Microsoft Announces Device Guard For Windows 10

jones_supa writes: Microsoft has announced a new feature for Windows 10 called Device Guard, which aims to give administrators full control over what software can or cannot be installed on a device. "It provides better security against malware and zero days for Windows 10 by blocking anything other than trusted apps—which are apps that are signed by specific software vendors, the Windows Store, or even your own organization. ... To help protect users from malware, when an app is executed, Windows makes a determination on whether that app is trustworthy, and notifies the user if it is not. Device Guard can use hardware technology and virtualization to isolate that decision making function from the rest of the Windows operating system, which helps provide protection from attackers or malware that have managed to gain full system privilege." It's intended to be used in conjunction with traditional anti-virus, not as a replacement.

Comments

Whitelisting executables...

[ZorinLynx]

This actually sounds like a great idea. Whitelist all the executables on your system. Then, if something tries to execute that's not whitelisted, throw up a dialog explaining what's going on. This would catch sneaky attempts to execute trojans in a lot of cases.

One downside is it probably wouldn't work with interpreted languages, and those can be fairly powerful. But it's a start.

Re:Whitelisting executables...

[Anne Thwacks]

It also wont block Malware from "Trusted Malware suppliers".

I think it is safe to presume the signing process will be hacked in a matter of hours.

Re:Whitelisting executables...

[oh_my_080980980]

Yo douche bag: "To help protect users from malware, when an app is executed, Windows makes a determination on whether that app is trustworthy, and notifies the user if it is not. "

So it makes a check against a list of some sort. How hard would it be to get some malicious software signed. More importantly what about devices that are from a trusted source but are not signed. Can an admin out such devices on a white list or does Microsoft control a master list.

FTA: "This gives it a significant advantage over traditional anti-virus and app control technologies like AppLocker, Bit9, and others which are subject to tampering by an administrator or malware"

So it sounds like the admin is taken out of the loop. Need more details, which are lacking in the article. But I would not trust Microsoft to make those decisions for me.

Re:Whitelisting executables...

[Anonymous Coward]

So it sounds like the admin is taken out of the loop.

Quite the opposite really. FTA (emphasis mine): "It provides better security against malware and zero days for Windows 10 by blocking anything other than trusted apps—which are apps that are signed by specific software vendors, the Windows Store, or even your own organization."

Re:Whitelisting executables...

[Greyfox]

"Trusted Malware Suppliers"

You mean, like SONY?

Re:Whitelisting executables...

[Anonymous Coward]

How hard would it be to get some malicious software signed.

It's still a extra step for the attacker to get the software signed. Remember that just finding a way to get the executable to run in first place in the victim's machine is a big headache.

Re:Whitelisting executables...

[Anonymous Coward]

If it were so easy to sneak your trojan code in, then how come I have never heard of a malicious Windows update infecting every single Windows workstation in the planet in one fell swoop?

Re:Whitelisting executables...

[Minwee]

"It provides better security against malware and zero days for Windows 10 by blocking anything other than trusted apps—which are apps that are signed by specific software vendors, the Windows Store, or Lenovo ."

There. Fixed that for you.

Re:Whitelisting executables...

[Dutch Gun]

I think it is safe to presume the signing process will be hacked in a matter of hours.

Code signing uses the same cryptographic technology as SSL-TLS, and is used by many operating systems already (the notable exception being Linux). The only real way for this system to be subverted is the same as for the web - for a trusted certificate authority to either lose or misuse their private keys, which would allow a certificate to be spoofed.

So, no, the signing system isn't going to be hacked. Code signing isn't a new feature. It's already been a part of Windows for many years. This is just an additional enterprise feature that happens to use it.

Re:Whitelisting executables...

[PsychoSlashDot]

This actually sounds like a great idea. Whitelist all the executables on your system.

If this were done well, it could be useful (if occasionally annoying).

That said, I suspect the definition of "executables" is what's going to cause the biggest headache. Sure, an EXE file is an executable. Sure, so is an SCR. But these days there's so much interpreted code that it's not clear what is a .NET app or Java app and what isn't. How about Flash content? It's sort of executable in that a runtime will process it and DO something. But wait, there's more. PDFs have macros, as do most document types, which are sort of executable too.

It'd be nice to fix this all so nothing ever runs without your explicit permission.

Re:Whitelisting executables...

[sexconker]

You've been able to do exactly this for ages via group policy.
I believe there's even a mechanism to whitelist via certificate (so you don't have to whitelist each time there's an update), though I've never used it.

I'm not sure what's "new" about this feature. Perhaps moving this piece to a separate virtualized ring and relying on hardware virtualization features?

Re:Whitelisting executables...

[sexconker]

Code signing uses the same cryptographic technology as SSL-TLS, and is used by many operating systems already (the notable exception being Linux). The only real way for this system to be subverted is the same as for the web - for a trusted certificate authority to either lose or misuse their private keys, which would allow a certificate to be spoofed.

So, no, the signing system isn't going to be hacked. Code signing isn't a new feature. It's already been a part of Windows for many years. This is just an additional enterprise feature that happens to use it.

What's the best way to wash sand out of your hair?
Where'd you get those wraparound granny sunglasses?
Do you prefer Icy Hot or Bengay for severe stiffness and cramps?
Etc.

Maybe you had your head in the sand, were stuck in a cave, or were living under a rock for the past eon, so I'll just point out that the "trusted" certificate "authorities" have repeatedly proven themselves to be untrustworthy and unauthoritative.

Re:Whitelisting executables...

[goarilla]

Couldn't you already create this "executable whitelist" if you setup software restriction policies ? (https://technet.microsoft.com/en-us/library/hh994620.aspx)

Re:Whitelisting executables...

[Dutch Gun]

I'll just point out that the "trusted" certificate "authorities" have repeatedly proven themselves to be untrustworthy and unauthoritative.

No shit, which is why I mentioned that this could be circumvented if the private keys are compromised. Compromised certificate authorities are definitely the Achilles heel of the system, and my concern is that we trust far too many of them at this point, and there's little to prevent one root from impersonating another.

Even so, code-signing still generally does it's job reasonably well, as most hackers don't have the resources or skills to acquire private root certificate keys. No system is completely foolproof of course. However, when breaches occur, it's not the encryption itself that breaks, which means that things can be made secure again with new certificates. Annoying, yes, but probably not catastrophic, except to the reputation of the certificate authority with lost control of their keys.

That's a long way away from the "signing process will be hacked in a few hours," and you damn well know it.

Re:Whitelisting executables...

[ron_ivi]

Not just Sony.

McAfee, Norton, Oracle (that damn Ask toolbar), HP Support Assistant, Razer mice, Skype.

Heck, it seems most Windows software has a "malware" buisness model these days.

Re:Whitelisting executables...

[Anonymous Coward]

It's a good thing that all malware comes from apps and/or stand-alone executables and never in the form of infected web pages, documents and plugins for existing applications.

Re:Whitelisting executables...

[Anonymous Coward]

Exactly! Except that code signing certs have been compromised since they were invented, and haven't been fixed to not be crackable, and there is no reason to assume this is any different.

So Microsoft is still papering over failures.

[Anonymous Coward]

This does almost nothing. Just more window dressing.

Most applications DO come from "trusted vendords" (such as Microsoft itself). Yet the virus attacks continue, and the security failures continue.

Re:So Microsoft is still papering over failures.

[TraumaFox]

Unless I'm misunderstanding this, it's what your IT department trusts by applying its own signature; Microsoft is providing its own list of "trusted" sources, but your organization would still have to whitelist them along with whatever else it wants. This should hypothetically give administrators an easy way to grant limited software installation privileges to users, making it easier to allow/disallow certain software by request. While it doesn't address deeper problems like signature spoofing, it should reduce the number of virus and malware-related tickets you'd otherwise see by giving users any degree of administrative autonomy as well as the number of software installation requests you'd have to deal with by completely restricting them. Any issues that do arise should be easier to route because of the narrowed list of potential sources, and being able to revoke that trust on the fly acts like a sort of panic button to prevent further propagation. Ultimately, users will feel like they win while IT has fewer headaches to deal with, at least in theory.

Re:So Microsoft is still papering over failures.

[Anonymous Coward]

This does almost nothing. Just more window dressing.

I know you are not try to be funny... But that there is a pretty good joke if you ask me... Window dressing... That's pretty much what Microsoft does these days.. Well that and putting lipstick on a pig...

Re:So Microsoft is still papering over failures.

