mostly for historical reasons, has all sorts of crap running with access to kernel memory, from various "security programs" to game DRM components. All that crap should have been taken out in Vista. The fact that it wasn't indicates how minor a change at the kernel level Vista is over XP.
If you KNOW it's a gun fight, then bring an RPG.
I will never understand the level playing field argument in this situation. Since when is it an OS developer's duty to create an environment that is compatible with the software that is to run on it? I have never heard the argument that Motorola was in violation of antitrust law for creating processors that Windows wouldn't/couldn't run on.
I just do not understand why anyone would want to run Vista? What's the advanage? where's the value?
Thanks to eating disorders most chicks are reasonably good looking these days.
Thanks for the info. I've been referring to it incorrectly for quite some time then it seems.
Jim
"...it still angers me that the 'major' pc protection companies can't deal with windows actually securing itself."
I think the point is that Windows IS NOT actually securing itself. If it's easy for black hats to get around it how can it be "Secure?"
The race isn't always to the swift... but that's the way to bet!
When the story said Window's Patchguard, I thought it might be about a third party app to prevent or control the Windows Update facility. Silly me.
I really doubt that their objection is based at all or in part on any perceived dilemma of being forced into using "black hat" techniques.
Firstly, they haven't really stated what they consider to be a "black hat" technique, though I strongly suspect they mean that they object to actually having to actually develop and maintain code instead of relying on existing redmond-authored api's that provide a spoonfed data conduit.
Symantec's AV/Security products rely on MS' file access api's - as do most other major AV packages.
This means that they inherit all the weaknesses of the underlying win api's. This in turn is why they cannot detect, clean or prevent access to malware which cannot be addressed via the MS api's. I have had one virus and one trojan that Norton could not detect or clean, but which AVG and Kaspersky had no trouble blocking access and tossing into quarantine. Neither relies of MS file access api's in it's scan engine. Is this a "black hat" technique? If so, then black hat techniques are pretty much a requirement for effective security, and Symantec should wise up and get to work.
Would this be in line with Microsoft producing their own protection software and trying to drive others out of their market share? Sure would be a convenient way to do it, forcing Symantec, et al, to resort to hacking or paying extortion fees for kernel hookins.
The name is Windows, so it would be "Windows's" or "Windows'," not Window's.
How 'bout we just call it what it is:
broken
if it weren't for all the security flaws in Windows. they make their revenue based on the fact that there are security flaws that can be exploited by viruses and spyware. if people randomly stopped making viruses, then these third-party companies would be out of business, too.
You keep using that word. I do not think it means what you think it means.
Proud neuron in the Slashdot hivemind since 2002.
Yes, and it also prevents lots of well intentioned companies from writing a damn driver for their hardware. If you switch around the API with every point release, your kernel becomes high maintainance and not many (especially small) companies are able to put with that.
Think about this the next time you complain about the lack of drivers for Linux. Sure, some of have are proprietary. Some are never going to be developed because the company couldn't care less. But many other would be developed if only binary compatibility were somewhat guaranteed.
Global warming is a cube.
...we are forgetting Microsoft has it's own anti-virus software. I'm not saying MS is trying to shut out competition, but that MS wouldn't do this if it would break their own software. They probably have OneCare doing things the "correct" way.
...in Windows software world, your anti-virus hacks you?
But it's for your benefit?
Don't ping my cheese with your bandwidth!
Otherwise, chose Linux, the other OTHER white meat!
I actually had more problems with Host based security being why my computer doesn't work rather than an actual virus, worm, trojan, or whatever. The cure is worse than the disease. Either it eats up CPU without regard, block network access to legit programs, or destroys my HD. And it's always because the host based products try to hook the kernel with their horribly buggy products. One of my favorite such occurences was the security product that hooked the kernel actually smashed the TCP/IP stack, and the OS had to be reinstalled. No network connections would work. My point, host based security doesn't work, and the algorithms are expensive. It's just not worth it.
Now here is where the host based salesmen tells you that your network IPS system can't see encrypted traffice and you aren't really protected. However, I'm not sure how it could really do what he claims since so much encryption/decryption happens inside the process, and not the OS. VPN connections sure maybe it can see the traffic. But, think about your SSL connections you create in your programs. The OS doesn't know you're encrypting or decrypting traffic. So how will hooking the OS allow your host based agent to see my SSL traffic? You might be able to do some sort of hair brain hooking the processes with DLLs or something like that, but what if the program is in Java, Ruby, or some nonnative language? That technique is limited to only native apps. So actually I think it's just market bull in terms of why you think you need desktop protection.
