Slashdot Mirror
Vista DRM Prevents Kernel Tampering
mjdroner writes "A ZDNet blog reports on a new DRM feature for Vista that 'protects' the kernel from tampering. The blog quotes a Microsoft document: 'Code (CI) protects Windows Vista by verifying that system binaries haven't been tampered with by malicious code and by ensuring that there are no unsigned drivers running in kernel mode on the system.' The blog says that much of the DRM in Vista is simply a port from XP, but that this feature is new to the OS."
Minifilter drivers don't have to be signed (at least in RC1 which is the last version I tried). That of course means you can get into ring 0 with a loadable driver - all that's needed is admin rights.
Modfying the kernel after that is just a matter of working out which bits (kill the code that checksums the binaries first, etc.)
"if unsigned code is allowed to load you won't be able to play protected high-definition multimedia content"
davecb5620@gmail.com
This unsigned driver "feature" is causing hell for those using the x64 version of Vista, which has abysmal driver compatibility. Nobody can now install 32-bit drivers.
Microsoft could sign patches with their private key, then include the public key in Windows to let them check that. AFAIK, they do that with the Xbox 360 and some other stuff already. The hard part will be making sure that the part that does the validation hasn't been cracked already - Apple is having problems doing that, and they even have a combined hardware/software solution.
Ewige Blumenkraft.
In the case of the xbox it was a fairly closed system with harcoded BIOS support for the DRM and custom hardware.
There are PCs with TPM chips that are at that level now but they're still fairly rare - in general a PC is still an open architecture.
The only unsigned driver I have ever seen was for an old Voodoo board.
The last time I met anyone who was using custom hardware was around 1985-6, a sound board that plugged into a C-64.
If you can't use your old hardware with Vista, then don't run Vista. New hardware shipping with Vista will be able to run it.
As a security-conscious programmer with a lot of corporate development history, I support Vista's blocking of non-signed drivers 100%. It's actually the first time I've agreed with Microsoft's plans and features since suffering the pains of Windows 3.1 development and support.
Maybe it's time for the idealists to get real about security issues. They see DRM as preventing them from experimenting; the vast majority of government, corporate, and home users either don't care or see it as a benefit that provides more protection from crackers, viruses, rootkits, etc. Even OpenSuSE has a similar enforcement option for verifying binaries, and I doubt it'll be too long before bigger commercial OS vendors do the same.
Fight a battle you have a chance to win, and stop dreaming that unsigned platforms have a future. Without someone certifying that a platform is secure, businesses are going to stop using them. Eventually client nodes that aren't certified won't be able to do much useful, either.
I object more to the use of products like Entrust web sign-in that ignores the security provisions of products like Java sandboxing, artificially blocking clients unless they are running a paid-for commercial OS from Microsoft or Apple. (Try registering with http://www.gc.ca/main_e.html for a "My Government Account" with Linux or even with Firefox under WinXP Pro.)
There is no reason for such an artificial blockage of client access, and that worries me a hell of a lot more than whether a couple dozen hackers can run custom drivers for their own hardware. Why would such a hacker go through the pain of Win32 driver development instead of Linux drivers anyhow?
I do not fail; I succeed at finding out what does not work.
So? Half the things you mention are also things viruses and trojans do for a living, and unfortunately users tend to approve any message generated by the system, "Are you sure you want to install the game you just downloaded?"
It's easy to shit on an idea, but the core components of a system need to be protected somehow, and while I hear a lot of whinning what I DON'T hear is anyone offering a better solution to the problem.
If someone really wants to build one of the things you mention then they'll pay the frieght. And Vista isn't open source.
Any sect, cult, or religion will legislate its creed into law if it acquires the political power to do so.
Funny how much better your searching goes when you know the right keywords! Not only do they talk about running recent builds on non-Apple hardware, they tell you how to do the same!
Just junk food for thought...
Hell no I'm not taking that bet! :) I'm with you on this. Microsoft would have to be retarded to do that. There's more money to be made from ensuring that everyone HAS a Microsoft OS than ensuring that everyone who has it has paid for it.
Along those lines, I wonder what would happen if Microsoft started making back versions of it's OS free? So, Windows95/98 would be free now, and Windows2000/XP would be free once Vista came out. Sure it would slow adoption to some degree... but I've never seen numbers about the number of sales that Microsoft gets for its OS straight out of retail boxes in the stores compared to pre-installs on Dell/HP, etc. If they have enough clout (which they do) to force Dell and the rest to sell new computers with Vista, they'd STILL have a huge base of Vista installs out there soon (since some people WILL pay for Vista anyway), and then everyone else using Windows could upgrade (should they choose) to 2K/XP for free. This would help them end support for older versions and it would expand their market share even more.
Aside from the fact that I'm guessing the odds of that ever happening are approximately nil, what do people think about it, conceptually?
At some time during execution of the validation process, the CPU computates a yes or no answer based on a number of bytes of input. Whether or not there is a validator for the validator is not known, but you can simply disassemble both of them, NOP out the entire validating sub-routine (or figure out which result is 'yes'), and voila. Well, it won't be this simple, the validation will probably be deliberately complicated, but the result os always the same, "no, not valid", or "yes, run it in kernel mode".
Disassembling binaries isn't the nicest thing to do. I've done it once or twice to bypass software registration, it took me a long while (days). There are professionals out there, though, that do this sort of stuff as a hobby. For them, it may not be so difficult.
What about the module that performs the verifcations (probably just a hash comparison, like Tripwire on *nix)? Suppose somebody conveniently inserts a JMP instruction to the location of the code following a successful verification, allowing the comparison binary to otherwise behave as if the check had succeeded (probably either terminating at that point or trying to perform another verification if a binary hash exists)?
(I personally don't grok x86 ASM well enough to do this. But some people do.)
As with privacy, the question is "who watches the watchers?"
Is Capitalism Good for the Poor?