[Anonymous Coward]

... Just more window dressing ...

You mean, WINDOWS dressing? (LOL)

Re:So Microsoft is still papering over failures.

[Jawnn]

This does almost nothing. Just more window dressing.

Most applications DO come from "trusted vendords" (such as Microsoft itself). Yet the virus attacks continue, and the security failures continue.

You don't understand. This isn't an "antivirus" solution. It works in completely different manner, one designed specifically to be effective even in the presence of porous and buggy operating systems like Windows. That approach is already being used, effectively.

Re:FTFY

[BradleyUffner]

"which are apps that are signed by specific software vendors, the Windows Store, or even your own organization"

There goes most of Shadow IT

[allquixotic]

When Corporate America IT organizations start deploying this with Windows 10 rollouts in, oh, 2020 or so, a whole slew of things that are necessary to keep companies operational are just going to stop working.

IT "administrators" will be unable to resist the temptation to enable this "feature", surmising that any user running an .exe that wasn't signed by a shortlist of vendors must be doing something illegal.

So that business process automation workflow that saves thousands of hours every year? It depends on, say, Ruby, or 7-zip .exes. Poof; gone.

How about that little Office add-in that the CFO really likes because he can rubber stamp all the incoming requests in one batch? Well, it'll probably block .dlls too, so that's gone.

That customer deliverable that people have been pulling 16 hour shifts to get done, which is due tomorrow? It depends on a complicated .NET app written in C# using heavy Excel automation. Now they have to rewrite it in VBA, or maybe your deliverable just won't get delivered.

This is bad, bad news for the skunkworks that keep the world spinning. Better start rewriting everything in Java (make sure it's compatible with the ancient version of Java that comes preinstalled on every system) and calling into native land via JNA. Uhh, provided that Windows will let you dynamically load the JNA .dll into the Java process, that is...

Actually, that probably won't work because of the aforementioned JNA .dll. Let's just rewrite everything in VBA forever and ship our "applications" as Word documents. Who needs proper threading or actually good performance, anyway?

Re:There goes most of Shadow IT

[Anonymous Coward]

As an IT "Administrator", all I can say is that you appear to be just like the worst-of-the-worst "users" that I have to deal with. Unable to comprehend how someone might know how to their job outside of your glorious intellect and ingenious insight.

Re:There goes most of Shadow IT

[Anonymous Coward]

In Corporate America IT: You build a an image with complete OS and App stack, test, verify, and deploy to workstations. If that's too much trouble, then just roll out a Terminal Server with thin-clients. The idea is to either mitigate risks, reduce redundancy in the process, or a combination of all the above.

IT is a cost center; it's an occupation not loved, but deemed a "necessary evil".

Snarky slogan time: Get over IT!!!

Re:There goes most of Shadow IT

[silanea]

The silver lining, of course, will be a sudden drop in "My computer mysteriously broke down, and of course it wasn't me (or any of the gazillion applications I managed to sneak past the firewall onto my harddisk)." type calls to IT helpdesks all over the world. Yes, there are overreaching admins and locked-down-to-death platforms, but the damage done by insecure, outdated or plain crappy software run without official sanction in offices every day is not exactly peanuts, either. And there are few things as crippling to a company than 'inheriting' such a - usually undocumented and fragile - shadow infrastructure once the people responsible leave.

Sensible companies develop sensible IT policies and provide procedures to get required software included into the platform in a stable and supported way. Yeah, I know. They are few and far between. But they exist, and they do hold a significant advantage over their competitors. And the more such measures as the one announced in TFA are being recognised as state of the art and prescribed as such by certifications and standards, the more financial incentive there will be to be sensible. It took until the mid-Eighties for seat belts to be mandated by law. Give IT time. (Ha ha.)

Re:There goes most of Shadow IT

[bev_tech_rob]

In Corporate America IT: You build a an image with complete OS and App stack, test, verify, and deploy to workstations. If that's too much trouble, then just roll out a Terminal Server with thin-clients. The idea is to either mitigate risks, reduce redundancy in the process, or a combination of all the above.

IT is a cost center; it's an occupation not loved, but deemed a "necessary evil".

Snarky slogan time: Get over IT!!!

Thin clients and Citrix. Problem solved. That is how we do it here.

Re:There goes most of Shadow IT

[allquixotic]

If some of the IT departments I've had to tangle with in the past were doing their jobs correctly, anyone doing software development -- whether an "official" part of the IT department or not -- would be able to easily obtain local admin rights on their workstation.

If they were doing their jobs correctly, it wouldn't take 2-3 years to develop, test and deploy a simple productivity enhancement or workflow automation solution that might take 40-80 hours to actually code, and maybe another 100 hours to design, test and document. Not to mention, anyone who's actually gone through the whole 2-3 year lifecycle often ends up paying way more than they wanted to, for a way over-engineered solution that tries to solve every problem anyone's ever had, instead of just solving the problem at hand.

Also, IT departments never have any free bandwidth for new requests, which is why it takes at least a year for them to even start looking at a problem someone comes to them with. This is not entirely their fault: the CFO will often demand the IT director to keep all of their staff 100% utilized on required projects, so if the IT director tried to keep some staff semi-available for new requests that come in, the CFO would just reduce their head count until they had just enough people to work the projects that are already in development.

I'm not saying *all* IT Administrators do their jobs poorly or take too long to get things done. I'm saying that the processes and bureaucracy in place -- which, let's face it, most of the IT folks hate just as much as their "customers" -- make the IT organization very inefficient for handling anything that needs a quick turnaround. They are good for managing general use computer rollout with bog standard Office software and Internet access. Beyond that, if a manager or director wants something different, and they want it done *this* year, they are probably going to have to hire their own software folks, interns, or tap internal talent of people who happen to know software development (whether or not it's in their job description). At that point, they've just created a Shadow IT organization.

My point is that Shadow IT isn't a bad thing if the people working it know what they're doing, and can avoid pitfalls like downloading malware, pirating commercial software, etc. One good way to go about it is to develop your solution in an open source environment (e.g. Java, a GCC language, Ruby, etc.) and to only pull in third-party libraries that are MIT-licensed. It's very, very hard to run afoul of the three-clause BSD license or MIT license; you just create a LICENSE.txt that fulfills the attribution obligations, and off you go.

This "Device Guard" feature, as I understand it, will actively block non-administrators from being able to compile and run their own executable code, or to install third-party software or runtimes that might enable the same. They then have one of two options: either talk to IT, or try to get around it by using runtimes that already exist on the computer.

If they try to talk to IT, chances are good that IT will ask that the entire shadow IT project be canceled, and that they be allowed to develop (or buy, COTS) the solution themselves. Once you're in that trap, you automatically know it's going to take 2 years at a minimum. The project you're working on may not even be relevant that far down the road. If you don't agree to letting them work it into their pipeline, then they likely won't agree to give you admin rights. These talks very rarely go over well, unless you're in a very progressive company; but if you were, you'd probably have admin rights in the first place, or at least a separate computer or VM with a sandboxed subnet without access to any sensitive stuff on the LAN, where you have full admin rights.

This is why shadow IT organizations often just choose to write their stuff in VBA or VBScript. Java is usually a viable option too, but if you need native libraries or any third-party components that need native libraries, you're probably o

Re:There goes most of Shadow IT

[rjstanford]

That customer deliverable that people have been pulling 16 hour shifts to get done, which is due tomorrow? It depends on a complicated .NET app written in C# using heavy Excel automation. Now they have to rewrite it in VBA, or maybe your deliverable just won't get delivered.

Or if it comes to that then, as a developer, you can just sign the app, you know. The fact that other OSs have had these features for years with none of these issues just makes your complaints look even more ridiculous.

Re:There goes most of Shadow IT

[allquixotic]

You are assuming that the standard image deployed to every employee contains all of the desired software solutions, and that no one could ever conceive of or imagine a world where a new piece of software might exist that could make their work more productive.

That's an assumption that I've found to be false in 4 out of the 4 jobs I've ever worked, over a career of 12+ years.

Re:There goes most of Shadow IT

[david_thornley]

One thing I noticed a LONG time ago is that "shadow IT" (back then it was "shadow DP") is not good at the fundamentals. Don't expect things to be backed up, or in source control, or to be robust on the latest version of Windows.

Good idea but not bulletproof

[davidwr]

This is a good idea but it will be broken (and fixed), repeatedly.

However, it will make malware writers work harder/spend more money and reduce their reach, which should knock many bad actors out of the game.