My answer is the network has plenty of security that is better maintained and updated than the endpoints. Virus scanning happens in the email servers, network protection devices sit inline blocking known security threats, proxies scan http/ftp downloads, and everyone should be behind a NAT router so Windows Firewall is not neccessary. I trust the ISP's or Google to update their virus/security content more frequently than my grandmother. Granny has symantec on her system, but its worthless because Granny on the computer doesn't maintain it. Let the network OPs maintain it, let the network secure itself, and stop trying to put security at every end point which is largely unmaintained. It just doesn't scale and still provide a reasonable amount of protection. Host based security is the biggest chunk of snake oil salesmen ointment.
If I make $100 million by doing something dirty, and I'm fined or have to settle a case for $10 million as a result, did I really lose?
I could be wrong, but I get the impression that a lot of the Microsoft lawsuits go that way. They "lose", but meanwhile, they've crushed their opposition beyond repair, which overall makes them money.
Look many hear are going to argue that Microsoft is being anticompetitive, and maybe they are or maybe they are not, its not really the point. What is M$ supposed to do?
On the one hand they could make kernel hooks available to vendors and perhaps secure their use with code signing or something. Then the AV companies would be happy; but it would only be moments before some blackhats found away to expoloit the system and make their code look legit. Once it is exploited M$ is again accused (fairly) of producing software that really does not meet resonable security expectations for what it costs and they risk loosing market share.
The other option is lock down lowlevel access as much as possible and keep non M$ code out of kernel space lots of the biggest security problems become much easier to solve and M$ can produce a better product. Now they might sell some enhancements that would be M$ code could run where others can't and that might look unfair but we live with all sorts of other products that discorage after market parts as well. The next obvious question is if the black hats can by pass security why can't the security vendors who can at least count on the person installing the software having root level permissions on the system? Sure you might be playing a game of hide and go patch with M$ breaking stuff all the time but lots of people do that already.
The real story here folks is we don't live in a command economy. If you make something you had better be sure their is a need or want out there for your product. You also need to understand that MARKETS CHANGE if your organization has a single revenue streem you better be developing others or finding new markets for your one product.
If M$ actually succedes is producing a system with pretty good overall security then two things are true, one is that many users decide that additional security software offers too little utility to invest in at any price and two given the number of plays in the security market there would likely be so much supply that prices would have to drop until the less effice firms vacate the market.
Being upset with M$ securing their product as an security software developer would be a bit like a garage owner being upset that auto makers are putting cars out only need tune ups ever 5 years instead of every 5k miles. It might suck to be and security vendor or a garage owner but those are the breaks. Best stop crying and find a way to use your talent for something people will still want you would be better served.
Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
It's really a catch-22 situation. If MS doesn't provide a way for AV programs to load directly into the kernel, they aren't as effective.... on the other hand, if they do provide a way, that way can (and will) be leaked to that viruses and rootkits use it as well rendering the new security measures useless.
I guess it'll be a wait and see if these measures will work or not... if the kernel security system, coupled with the non admin use, works as intended, then the AV programs won't be an issue to begin with. What I wonder is that they say that the blackhats can bypass it... so, did they find out how? (and more importantly, did they report it to be fixed?)... and how easily?... I mean, if bypassing it depends on actually being on the computer, or getting the user to install an unknown program (inputting his admin password)), I don't see it being much of a deal, since that would be more of an user problem than an OS one.
The free AV products. Avast is very good and has actually caught infected files that Symantec ignored on my customers' PCs. I see no reason to pay M$ $50/yr if free products that are likely just as good as *their* software are available.
-b.
Agreed, free products are certainly worth exploring, but the implication in the original message (in my opinion) was that Microsoft's solution was more expensive than other commercial solutions like Norton etc which I don't beleive it is.
Go listen to "Don't Drink the Water" by the Dave Matthews Band (sorry I can't include a link to the audio file, you know how it is, but the text is on-line) and think about how the words apply here. Chilling.
