Slashdot Mirror
64-Bit Vista Kernel Will Be a "Black Box"
ryanskev writes with news from RSA Europe, where a Microsoft VP spoke bluntly about the lock-down that will apply to 64-bit Vista. From the article: "Microsoft will operate 64-bit versions of Windows Vista as a tabernacle, with the kernel as the holy of holies, where only its own high priests of security may venture." While Microsoft has seemed to be making some concessions to the likes of Symantec and McAfee, considerable doubt remains as to their ultimate future.
Sounds like the right approach to me. We will soon find out whether Symantec and McAfee are helping or hindering security.
Looking for an Information Security student project suggestion?
Try http://dotcrimeManifesto.com/
Microsoft executive clarifies recent market confusion about Vista Security
Am I the only one who read the line "Making concessions to Symantec and McAffee," and the first concessions that popped into my mind were "Just a little security hole here, buffer overflow there, ect."
I'm no fan of MS, especially when it comes to their horrible security track record. However, if they really can manage to get it right (or even significantly better) in Vista, they shouldn't be going and making concessions to the people who've been making a living off the things that were broken in their last OS.
The only way to run kernel code is drivers, 32 bit drivers are currently only sometimes signed. ALL 64 bit drivers must be signed, or they won't be loaded. This is why there is a distinction between 32 bit and 64 bit Vista.
The main reasons they aren't implementing the same thing in 32-bit Windows is because of "limitations of the 32-bit architecture" that apparently don't let them do what they want, and since a lot of programs already patch the syscall table in 32-bit windows, it'd break compatibility with a lot of software to change it now. Binary compatibility for drivers that patch the syscall table on 64-bit Windows isn't an issue because 64-bit Windows for AMD64 has always prevented syscall patching. They figure that the 32->64 bit change is big enough to pile on some more changes, like this.
This has more to do with system stability than it does for security. Many syscall interceptors are not multiproc safe or do bad things: if the computer bluescreens because of a poorly written syscall interceptor, Microsoft gets blamed for writing unstable software. The syscall interface is considered an internal interface, not to be tampered with by outside parties because its behavior has subtleties not documented, and could change. This is a technical enforcement of that policy.
Isn't this just another variation of security by obscurity?
Which everyone by now should have learned does *not* work.
Microsoft also warned 32-Bit users to be careful, because if you run the 32-Bit version, you're screwed
If it will stop crapware like StarForce and the Sony rootkit from sneaking extra drivers in, bring on the kibosh. People who want to tinker can use one of the fine Open Source operating system kernels that run on 64-bit Intel machines. Those that just want to play games or run Office can feel a little bit safer from malware.
Sorry Symantec, but after dealing with the disaster that is Norton Internet Security, I won't shed a tear when I read that you've filed for Chapter 7.
0 1 - just my two bits
..to release a 32-bit version of Vista?
Every week, I hear about a new thing that will "only be in 64-bit Vista". First it was HDTV content only on 64-bit for DRM reasons. Now, we're hearing the reasoning that Windows will be more secure if we don't let third parties in the kernel. Fine, whatever. If we were to assume that makes it more secure, then so be it.
But why bother to release an inferior 32-bit version? Under the presumption that closing the 64-bit kernel off will make things better, why not use the same strict security policies in 32-bit? Surely, there can't be any technical reason for all of this. It's all marketing, right? ("Microsoft recommends a 64-bit PC.")
Or is there some real reason why it feels like 32-bit Vista and 64-bit Vista are two entirely different operating systems?
Joanna Rutkowska gave a talk about this at Blackhat. Take a program in usermode but with administrative privileges, force the kernel to get paged out, edit the pagefile.
In a recent blog entry, Rutkowska criticizes Microsoft's response to the pagefile attack. Boiled down, it amounts to the problem that as long as a disk utility can run, someone can still edit the pagefile. Her preferred fixes would have been encrypting the pagefile or simply not swapping the kernel. NetBSD's Elad Efrat suggested simply hashing the kernel for integrity checking.
For 32-bit versions of Vista, it'll be mostly as you were on security
Translation: You're screwed! Upgrade to 64 bit ASAP (P.S. some of your software won't work)
Defender has already become the most popular download ever from Microsoft
If I was MS, I certainly wouldn't brag about anti-malware being the most popular application.
referring to third parties being able to patch 64 bit Vista - "It's just not the way the box was designed...we're putting a stop to that."