Unlike Apple, this will be something most users will have to turn on manually or at least be something they can turn off if the manufacturer has it turned on "out of the box".

I'm more worried about Windows 10+1 - by that time people may be so used to the "safety" of walled-garden "app stores" that a computer you actually own (that is, control) will be a niche market.

Steam and Steam games as well + user mods

[Anonymous Coward]

Steam and Steam games as well + user mods + user maps + and more.

Also opens the door to all apps must come from MS with them taking $99 a year (even for free apps) + 20%-30% cut of sales.

Later say good buy to hardware that did not pay MS a free to get there drivers trusted and MS wants to be evil keyboards and mouses as well.

Re:FTFY

[Anonymous Coward]

No, but that's not a surprising thing to see someone post at this conspiracy nutjob site.

Administrators control

[PPH]

Everyone is a Windows Administrator. So how well will this really work?

Most non IT people will just see the popup saying "Blah, blah blah blah. Blah blah, blah, unsigned blah blah." And click the button that says, "Make the nasty popup go away and run the neat app I just downloaded."

Re:Administrators control

[Anonymous Coward]

Look to OSX on how it's properly done. You can be a system administrator on your Mac, but can restrict -by default- apps not signed.

In OSX --> System Preferences --> Security & Privacy

Allow apps to be downloaded from:

-Mac App Store
-Mac App Store and identified developers
-Anywhere

Re:Administrators control

[Trepidity]

Not always in corporate settings, which is probably what this is aimed at. It's admittedly super-annoying to have to use a machine where you don't have administrator access, but it happens.

Re:Administrators control

[Anonymous Coward]

This will probably be a strict policy like classic Active Directory policies. So the user can't just skip it with a simple dialog box.

Re:Administrators control

[allquixotic]

This is true for home users, but anyone connected to an enterprise domain who doesn't work for the help desk probably knows the pain of not having an administrator account. Even people who fall under the auspices of "IT" often don't have administrator accounts, if they aren't part of the team that holds the keys to the castle.

I know many software engineers who don't have admin rights on their PCs. It'll be interesting to see the tug of war over this, between paranoid IT guys and the rest of the people who are just trying to get their work done, whether by installing third-party software, or by compiling executable code themselves.

Re:Administrators control

[Anonymous Coward]

And the guy who makes the GPOs is going to say "Haha suck it."

Re:Administrators control

[Ravaldy]

OSX is great and all but it hasn't catered to large corporations and enterprises. It's the one segment Apple either doesn't care about or doesn't know how to penetrate. Maybe they understand how generic doesn't work in complex business environment.

Don't take me wrong, the concept is good but what Windows 10 is doing here caters to the corporate/enterprise environment better.

Re:Administrators control

[Ravaldy]

The idea is that there are different levels of control: "All good, Warning, Deny".

Application control already exists through group policies. What this does is make it easier for the administrators to manage but it also brings another level of flexibly which is virtualization. Windows 10 comes with built-in virtualization which will allow isolation of the instance being run. This will further protect the system. I believe some antivirus are already doing this but obviously MS is trying to make the OS provide this functionality built-in. After all, MS best understands their own OS and the API that runs on it.

Re:Administrators control

[pr0fessor]

If you set up the permissions in your organization correctly that doesn't happen, however on home pc yes very much so.

I'm considering making my next pc Ubuntu LTS with KDE. I built one for my brother... he saw the price tag on win7 and said let try Ubuntu, I can always buy windows later if I don't like it. It's been about three months and him and his wife love it.

Re:Administrators control

[blazer1024]

In recent versions OSX even goes a step beyond "are you sure you want to run this app?" into "you cannot run this app unless you go into security settings, enter your admin password and then authorize the app to execute"

Re:Administrators control

[SimplyGeek]

As a developer, it's always fun when I have to submit a ticket to get a simple Visual Studio plugin installed, wait a month, get signoffs from my manager, IT, the desktop testing lab, and finally get it installed by someone in India that doesn't know how to install it. He then proceeds to close the ticket even though it's not configured right and I can't configure it without admin rights. We need a better system.

Re:Administrators control

[ColdWetDog]

Yep, the point and click version of SUDO.

Re:Administrators control

[Bing Tsher E]

Apple doesn't know how to penetrate.

But also, they don't care. They are satisfied with their only corporate customers wearing tasseled wingtips.

Re:Administrators control

[PPH]

This is true for home users,

And the BYOD crowd. And the telecommuters, who's systems could be configured who knows how when they aren't connected to the company VPN. Or the CEO who can't figure out why he can't take his company laptop to Starbucks and download whatever the hell he wants.

Re:Administrators control

[Anonymous Coward]

Wha? Nuget downloads things into the solution folder heirarchy, it doesn't need "installation" on your computer in terms of "C:\Program Files\blah blah" to do this.

Re:Administrators control

[Anonymous Coward]

Or, the first time you run a downloaded .app, you could just right click on it and hold down the Option key while clicking Open.

What's new?

[ReluctantRefactorer]

Doesn't Windows have this already? If the installer isn't signed with a "trusted" certificate, you get a scary warning message. Or is the "hardware technology and virtualization" the new bit?

As long as the user has the option to override the warning and install anyway, you'll still get malware being installed.

This feature however seems more aimed at IT departments so they can lock down their users' machines to only run their definition of trusted software. How will it apply to standone or home users?

Re:What's new?

[hyperar]

You seem to forget that the OS just allows the user interact with the machine. If the user dismisses every warning and proceeds with the install, then he deserves it.

This is not new, is it?

[Anonymous Coward]

This announcement sounds vaguely familiar. Did they just rename UAC?

Wouldn't surprise me. First time I heard of UAC I thought it was the company that blew up the world in the DOOM games.

Re:FTFY

[Anonymous Coward]

This is an optional feature, mainly targeted for enterprise use. The system administrator chooses what to whitelist. Also, any app can be self-signed.

Quite nice feature if you want to prevent random executables from conquering the computer. Of course this does not protect from vulnerabilities contained inside any of the trusted apps.

Re:FTFY

[worf_mo]

With OS X, you (as an administrator) can decide whether you want to allow apps downloaded from 1) Mac App Store, 2) Mac App Store and identified developers, 3) Anywhere. I don't use Windows but I could imagine MS taking a similar approach.

Re:FTFY

[gtall]

Do you trust MS? Do you feel lucky, punk?

Won't guard against signed malware

[Anonymous Coward]

Remember that Stuxnet used drivers signed with "stolen" Realtek and JMicron certificates. Lots of malware is signed with fake, stolen, or weak certs. Hell, some manufacturers like Lenovo even included malware like Superfish on new laptops. Will Deviceguard prevent that from happening?

Re:Won't guard against signed malware

[Anonymous Coward]

No, it will add a layer of security to what organisations already have, and like any other security measure this one too should not be trusted blindly, like so often is the case when people say my PC have never been infected because my AV say so. No! what your AV say is that your machine have not been infected with malware that it can detect. A fine but important difference in the real world, and it is here that device guard can add to existing security in an organisation. I spend most of my working day cursing over everything Microsoft, but in this case I honestly have to admit that for once they may actually be onto something.

Re:Won't guard against signed malware

[Anonymous Coward]

You know what you get when add layers to something? You get a layer cake.

Re:Won't guard against signed malware

[arglebargle_xiv]

Hell, some manufacturers like Lenovo even included malware like Superfish on new laptops. Will Deviceguard prevent that from happening?

Nope. Quoting from TFA

The following OEMs are endorsing the use of Device Guard on their Windows 8 certified devices [...] Lenovo.

So you still get SuperPhished, only now it's DeviceGuarded.

AppLocker

[Anonymous Coward]

We have this already but it's Windows Enterprise which needed Software-Assurance...

Re:privacy :{

[Anonymous Coward]

No imbecile, it's talking about checking the code signing certificate.
If you've trusted the particular vendor or cert chain, then the app is allowed to be installed, if you don't trust the cert, it warns or blocks installation or execution.

Not sure this helps...

[xxxJonBoyxxx]

Unless Microsoft's changed something, you can still change the code in (non-device driver) SIGNED executables. (Try it today by flipping a few junk bits in a signed app and see if Microsoft notices the difference.) If that remains true, this isn't much of a deterrent to malware at all.

Furthermore, some of the biggest recent hacks (e.g., Sony) used a SIGNED commercial device driver (running in trial mode) to circumvent NTFS permissions; a default scheme that allows only signed executables wouldn't stop that down either.