Gary Dunn
Open Slate Project
excellent point, most 32 bit processors don't have the process execution flag enabled.. but nearly ALL 64 bit processors have the feature. When vista comes out, all desktop processors will be 64 bit. I believe Core 2 duo desktop is ready. The second clue would be Apple seems to be gearing for 64 bit as well, so intel will be pushing it heavily in the next 6 months. That processor shift could neatly include the TPC and anything else. Most importantly, the cool new media, protected conntent features could be only available to the new 64 bit processors on the new Vista OS. Minimal backward hacking compatiability because older PCs don't have 64 bits or the SEE3 instructions, registers, processor commands to even allow the hacked code to run. Intersting idea.
What you defend is classic Microsoft anti-competitive behavior. Charge less, and wait for the competition to abandon that market segment or go under. N-E-T-S-C-A-P-E. Operating "Windows Live OneCare" at a loss is not a problem for Microsoft. They don't rely on it to pay the rent.
Consider this series: "OneCare" -- "MonoCare" -- "Monopoly"
"No more worrying about different versions of your antivirus software."
Gary Dunn
Open Slate Project
BrainGaurd is new gift from God the prevents diseases from Satan, like Alzheimer's, from taking control of your brain. However, it looks some doctors, reasearchers, and insurance companies now claim to have been locked out of of a big piece of the health industy.
However, BrainGuard does not protect agaisnt all of Satans tricks, like cancer, which still need additional research. One has to wonder why, now that one problem is solved, that these unemployed entities cannot go to work on new/additional problems and are not rejocying that such a big problem like Alzheimer's is cured.
When asked for comments, God said, "I dont understand it, I prevented the problem, nobody gets the disease anymore, why are they unhappy.. I should just re-write the whole thing to be perfect"
If Windows implements an approved kernel hook for the antivirus companies, it will get exploited
Not exactly - Windows Vista breaks a lot of hardware support by forcing most drivers to exist in user mode instead of kernel mode. This keeps the system more stable because a crappy driver running in user won't bluescreen the computer and besides, your printer driver doesn't need to be in ring 0 anyway.
Most antivirus software uses a kernel mode driver to implement "on-access" scans or to see past a user-mode virus trying to cloak itself in some way. It's not that Microsoft isn't implementing a special backdoor hook; they just disallow almost every kind of kernel mode driver in Vista.
DATABASE WOW WOW
Administrator accounts in Vista are much better handled than in XP. Even when you're logged on as an administrator in Vista, you run with user priviliges. Should a program actually NEED your admin powers, a little dialog box pops up whenever a program tries to use admin priviliges. (It's a little annoying, but it doesn't happen as often as you'd think and it's much more secure.) When on an strictly userland account, this box also has a prompt for the admin password.
For games and other programs that pretty much scream for administrator access, you can still have it run with admin priviliges like in XP. The Vista build of Internet Explorer 7 also takes advantage of some security tweaks in the kernel that let it run as a super-limited user account - all ActiveX controls spawn as processes of the low-privilege IE7 thread (and inherit IE's restrictions), and all file reads/writes are redirected by the OS to a junk folder. So, even visiting an exploited website with IE while running as an administrator on an unpatched system probably wouldn't result in an infection.
DATABASE WOW WOW
I'm not defending it, and the post I responded to was talking about how Microsoft was trying to destroy *less* expensive products. Perhaps you should read the whole thread before responding!
It's really a catch-22 situation. If MS doesn't provide a way for AV programs to load directly into the kernel, they aren't as effective.... on the other hand, if they do provide a way, that way can (and will) be leaked to that viruses and rootkits use it as well rendering the new security measures useless.
Well their is a third way run the anti-virus/Trojan/root-kit software from a boot CD that solves all the problems.
... it kind of looks like: we want to take away your privacy/freedom so you could be safer. I mean, not strictly speaking only about MS vendor-locking...
Normal secuity level. Light selinux procection on deamons and the like.
Low selinux disabled bad things can happen at this level.
Notice only Normal and low. Can you harm the system as root user .
Preparing for a attack mode. selinux fully on strict mode. Even if loged into root depending on settings root might not be able to reconfigure system. Fully on and locked down only way to reconfigure system is reboot and alter boot loader to put system into Normal or low mode.(hopefully you pull network cable at this point so system is not at risk in low or Normal mode).
And that is using off the shelf linuxs.
There are other things other than selinux that can be added to harden it even more.
The point the secuirty is truely in the hands of the system admins. Windows it is not. Signing of drivers is optional in linux.
Actually, there is an official way to filter filesystem access in a well-defined manner, and antivirus systems do use them.
