Slashdot Mirror
Security Companies Tussle With MS Security Center
hey0you0guy writes, "The large security firms such as Symantec and McAfee want Microsoft to allow them to replace Microsoft's Windows Security Center. Microsoft is refusing these requests. 'By imposing the Windows Security Center on all Windows users, Microsoft is defining a template through which everybody looks at security,' Bruce McCorkendale, a chief engineer at Symantec, said in an interview. 'How do we trust that Microsoft knows what all the important things about security are to warn users about?' Given Microsoft's past, with vast piles of security flaws and patches, they should at least cooperate with these companies. A dispute still exists over PatchGuard, a security feature that Microsoft says is designed to guard core parts of the 64-bit version of Vista, but which critics say locks out helpful software from security rivals."
And that's why MS will never allow other companies to replace it. It seems to say "this makes the user more secure" but it actually says "this makes US more secure". Notice how that is the vector that allowed Microsoft Genuine Advantage onto all the XP machines. Which is also doublespeak - there is no advantage to the user, only to MS.
If these guys think MS will simply hand over the keys to that much control, they're nuts.
Weaselmancer
rediculous.
I don't agree a media player or a web browser but I do beleive security should be part of the kernel.
"There are more things in heaven and earth, Horatio, than are dreamt of in your philosophy."
This is the very same thought I had...
Even if they only give the method to approved companies... What's to stop some nut job programmer for Mcafee or Symantec creating a piece fo code that only disables WSC and letting/allowing/or causing writers of malicous code that same ability... I doubt theyed be able to track such a thing back to a single programmer working for either company and I can imagine some large slices of change from places that want to write malicous code for such an ability...
Also wants there is a way to turn it off (without user intervention), then what stops someone from accidentally stumbling across it?
we are all invisible unless we choose otherwise
AV Companies: Learn to CODE!
This guy probably knows more about Windows' guts that anyone outside Microsoft.
- Killing the server ends the life of all client processes in all three cases.
- Since all meaningful processes in Windows are Win32 clients (the Win32 server provides more services than just the GUI), this puts the OS into a fairly useless state in the NT3x case.
- In NT4+, the kernel bugchecks, terminating all current activity.
- With X-Windows, all of the user's GUI apps die. For a workstation, this likely represents everything important.
- The server is highly privileged because it has to access the graphics hardware.
- In NT3, csrss runs with the SYSTEM token, effectively granting total control over the computer; if the Win32 server is compromised, so is the machine.
- Since win32k.sys runs in kernel mode, compromising it also grants full control over the machine.
- X-Windows normally runs as root (without resorting to slow wrappers), and so do many window managers. Compromising these also compromises the entire machine. Even if X doesn't run as root, it's likely that unfixable privilege escilations exist due to the control over the video hardware and memory mapping that the X process has.
The issues you've brought up are comparatively minor implementation choices compared to the design of the authorization and authentication systems.X can be somewhat safer with some extra work and overhead.