Re:Not sure this helps...

[Ravaldy]

I think anybody with enough of a system background knows you can fool a certificate system locally but how does the external malware know what certificates your organization allow? As for apps from the app store, you cannot fool it into providing a different certificate than it's authentic one.

Considering most apps will eventually be app store downloads/purchases, I suspect their strategy is pretty sound.

Re:Not sure this helps...

[xxxJonBoyxxx]

>> how does the external malware know what certificates your organization allow

The same way hackers with malicious HTTPS sites do today. They look at the ungodly-long list of default Microsoft CA certs, find a "broken" CA in that list that can be corrupted or whose issuer doesn't really care, and get a signed certificate that looks legit to 99.9% of all corporate users today.

(So far the signing system for Microsoft has also used the Microsoft Certificate Store; the certificates used to allow signed executables just have a different role.)

Re:Not sure this helps...

[Ravaldy]

The point is that it makes it a lot harder for malware to target masses. The malware creator needs to fake the right certificate and hope the users make the mistake of running their malware AND it most not be known to AV. That's increased the difficulty significantly.

Re:FTFY

[cinky]

It's for organizations... You know, so you don't install stupid shit on your company laptop. It's not "microsoft says what you can install"... But you would actually have to read the article before commenting...

Corporate IT salvation

[edtice1559]

Most of the posts on here are of the variety that this is taking away a fundamental human right or that everybody is an administrator so it's a meaningless feature. In the corporate IT world, this is hugely valuable. Most non-programmers *don't* have administrator privileges. But, even if they do, you don't want to allow untrusted binaries. Windows has local administrators and domain administrators. Nobody is a domain administrator. Even local admin privileges won't let you override a group policy. This really is as near perfect solution as you can get. As far as interpreted languages... uh, non-programmers don't need to have interpreters on their machines. Some "interpreted" languages (like the .Net CLR) will honor this and not interpret things that aren't properly signed. So I see this as a big win. Although it's hugely helpful for the large organizations who spend billions of dollars on IT, I do agree that it's a bit of an inconvenience for people who live in their parent's basement and run pirated copies of Windows while claiming to live and die by Linux.

Re:Corporate IT salvation

[Anonymous Coward]

Really funny thing is that Windows has had this very functionality in the form of Software Policies since Windows 2000 (and it's still there in Windows 8.1). And the Slashdot users insisted then that this was the beginning of the end allowing Microsoft to force everyone to only run Microsoft software.

Re:Corporate IT salvation

[Ravaldy]

I do agree that it's a bit of an inconvenience for people who live in their parent's basement and run pirated copies of Windows while claiming to live and die by Linux

Lol!! That was me 10 years ago.

Re:Corporate IT salvation

[Nemyst]

I think the only potential weaknesses would be Java, Flash and browsers which now run a bunch of apps of their own. Java still only ever shows up as a single executable and is easily the biggest security risk in that context. Mind you, you might be able to get away with not having Java installed in a corporate environment, depending on your in-house platform of choice.

Re:Corporate IT salvation

[Anonymous Coward]

That was a lot of us. Luckily, most of us grow out of that phase and find better things to get worked up about instead of something as trivial and stupid as people's choice operating systems. :)

Re:Corporate IT salvation

[allquixotic]

First, let me say that I totally agree that "regular" users -- those who are not programmers or testers or system administrators -- do not typically need administrative rights, nor do they, in the ideal case, need the ability to run unauthorized third-party programs.

HOWEVER, my concern is that there will be many inappropriate and heavy-handed uses of this technology called "Device Guard" by IT departments that are not effectively satisfying the needs of their users.

Firstly, every IT department would, in an ideal world, be willing to get over themselves and accept the fact that software development can, and should, happen in departments other than the official IT department. The larger and more diverse your organization is, the truer this statement is. An employee shouldn't have to be within the reporting chain of the CIO or IT Director in order to be able to develop software as part of their official responsibilities. And yes, if an employee's management chain officially assigns them software development duties, and these responsibilities are accepted as legitimate by a corporate officer who isn't in IT, then this software development *is* official, even if IT isn't aware of it.

The next thing is, IT organizations need to assign appropriate permissions and trust (e.g. local admin rights) to these external development organizations. Trust them to do their job correctly, and only crack down if there is an actual violation. If you're worried about compliance, give them your security policies and make them provide a compliance report before deploying the software. Come up with some *minimally-invasive* hoops they'd have to jump through to get approval to deploy their finished software. *Don't* try to take ownership of their product lifecycle.

In an IT shop meeting these simple minimal criteria, I think this Device Guard feature would be mostly harmless. Jane the Executive Assistant tries to run an .exe screensaver with cat pictures and is blocked; too bad. Tom the software developer who doesn't work for IT submits a ticket and gets local admin rights within 48 hours so he can get his job done. Before deployment, he gets IT to roll out a patch to all their workstations whitelisting his codesigning cert, which was purchased on his (non-IT) department's dime. Everybody is happy (except Jane, but she'll live).

My concern is that there are hundreds of IT shops out there in the wild which do NOT have the political or social intelligence to enact policies like these, and would rather bury their heads in the sand and pretend there's not a problem. They are so averse to risk and change that they would rather see their company stagnate due to the unavailability of necessary tools and technologies, instead of working through the growing pains of becoming an organization that can accommodate the realities of the fast-paced 21st century business culture, such as the necessity of software development done locally to the people who will be using the software (advantages: reduced cost, shorter lifecycle, more relevant and accessible to the end-users, faster response to change requests, etc.)

These same shops without the above will be all too happy to turn on Device Guard for its security benefits, without making the required accommodations for the many existing Shadow IT organizations in their company, half of whom are afraid of IT's potential overreaction to their project and have thus never come forward and told IT what they're doing.

Mark my words: the day that IT departments roll out Windows 10 and turn on Device Guard, the shit is going to hit the fan. You'd better have already worked out the proper preparations with *all* the software developers in your user base -- not just the IT department -- to support their production software, or random pieces of your mission-critical software are just going to stop working one day, and an angry CxO is going to want to know why IT broke their systems.

Re:Corporate IT salvation

[allquixotic]

And for heaven's sake, if you're an IT administrator and reading this, please, please, PLEASE stop forcing users to run IE 6/7/8 and nothing else. At a bare minimum, install and support Firefox ESR. It is not in your job description to take pleasure in your users' suffering. ;)

Re:Corporate IT salvation

[UnderCoverPenguin]

One client I worked for, software developers were issued 2 PCs. One for email, Word and Excel documents, and other office stuff. The other for SW development. There was also a separate LAN for the SW dev PCs. The only support IT provided for the SW dev PCs was (1) an install DVD so we could re-install Windows and (2) hardware repairs (for example, replace a failed hard drive). Otherwise, IT treated us like an outside vendor.

Re:Corporate IT salvation

[Coffeesloth]

An interesting point, yet all web browsers use an interpreted language and would be trusted applications, I'm not sure how this would protect them. For an enterprise solution this does seem like the perfect thing. Of course if I can create a signed certificate for my software then I would presume the "bad guys" can do the same so we may be back a square one yet thinking we are safe and secure.

I would categorize this as "Build a bigger mouse trap and they will make smarter mice"

Re:Corporate IT salvation

[allquixotic]

No -- modern web browsers (IE 8+, Firefox since a long time, and Chrome since its initial public release) are sandboxed off from the native platform to such an extent that you cannot access the native code environment or the local filesystem from JavaScript. Even if you tell the browser that you trust the site, a modern browser is not going to allow you to access the filesystem or call Windows APIs from JS.

You can do a lot of useful things with JavaScript and HTML in a browser like Chrome, but there are still a great many tasks that are desirable and important which can't be done in this environment. For example, automating a workflow in Microsoft Office.

Re:Corporate IT salvation

[bruce_the_loon]

Java already has this in place. Can be difficult getting unsigned code running on Java 8 in default configuration.

Re:Corporate IT salvation

[Anonymous Coward]

You're failing to grasp the fundamentals here Ed.

In the future, there will be apps based on a Linux or proprietary platform with a UI that interacts via a remoteapp-like interface. These will run in a Linux container or similar virtual machine as an appliance technology.

And then, there will be windows store.

Why?

Because windows store is more efficient for most corporate customers, you have fewer maintenance and deployment costs. Also, software vendors will like the anti-piracy options for the small cost. Most of those apps will be subscription based. Eventually it will become mandatory, like allowing windows to phone home for activation. Try cloning a stack of windows servers into a completely isolated VMware workstation environment; they stop working after 90 days. If you want to run off the net you need a KMS server and that manually phones home.