However, not all threats are filesystem-based, so this method - on its own - is insufficient. If you want to add an additional protection - such as protect your antivirus processes from tampering - you'll have to hack your way around it, as is frequently done by both antivirus vendors AND blackhats (and Sony, too).
The lesson here is that a sufficiently large corporation is indistinguishable from government. --ultranova
It's not that windows will be secure, exactly, it will still be able to download disabling code from microsoft. Their firewall is transparent to their own software.
:-( ).
.. too bad it's on an internal, non-routable subnet. When I complained to MS-support about the update problem, they had me uninstall my firewall software completely -- to download "patches" (not install or download an SP2-upgrade), just the normal "firedrill tuesday".
Recently, I was forced onto SP2 (new computer, old computer died, even linux won't run on the new system -- doesn't see the SAS Harddisk at all nor the Gigabit Broadcom ethernet; I'm sure it will be supported in 12-18 months
But one of the brilliant things I noticed about their "security upgraded XP" was that it seemed to "disable" most of my current security. Now windows goes around the firewall product I have installed. Other software is still blocked. Even MS-sites appear to be blocked, but the WGA-authentication and update routines -- they just go around the firewall.
This is will be the end of user's controlling their machines that run MSed-upOS. The creator of the sysinternals site was being happy about Microsoft adding new "managed" hooks to allow programs to monitor various functions -- but my guess is it's the equivalent of a sucker punch. Vendors switch to the new interfaces to do monitoring, but anything that MS wants to hide will be hidden from their new "hooks".
XP2 also ignores user and computer proxy settings -- it first tries to go direct (around my SW firewall)
Then they told me I had to take my computer out of a domain, and wanted me to hook it up directly to the internet so it could go around any checks on their access. Sorry, told them, I wasn't in a position to eliminate the proxy server from the equation (it actually would be a pain, even if I wasn't annoyed by their blatent attempts to circumvent my network security.
Yeah -- great! We can all rely on MS, to keep us safe, because we know they will never download anything harm(WGA)full, that could accidently deactivate our computer. It's such a pain, as well to keep calling them up to get activiation codes...it takes way too much time and I usually get shunted over to a person who tries to grill me about multiple installs. I tell them the truth. If they put out an OS that didn't need reinstallation on a frequent basis, they wouldn't keep getting license hits from the programs I have to reinstall. Idiots.
-l
It sounds like the 'black hats' will be able to bypass this security feature (which will be in all copies of Vista) but force security software companies to give up developing software for Windows.
What? Microsoft exploit its control of the operating system to destroy competitors? Surely you jest. HA HA HA!
"A laugh can be a very powerful thing. Why, sometimes in life it's the only weapon we have," Roger Rabbit
Despite what everyone seems to think, PatchGuard is not security. It's "security through obscurity", which is not security. If you are a rootkit running in kernel mode, you can patch out PatchGuard. It may be difficult to reverse engineer, but it CAN be defeated. I still think it's a great idea.
/dev/hda with a hacked MBR and reboot.
The "security" vendors out there have nobody to blame but themselves. For years now they've been installing badly designed "security" software that damages the integrity of the system. This software adds hooks into syscalls that frequently crash the system or make it easy for unprivileged user-mode programs to crash the system. Worse, some of these unintentionally add back doors to the system that allow privilege escalation.
PatchGuard prevents legitimate software developers from doing things they shouldn't be doing. If a legitimate software developer breaks PatchGuard, the next second Tuesday their software will stop working. Meanwhile, rootkits are completely unaffected; they've pwned your system for a month already.
Many people suggest that kernel drivers should need to be signed to solve these problems. This is a terrible "solution" for many reasons. For one, you have to severely restrict user mode in order for it to work. To explain it to UNIX users, "mkfs", "fsck", etc. would have to become kernel programs because otherwise bypassing signature checks becomes easy: overwrite
Driver signing throws the ability to write kernel software out the window for anyone not able to pay the VeriSign Tax - and only corporations, not individuals, can get such a signing key.
PatchGuard does have one problem from my perspective: you cannot implement features that Microsoft hasn't implemented or has removed. For example, I wanted to make my own NTVDM for Win64 since Microsoft removed it. I found out that it is impossible, because Microsoft removed support for LDTs in Win64. You can't add it yourself with a kernel driver, because you'd need to patch the context switch mechanism - the kernel doesn't have code to switch LDTR values between processes anymore.
Melissa
"Screw Sun, cross-platform will never work. Let's move on and steal the Java language." - Visual J++ Product Manager