Great. What happens when MS doesn't quickly put out a patch... no choice on using the good samaritan patches anymore, you just have to sit and twiddle your thumbs.
referring to ever being able to secure 32 bit Windows - "That train has left the station."
I think it's more like the Windows train has left the station. Why bother to convert to 64 bit Windows? Switch to something else as soon as possible.
I think the crux of debate will be what MS considers its own high priests. If that means MS security products that compete with Symantec and McAfee, then the two vendors have a legitimate gripe that MS is using its monopoly power to lock them out. MS has said that its security products will not have access to undocumented APIs, but how much do you trust MS at their word? I don't trust them that much because I think MS still plays dirty. As recently as the Burst lawsuit in 2004, you can still see MS is refusing not only play fair but abide by court orders: Both parties were told to disclose emails as part of discovery. Burst.net discovered that not only did MS destroy emails but it was the policy of a multi-billion dollar company not to retain any emails over 30 days. And Burst listed out the many ways the company actively followed this policy.
Well, there's spam egg sausage and spam, that's not got much spam in it.
everyone got it all wrong
the os isn't a black box, the os needs a black box
you know, for when it crashes
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
The kernel has a reputation for being not particularly bad.
The reason the kernel is an issue, is that the new "threat" against Windows security is the owner/administrator of the machine. Microsoft needs to try to implement DRM, in order to get into bed with the media companies and sell music and Zunes to play it. You can't implement DRM if the user can patch the kernel to work around the DRM. Thus, they're going to try to prevent end-users from having the capacity to modify this behavior of their own computer.
The "security companies" are taking collateral damage from this, because their applications have to intercept all reads/writes (to files, the network, whatever) in order to scan all data against a blacklist of known malware in order to try to protect the comically fragile userspace. This scanning is implemented through kernel patches, I guess.
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
That's partly true*, but the reason that security through obscurity is derided is because it is typical of a mindset that has implications beyond just using obscurity as a security mechanism on top of other well-formed policies. Very often, obscurity is the only measure used, in large part because of a lack of substantive review of the other security policies that would reveal their endimic flaws. The belief is "what others don't know can't hurt us". Even worse is that "others" is often not "black hats" but "customers".
The NSA is a good example of an organization that uses security through obscurity well. They employ the best cryptographers and system designers around, but they are also not about to tell anyone how those systems work. If you did know exactly what they were doing, though, you would still find them to be some of the most secure systems anywhere.
Microsoft, on the other hand, has a history of using obscurity as a method of covering up embarassing security flaws. They do not have a history of having the best security. Do I think that Microsoft intends to hide the internals of their kernel as part of a comprehensive security regime in which obscurity is only the last layer thus making Vista an impregnable fortress, or is this an attempt by Microsoft to squelch competition from other AV vendors under the guise of fixing their tarnished security image? Well, it's obvious what I think. Which do you think it is?
* The fundamental problem with security through obscurity is that you can't count on it. Either a clever hacker will figure it out, or an insider will leak or exploit information about the system. Your system must be as secure as you know how to make it assuming that your enemy has full knowledge of the system. Only then does layering obscurity on top of that make sense as an additional mechanism. Otherwise it's a false sense of security.
The enemies of Democracy are
So, if your writing (alpha) drivers for a new piece of hardware, how do you get them into the kernel to test them? Do you have to get MS to approve your H/W as pretty enough to make it in to Vista first?
Microsoft has been attempting to deploy an architecture like this for some time. Check out Microsoft's NGSCB/Paladium/TCPA initiatives (http://en.wikipedia.org/wiki/Palladium_operating_ system). This is a paper tiger without the special hardware. In a few years a push will be made to get people to adopt the hardware. It will be interesting to see how they sell it.
Kanga: That's not a fish, that's a bird.
Pooh: Yes, but is it a starling or a mackeral?
For those of you who don't speak "Microsoft"... "Microsoft will operate 64-bit versions of Windows Vista as a tabernacle, with the kernel as the holy of holies, where only its own high priests of security may venture." roughly translates to "It will have a password."