The real nightmare you are not seeing are patents, granted for decades on basic technology that will enable those subscription vendors to acquire a very tight grasp over their respective markets and technologies. Even if the little guy comes up with something completely off the wall and fresh, they will be used to bludgeon them by "what if's". "This vague patent looks like what you're doing".

Microsoft is moving in this direction because corporate customers are demanding security, and an open platform cannot, fundamentally, provide good security without a lot of overhead, unless you streamline every step of the process.

Re:Corporate IT salvation

[tepples]

non-programmers don't need to have interpreters on their machines. Some "interpreted" languages (like the .Net CLR) will honor this and not interpret things that aren't properly signed.

Do Python, cscript, and PowerShell do this yet?

Re:Corporate IT salvation

[Anonymous Coward]

Unless something has changed recently a local admin can very much override a group policy.
You used to be able to do this by locking whatever registry key(s) the policy was trying to set.

Re:Corporate IT salvation

[Anonymous Coward]

And for heaven's sake, if you're an IT administrator and reading this, please, please, PLEASE stop forcing users to run IE 6/7/8 and nothing else. At a bare minimum, install and support Firefox ESR. It is not in your job description to take pleasure in your users' suffering. ;)

Keep in mind, most IT departments don't want to run that crap either. Unfortunately, business solutions are chosen that ONLY run on ONE specific version of IE. Heck many also only run on ONE specific version of Java. I'm not saying Java 6 VS Java 7, I'm saying Java 6_27 VS Java 6_28. One minor version upgrade is enough to break some of these brain dead applications and they run on an insecure version. But you need them. You have to have them. The vendor who made them isn't offering upgrades (or worse, it's made in house and the person who made it is gone or is doing three people's jobs and just doesn't have time, or can't get permission to spend time, on an app that's already "working").

Welcome to the world of IT. This is but a small slice.

This is how Microsoft grew before

[david.emery]

If you look at Windows NT and beyond, it was all about removing capabilities from untrusted users, and placing them in the hands of IT staff/CIOs. That was a huge success for Microsoft, CIOs -control the budget- and decide what gets purchased. So they stuck with what empowered them, regardless of whether this was good for the user community, and whether the Microsoft monoculture created more problems -and more costs- than it solved. (After all, the measure of 'power' in many organizations is the size of the budget and staff, growing the CIO budget and hiring more IT workers equated to more CIO power.

So now, with the growth of non-PCs (phones, tablets, even IoT) in companies, Microsoft once again plays to (you could say 'panders to') the CIO and ability to control the device.

This could be quite a battle, with Apple/IBM (and presumably Google/Android soon) providing business services to the user community, versus Microsoft providing control (and familiarity) to the CIO community.

Re:This is how Microsoft grew before

[Nemyst]

You're severely misrepresenting things here: the notion of putting IT staff in control and removing privileges from users is a fundamental part of how corporate IT is supposed to work. Linux does the exact same thing in that context. You are using and working your employer's hardware: they, not you, get to decide how it's run and what happens on it. You're free to ask them about something, but you don't get to install your own shit because you wanted to. A dumb user installing a cat screensaver trojan doesn't risk losing their family photos, they risk exposing their entire company to a leak or a hack or whatever else.

You can directly trace the slow uptake of many consumer platforms in the corporate sector to how little support they have for central management.

Re:This is how Microsoft grew before

[david.emery]

I documented the change of control, and noted Microsoft profited from enabling that change. If that's characterized as "misrepresenting" things, so be it.

When Corporate IT provides all employees with a charge number, from the CIO's budget, to use when the IT keeps the employee from being productive, then maybe I'll have more sympathy for corporate IT. How many times, for example, has your computer been forced to reboot in the middle of the day because IT decided to roll out some change? How many times have you had to go to the HelpDesk because something that worked before, suddenly stopped working? How many policies have been instituted that are a direct response to problems that are unique to Microsoft Windows? The real problem is not the transfer of control to IT, but rather the lack of accountability on IT departments for how their policies and actions negatively impact the larger community.

One advantage I've had as a Mac user in Windows-centric organizations is that IT didn't know how to mess with my computer, keeping me much more productive. Best example was Y2K remediation where I worked back in 1999. IT budgeted an hour to do each Windows machine. No one in my department was done in less than 2 hours and the worse case was the guy who was down for 3 days. For the Macs, IT budgeted 1/2 hour, most Mac users did it themselves in 10-15 minutes, and most of those changes actually were making sure -Microsoft Office- was up-to-date.

As always, Your Mileage May Vary.

Will not work...

[Lumpy]

a lot of the malware out there is "trusted" crap from "partners"

So now we will have Microsoft certified SAFE malware....

Re:privacy :{

[drinkypoo]

Android has the same functionality, and it can be disabled there as well. No reason to believe it would be any different in Windows, at this point.

Now, there is the question of whether some malicious software could reactivate it, railroad it, use it for evil. But that's true of any beneficial functionality in the OS.

Re:privacy :{

[Howitzer86]

I had to turn off UAC in Windows 8 to compile and automatically copy my plugin project to its proper directory because that directory is under Programs Files. This was necessary because I had set the host program to start immediately afterwards in order to debug my plugin as it ran. This worked, but in doing so, I lost access to my Windows 8 apps. I only use a few, but it was annoying enough that I eventually moved the project to a Windows 7 machine (and you don't have to turn UAC off completely, it's just as far as Windows 8 is concerned, if that one registry entry concerning protected directories is toggled off the whole thing is compromised).

So, while any rebuttals here to the effect that "undoubtedly you can turn this off" are probably accurate, I wouldn't be surprised if there were things like this built into the system to encourage the user to keep it on. "Want to develop software on your PC? Well, either apply for a personal certificate or stop using Metro apps." It won't really stop developers, but it could shut down new user interest outside of closed markets.

Re:FTFY

[dimeglio]

I believe this feature is more for corporate IT (the real administrators) rather than for individual administrators of the system. Although corporate IT has some control, it basically centers around limiting the installation and not the execution of applications. For home use, I'm sure this is going to be disabled quickly - just like the firewall.

Re:FTFY

[Anonymous Coward]

why is it that people can't read?

This is a feature for corporate IT, not for home users. Basically, this is to enforce company IT rules more and prevent malware.

A pretty UAC

[QuietLagoon]

This sounds like new lipstick on the Windows UAC pig. From the UAC page:

User Account Control (UAC) helps defend your PC against hackers and malicious software. Any time a program wants to make a major change to your computer, UAC lets you know and asks for permission.

This new "feature" looks like yet another security prompt that the user is going to click through.

Re:A pretty UAC

[BobSwi]

Are you sure you want to run this .exe? Are you really sure? No, seriously are you absolutely sure?

Another wrench stuck in the gears...

[Anonymous Coward]

Why would I want MS have control of my device? No thanks, it's just another ploy to let them own your hardware.

Re:privacy :{

[Needs2BeSaid]

You're kind of an ass. Not that there's anything wrong with that.

Re:FTFY

[DigiShaman]

For home use, I'm sure this is going to be disabled quickly - just like the firewall.

Really? Do home users disable allowed app verification in OSX? No? Thought so!

Windows (like iOS and OSX) is no longer just an operating system, it's a platform. The new paradigm is to download from the app store ecosystem where it's vetted. Even Android has this process. The days of downloading programs from dubious vendors and websites zipping up files via shareware/freeware is over. In OSX, it ca be overridden to run programs like Onyx which is real easy with a few mouse clicks; but most people don't do that, let alone download Onyx either.

Re:privacy :{

[Anonymous Coward]

How about you just change the folder permissions on the destination folder rather than compromise/screw your whole system?

Re:FTFY

[RingDev]

I'm going to turn this on in a heart beat for my wife's Mom and Grandma's PCs.

And I'm sure the sys admins here at work will deploy with it enabled and completely locked down. It sounds way easier than dealing with this Power Broker crap.

-Rick

This is good - think OS X Gatekeeper

[mccalli]

This sounds a lot like Gatekeeper on the Mac, which works really well. It allows the user several levels of trust - "trust store apps only", "trust store apps plus recognised developers" (certificate signed), "allow everything".

I have mine set to "store apps plus recognised developers" and ask for the rest. If I run something else, I can right click and select Open..., it asks me if I'm sure and I say yes. This is a five second operation which gives me control over my options, whilst preventing unknown apps from running without my knowledge and explicit say so. This Windows one sounds pretty much the same, with the addition of your classic enterprise lock down features - it it's a corporately-owned machine, then yes the corporate should get say over what's running on it.

Imagine the kind of download-happy, click-on-everything user that we've all seen around. They would download cunningly-disguised-malware.exe and try to run it, and the OS would simply prevent them. Now true if they had admin rights they could go into preferences, set to allow everything etc. but it's all more effort and a quick realisation that something's unusual here.

Nope, I regard this as a good move. It already exists in OS X and works well - putting a similar system into Windows seems like a good idea to me.

Re:FTFY

[Anonymous Coward]

Just saying this looks like another layer of software that will only raise the barrier of entry for malware a little bit...

Nothing wrong with that. No security feature is perfect. A nice mix of different mechanisms is what you want anyway.

This is not a new concept, and it's already broken

[Da w00t]

Bit9's application whitelisting product was leveraged to attack customers using it.

http://krebsonsecurity.com/201...

Re:FTFY

[LifesABeach]

MS has the bucks to buy H1B hacks to make "a device" that *nix users have come to consider normal in an O/S. I give some bored 14 year old about a month to publish the simple work around for MS's "solution?"

Re:FTFY

[LifesABeach]

Poor A/C, you did.

Re:FTFY

[LifesABeach]

Meph, it gives bored 14 year old's something new to play with.

Executables are interesting, but what about data?

[jpvlsmv]

Ok, so this will prevent a modified "acrobat.exe" from running without a prompt. But running a properly-signed "acrobat.exe" to open evil.pdf still pwns the machine. You can also completely pwn a system by interacting with PowerShell. Wanna bet that in a corporate environment (which this is intended to help) powershell.exe will be allowed to run? (and thirdly, this functionality already exists since XP, in the form of "Parental Controls" and/or AppLocker.) --Joe

Re:privacy :{

[DigiShaman]

1. It's from an AC. Any attitude goes.

2. You really should have been asking the questions, not making a baseless statement.

However, in a manor of speaking, you may be correct. If the cert has become compromised, it could quickly be revoked. Not sure what that technically means for apps already installed and running on an existing workstation/server however.

Re:FTFY

[Ravaldy]

Stop with the Transformer quotes.

there needs to be free certificates at least for t

[Anonymous Coward]

there needs to be free certificates at least for testing / dev stuff.

Re:FTFY

[Wolfsbruder]

Stop with the Transformer quotes.

It's not Transformers, It's Dirty Harry.

Re:FTFY

[Ark42]

What's the default? If it's like OS X's Gatekeeper BS, then it's not really optional. Most Mac users are honestly too stupid to know that Gatekeeper exists or where to change the default so that they can install non-App-store software.

Re:FTFY

[Anonymous Coward]

"which are apps that are signed by specific software vendors, the Windows Store, or even your own organization"

This is no solution. I'd have to sign every software that gets in through the door for the users, every new version?

Because microsoft is not going to give free signatures to open source projects like libreoffice or preinstalling the public key of some open source project or organization...

Re:FTFY

[amalcolm]

Kids these days - no clue !

Re:FTFY

[Anonymous Coward]

Slashdot needs a "+1 Hey everybody, look at this idiot!" moderation.

It was a nice feature in 2003

[jd142]

So this feature has been around in some form or another since at least 2003. See https://technet.microsoft.com/... for how to implement it 12 years ago. It included the ability to make generate a hash for an executable, so if you needed people to run foobar.exe version 1.1.1.1, you generated the hash and then people could not run 1.1.1.0 or 1.1.1.2. You could also do certificates from trusted publishers, etc. It looks like there are a few new features, including virtualization options, but this is really just a rebranding of an existing feature to make it more prominent for the end user. Something all corporations do.

Re:It was a nice feature in 2003

[Anonymous Coward]

So this feature has been around in some form or another since at least 2003.

Yes, but there are known ways around software restriction policies in windows.

It would be interesting if this loophole was closed.

Re:It was a nice feature in 2003

[edtice1559]

Put less cynically, the feature hasn't been widely adopted so the vendor made some improvements based on customer feedback and is now trying to push the feature again in order to meet customer needs. I feel like a shill for M$ saying that, but really, it's hard to criticize them for continuing to work on a difficult (or maybe just difficult for them) feature for years because they see it significantly improving their product.

Re:It was a nice feature in 2003

[Anonymous Coward]

Yeah you can enforce something similar via GPO with a number of pattern matching rules. From hashes, to certificates, to simple file/path name rules.

SPP is really good, actually, for certain types of lockdowns in public access and other controlled computing environments. Blocking executables from media, download folders, the desktop, etc stops 99.5% of nonsense from clueless or annoying users - But it won't stop the determined ones. That's a social issue not a technical one anyway.

It's also quite good for helping mitigate some newer classes of malware that run entirely in user space. Bitlocker type malware, notably, quite happily executes in a user context (But tries a laundry list of privilege escalation exploits while it can to increase it's effectiveness) - It can encrypt everything an ordinary user has write access to without needing any sort of admin privileges. A lot of non-malware programs run like this too. You can download and install chrome, firefox, and spotify and they will live completely self-contained in a user's profile.

While handy, SPP is not very flexible. Strict rules are not very good in the current day of weekly or daily software updates. When your environment changes a lot or needs to be flexible SPP will not make your life easy. I'm hoping this new offering from microsoft allows stronger mitigation with the ability to have a "living" desktop system that receives regular updates..

Re:privacy :{

[John Bokma]

It needed 2 be said, I guess ;-)

Re:FTFY

[Anonymous Coward]

Are you an idiot?

Re:FTFY

[Anonymous Coward]

Stop with the Transformer quotes.

It's not Transformers, It's Dirty Harry.

Yoots today have no appreciation for classic movie quotes. Hell they think "Toy Soldier" by Martika was written by Emenim because they heard it in Grand Theft Auto.

Re:there needs to be free certificates at least fo

[brainstem]

there needs to be free certificates at least for testing / dev stuff.

You can do it yourself by setting up your own internal CA and trusting the root certificate on your test machines. It's totally free and included in Windows Server.

Re:FTFY

[Marginal Coward]

The days of downloading programs from dubious vendors and websites zipping up files via shareware/freeware is over.

Darn, there goes my home software business that I've run on the side for the last 15 years under the old "shareware" model. And I always thought the biggest threat to extinction that I faced came from pimply-faced teenage hackers posting cracks for my registration keying system. (Nobody but teenagers would spend the time to crack such low-volume software. I ain't exactly selling Photoshop.)

Re:there needs to be free certificates at least fo

[Anonymous Coward]

Device Guard allows using a local certificate as well, so it shouldn't be a problem.

What about software developers?

[ifdef]

I'm a software developer. I am constantly recompiling new versions of the code I'm working on.

It's bad enough that I have to keep reconfiguring my firewall (yes, all link-local addresses should be whitelisted; yes, all addresses given out by my own DHCP server should be whitelisted; yes, our server in the "cloud" should be whitelisted; yes, all address in a VM should be whitelisted; etc.).

Will I now have to include some sort of signing step in my build process? What about when I download and install a new tool? Currently, I do get asked to verify this, which is okay, because I don't install new tools every day, so having to occasionally click "ok" is worth the benefit of knowing that something won't get installed without my knowledge.

Re:What about software developers?

[DigiShaman]

I'm not a dev, but work with them. As I understand it, they work in OSX or Windows with full access to the resources they need. They test, then publish. If that means obtaining a method of certification, so be it. Otherwise, home-brew apps will just have to include instructions on temporarily allowing access to the program.

In OSX at least, I can run Onyx for the first time, then go back and re-enable "Mac Store and Identified Develops". My preferences for that one application is retained as the rule to the exception.

Re:What about software developers?

[DigiShaman]

Correction: "exception to the rule"

Re:What about software developers?

[Meneth]

Presumably this "Device Guard" can be disabled by an administrator. As a software developer, you do administrate your own computer, right?

Re:What about software developers?

[ifdef]

Yes, this would presumably be the solution.

I don't know, though, it was not trivial to configure Windows 8.1 to allow me to install and run an unsigned driver.

Re: privacy :{

[Anonymous Coward]

You know this is why the CD function exists right? You're not supposed to use program files this way. Use AppData folder or user-space folder.

Re:FTFY

[Anonymous Coward]

Aren't there project that deal with distributions of open source software?, I think they're called "distributions", or "distros" or such.
They maintain "repositories", which contain software packages. Sometimes the packages are signed!

Re:FTFY

[Ravaldy]

Which is quoted in Transformers.

Re:Executables are interesting, but what about dat

[Anonymous Coward]

To address that scenario, we would probably need signed documents as well.

Re:FTFY

[kolbe]

I would like to think if I installed Win10 Enterprise on my systems at home and use workgroups, I could deploy this and manage my kid's ability to allow/disallow various applications as well...

In the mind of an Administrator, domain employees are not any different than children after all.

Automated installation decimates defense in depth

[Anonymous Coward]

We've reached a time where the general consensus seems to be that automated installations are a required thing, but their existence wreaks havoc on defense in depth strategies. The security implications of automated installations clearly were not considered well, or considered and sacrificed on the altar of expedience. Just look at Ubuntu (I'm picking on you Ubuntu, but pick nearly any other OS too), with PolicyKit with permissions that provide for automated privilege elevation to allow completely unattended and automated background software download and installation. That's like having a nice castle with 4 concentric walls, then putting a giant door in each wall, with all the doors lined up, and a single key used to unlock each one.

Maybe a geek Benjamin Franklin born in this generation would have said something about those desiring convenience at the expense of security deserve neither.

Re:privacy :{

[Anonymous Coward]

Like most people here, if you don't how to use Windows, the problem is you, not the OS.

Re:FTFY

[mlts]

It is understandable to be worried... but similar functionality has been in Windows for a while.

Secure Device is basically AppLocker, except on a driver level. AppLocker is a function that can be turned on since Windows 7 that can allow applications by signature or by their hash.

For the enterprise, this is a useful tool. One use case would be on servers, as a way to prevent an attacker from trying to install a driver for keylogging or to hook into disk I/O in efforts to try to grab a key or a password. Another use case would be in groups of locked down desktops (finance and point of sale systems come to mind.)

What Device Guards adds is that the business can choose which companies to trust. That way, if someone wants to install a product not on the list, even though the code may be signed, the install would be stopped.

All and all, this is a useful feature to have, especially on machines which should be locked down thoroughly (edge webservers, for example.)

Re:FTFY

[ColdWetDog]

Slashdot needs a "+1 Hey everybody, look at this idiot!" moderation.

No we don't - it's just assumed.

Re:FTFY

[Anonymous Coward]

You should probably point out that that's the joke to the GP. Something tells me it'll sail over his head otherwise.

Re:FTFY

[ColdWetDog]

And Gatekeeper is fine (for individual use, it's not an Enterprise solution). If you don't understand the concept of walled garden or malware, then the DEFAULT secure position is to protect you from you lack of computer sophistication.

If you pass computer kindergarten and can now walk along the road unchaperoned, then you are one simple click away from freedom.

A perfectly sensible approach. I suspect that anyone posting here using OS X has unclicked Gatekeeper, but we are not it's target audience. Remember, it is still Eternal September out there.

Re:This is not a new concept, and it's already bro

[Nemyst]

By that logic, SSL is also broken, and so is any form of encryption: if you have the key, you're shit out of luck. Thankfully, getting the key(s) is a lot more complicated than you make it sound.

Re:FTFY

[Minwee]

Children tend to complain to HR a little more often about complicated login processes and restrictive password policies.

Re:privacy :{

[Anonymous Coward]

Doesn't the host program have a configuration somewhere allowing you to set up locations for plugins?

Re: FTFY

[Anonymous Coward]

This wont fix java running with more privileged than the user. Additionally if you allow java the executable do you allow every jar ever made?

Re:FTFY

[fuzzyfuzzyfungus]

TFA is a little vague; but if it is implemented the way that Software Restriction Policies currently are; I'd be all for it(and I say that as a smirking, linux using, tinfoil-hatted paranoiac.)

Cryptographic verification and whitelisting are enormously powerful techniques, and (aside from being able to take advantage of them), they are simply too useful to forbid successfully. What matters, and makes the difference between a fortress and a prison, is who gets to put something on the whitelist.

If you can whitelist something(either by signing it yourself, adding the cert of the person who signed it to the trusted list or both), it's a fortress. If the whitelist is what the vendor says it is, it's a prison. Same deal with 'secure boot'. If I can re-key it, it's a valuable tool. If I can't, it's a device that I'll never be more than a peon on.

Re:FTFY

[Anonymous Coward]

Wait... I'm confused...

Whenever I hear anything by Enema it's basically just fart noises in an angry little adolescent voice....

Re:FTFY

[ifdef]

Well, yes. I don't want my kids installing stuff on any of the other computers in the house. I was going to qualify that statement, but maybe it should stand as is. I don't want them installing anything at all without my knowledge.

I guess it's okay as long as it is sufficiently configurable. I know what I'm doing, and I need to do things that I don't expect my wife or kids to need to do. I'm also pretty careful about protecting myself, but they are more interested in their forums or facebook or tumbler or youtube or whatever, and they wouldn't even notice a restriction on what can be installed.

We had an issue like this at work a few years ago. Various protections, which were ABSOLUTELY necessary to protect the marketing people from themselves, were very inconvenient for developers, who were very frequently running builds that opened and read hundreds if not thousands of files. I KNOW that my header file is a text file and is NOT infected with a virus and doesn't need to be scanned each time it is opened (or ever), and especially not if it was just read a fraction of a second ago when it was #included from a different file than the one that is #including it now.

Re:FTFY

[fuzzyfuzzyfungus]

I can only comment on SRPs as they currently exist; but as of now the only real pain is vendors who don't sign anything. Self-signed or untrusted roots throw up scary warning by default; but you can add those to the trusted list if you wish. Legacy software is a giant pain in the ass, since most of it predates the custom of signing much of anything by default; but newer stuff generally isn't so bad. If necessary, you bless the vendor's cert and that takes care of it. You can also (again, with the present implementation of SRPs) bless binaries by hash, rather than by signature, which is frequently easier if you need to do once-offs.

Can they revoke an app's approval retroactively?

[Rob Y.]

So let me see. I assume all Microsoft apps will be signed as trusted from day 1. But of course, the bugs that make them malware don't turn up till months or even years down the road. Same applies to, say, Firefox or Chrome, but new versions of those won't be automatically signed - or maybe they're big enough players that they will, but you get the point. Other than allowing some administrators to force a Microsoft-only 'standard' desktop on users, what does this accomplish?

Re:FTFY

[fuzzyfuzzyfungus]

What is damned annoying is that 'Gatekeeper' can be turned off; but as of 10.10, it will turn itself back on after a period of time. iOSX seems likely in the near future.

win 10

[JohnVanVliet]

one more reason to get a new computer WITHOUT A OS
That way i can install MY OWN NON Microsoft OS

Re:FTFY

[Anonymous Coward]

Actually, I keep Gatekeeper on. When installing software, I two-finger-click (equivalent of right-click) the installer and option-click "open," which prompts for an administrator password to bypass Gatekeeper just this once. That way there are no accidents: installation of new software is a highly intentional act, equivalent to using sudo on the command line.

And that's exactly how it should be. That's why sudo works. That's why users should not run with administrator privileges.

Whining about Gatekeeper? You might as well be whining about not running everything as root on Linux.

Boring, to me.

[Anonymous Coward]

I only want two things out of windows 10:

1) hololens, so I can have simulated acid trips without any drugs involved...

2) a mod for Cortana to make her speak and behave like a virtual girlfriend (forever stuck in the "giddy over new relationship" phase).

Re:FTFY

[rjstanford]

The way that OS X solves the issue is that unsigned apps can still be run, but they require a more explicit first-time-only execution (right-click -> open which then displays a confirmation dialog indicating the app name and the website it was downloaded from) as opposed to signed apps that just run like normal. Its very unobtrusive, never even happens for most people, and works very well in the "least amount of tech to solve the problem" sense.

Re:FTFY

[rjstanford]

How often do you install new un-signed software that you didn't compile locally yourself that right-clicking only on the first time that an app is executed is a problem?

Re:FTFY

[Anonymous Coward]

Um, this is how I get all my PC software. Some of which I pay good money for. Store, indeed.

Re:FTFY

[Creepy]

Gatekeeper was never really designed for corporate style use, but to be honest, neither was the mac itself. For that matter, Windows PCs aren't really designed for corporate use, either.

My worry is that it works like Gatekeeper, though. The Windows Store is a hideous mess, especially on the free side - a lot of programs that should be free come up as low voted "lite" versions that do nothing without you paying for the real program. A prime example of this is .7z - the default programs (and there are about 20) are all view only unless you pay their fee and all you get is a touch interface 7zip, a program which you can download and use free on non-touch devices. I got so frustrated finding one that I just gave up and installed 7zip (this was a touch supporting laptop). Uninstalling one of these crapware programs is completely unintuitive to a desktop user, as well (supports the touch paradigm only). I actually had no idea how until my wife got a Windows Nokia phone.

And yes, I think the Windows Store is far worse than the Android store in this respect - way too many "lite" programs or trialware that does little or nothing without you paying for them. With android you usually get advertisement injection with this sort of free program. I'd rather have that than shakedown-ware. For reference, on android I had no problems finding a free .7z extractor (and it compresses, too!). It was the first hit I got and had 4.2 stars (first I got on Windows was 2 stars).

No, I don't mind paying for software, but when the program is free on the same platform just with a different interface I draw the line. Set up a paypal account and ask for donations if you are a poor college student. Be sure to state that you are a poor college student on the download page - I'm a sucker for pity pay donations. My worst fear is a Gatekeeper-like app locking the vast majority of users to some money grubbing bottom feeder developers like people that make money this way. This is capitalism at its worst, profiting off of someone else's creation.

Re:FTFY

[Jawnn]

>>

Windows (like iOS and OSX) is no longer just an operating system, it's a platform. The new paradigm is to download from the app store ecosystem where it's vetted. Even Android has this process. The days of downloading programs from dubious vendors and websites zipping up files via shareware/freeware is over.

You're kidding, right? The "vetted" Android apps are (in general) collection shit, a sizeable portion of which is unsafe or downright toxic.

Re: FTFY

[jd2112]

Transformers has dialogue?

ActiveGuard

[AnotherBlackHat]

Device Guard; the proven security model of ActiveX.

Require all apps to be controlled by MS

[higuita]

one more step so that MS can control what you can run on your computer...

You already have Boot loader signing, now you may block the non-whitelisted apps... (for sure MS signed apps are automatically allows)
next is to require all apps to be signed to be executed (if not enabled with this)...
Finally require all apps to be delivered by MS store (with the excuse to automatically sign all apps), or if you are big enough, setup your public store with expensive MS software and some CA like key from CA

I'm so glad i have stopped using windows

Re: FTFY

[Ravaldy]

2 to 3 lines.

Personal use

[Bengie]

I could see this being useful for my desktop. I think all of my games are signed, I would need to check. But if it became common practice, this could be useful. I could create a whitelist.

Re: FTFY

[Anonymous Coward]

I would be happier if the Microsoft store contained a section that allowed you to install and update desktop apps. Pretty much everything on there at the moment looks as if it was designed for a touchscreen

Re: FTFY

[Anonymous Coward]

Yeah normally its why can't my password be '12345' or pressing Ctrl+alt+delete is too complicated to login

Re:FTFY

[reikae]

I think right-clicking on an icon and selecting uninstall is intuitive to desktop users; it certainly was for me. And there's always Powershell :-)

Re: FTFY

[Anonymous Coward]

It also has butts and boobs.. and a dumbass protagonist who needs a girl to teach him about cars. Yay for feminism.

McAfee Application Control now OBE

[random coward]

Looks like MS is going to kill McAfee's application control(used to be solidcore) product.

Re:Can they revoke an app's approval retroactively

[hairyfeet]

Uhhhh....its the same thing Google does with ChromeOS only unlike ChromeOS its OPTIONAL and can be turned off. I seriously doubt it will even be on by default for any SKU other than Windows Enterprise as it would mean a ton of headaches for any OEM that sold a PC with this on thanks to the increased support calls.

Don't you just love how whatever MSFT does its automatically evil, even when its just copying Slashdot darling Google? It doesn't matter that Nadella is nothing like Gates or Ballmer, that one of the first things he did was open up .NET (as many devs had asked for) and bring their open source back into the fold so it wouldn't be treated like an afterthought, got rid of Metro for everything other than phones/tablets (again just like so many of us asked for) and then to top it all off have Windows 10 be free for a year to make up for Windows Mist8ke...what happened to letting the new guy have a chance before tarring and feathering?

This CEO change so far looks to be as big a direction shift for MSFT as bringing Jobs back was for Apple, as he doesn't seem to give a shit about planting Winflags on everything (like Ballmer) or treating FOSS like the plague and fucking users in favor of getting snugly with the OEMs (ala Gates) but actually seems to be LISTENING TO THE USERS and giving us what we ask for...shouldn't we at least give the guy one OS launch to see what he's gonna do?

Re:FTFY

[Anonymous Coward]

Let's see what we have here....

Really? Do home users disable allowed app verification in OSX? No? Thought so!

Comparison to another operating system. Tsk, tsk, tsk.
"Paradigm", "Platform", "Ecosystem" Three marketing-speak terms. My my.
A sentence with the phrase "The days of X are over". This is looking very bleak.

I'm afraid you have a case of elite-ism

Please consult with a physician about an inter-glutial-cranial-ectomy as soon as possible.

Re:FTFY

[Darinbob]

No, I don't. Windows will already routinely install all sorts of crap merely because it's been signed, without ever asking the user for permission. Including drivers from USB devices and smart phones. I would personally prefer an option to turn this feature off so that it must ask me always before it installs anything.

Re:FTFY

[Darinbob]

What is a "yoot"?

Poisoned Well

[Anonymous Coward]

So in the past our government has actually compromised Windows Update to distribute Flame/Duqu. How does this prevent that from happening? You know if the government can do it that's a fairly low bar.

Policies

[ITRambo]

I presume that this is policies being dumber down for use on all versions of Windows 10, not just Pro or Enterprise. I'm happy with the policies we set that only allow installations from specific mapped locations. Our workstation that is running Windows 10 preview to see how useful it is, updated directly from Windows 7 Pro, imported all the policies perfectly. I hope that doesn't change..

Re:Can they revoke an app's approval retroactively

[Rob Y.]

I wasn't saying it was Microsoft being evil. I just thought stupid admins - or corporate policy makers might set a policy that only allows Microsoft apps - and this feature was giving them a way to enforce that. Imagine if this had been in place during the heyday of IE6. Firefox would've been severely hindered in getting acceptance, and IE6 would've ruled (and messed up) the web longer than it did. As it was, lots of corporate IT disallowed you to install it. So yeah, at this point maybe it's the "nobody got fired for restricting you to MS products" crowd that's evil - but that doesn't mean it's not potentially problematic...

Re:privacy :{

[Howitzer86]

That was the first thing I did. It didn't work.

Re: privacy :{

[Howitzer86]

Tell that to Autodesk's Navisworks division. I'm just a guy making a plugin.

Re:privacy :{

[Howitzer86]

Nope.

Re:FTFY

[tepples]

Fairly often if I'm running alpha or beta tests on someone else's software.

Re:FTFY

[spire3661]

Yeah i have given up on Apple as a workstation. My 2011 Mac mini is slowly turning from a Unix-alike workstation to a very fancy ipad.

Re:privacy :{

[spire3661]

This is why i refuse to use/buy the windows 8 apps. They are like weird alien programs on a machine im used to executing anything i want. IF I have the exe, it should run, logins be damned.

Re:FTFY

[Pascal Sartoretti]

For home use, I'm sure this is going to be disabled quickly - just like the firewall.

Yes, but it requires a deliberate action from the user, who shouldn't be surprised if problems then happen...

Nothing from the Windows app store should be...

[Anonymous Coward]

...trusted.

Wasn't there a report of how the Windows/Metro app store was infested with malware?

Microsoft trying to regain their monopoly

[Anonymous Coward]

It provides better security against malware and zero days for Windows 10 by blocking anything other than trusted apps—which are apps that are signed by specific software vendors, the Windows Store, or even your own organization.

Basically all they doing is trying to kill open source. This won't do a thing to stop malware.

Re:Can they revoke an app's approval retroactively

[david_thornley]

Stupid admins can set policies that don't allow some useful software. GIFs at 11.

What about software that is just run uninstalled?

[Helldesk Hound]

What about software that is just run uninstalled?

How does Microsoft Device Guard protect against that?

Re:FTFY

[rjstanford]

So have them sign the software as part of the build (self-signed is fine, you'd only have to add the cert once). Still not an issue for the vast majority of users out there.