Slashdot Mirror
Israeli Security Company Builds "Unhackable" Version of Windows
New submitter Neavey writes: Sounds too good to be true, but Morphisec, an Israeli startup, claims to have built an unhackable version of Windows. Its not yet publicly available, a red flag if ever I saw one, but internal testing has had a 100% success rate: "In a statement for BI, Dudu Mimran, the co-founder of the company, describes this new OS version as the Windows that 'Microsoft should be doing,' explaining that, while the platform was initially designed for government use, it can be actually installed by any enterprise that wants to make sure that no hack is possible.
Basically, this operating can block any zero-day attack, the founder says, thanks to the operating system randomizing all memory, which means that the hacker cannot target the computer memory and compromise the data stored on the drives."
What things memory randomization does not fix, left as an exercise for the reader.
I hope everyone at that company is prepared for a long week.
SJW's don't eliminate discrimination. They just expropriate it for themselves.
It is being offered to the mullahs on a flashkey.
You may want to take a look at some of this company's other products, including flying serum and invisibility powder.
Just remove all input and output capabilities, and the power supply. Most secure computer in the world.
This company (or whoever wrote TFS/TFA about them) seems not to understand the concept of a zero-day vulnerability.
It is ridiculous to say that one is not vulnerable to zero-day attacks. They are, in security parlance, the "unknown unknowns" - the things you don't even conceptually know of as vulnerabilities right now. One cannot design a networked computer system with any functionality whatsoever in which they can somehow know and anticipate the "unknown unknowns" (as opposed to the known unknowns, some of which can be mitigated if you're lucky).
The unknown unknowns are, by definition, *not yet known*, so you can't design a mitigation against them until *after* you are aware of them. If awareness comes in the form of a zero-day hack, then you will fail to defend against the attack at the time it hit due to your lack of information about the attack vector.
Also, unless this company has full access to all Windows source code for the build they have, it is very likely that one singular memory-based mitigation will not be effective against every possible attack vector that exists in the Windows codebase. So unless they have performed full formal methods verification of the entire Windows codebase to guarantee that there are no "unknown unknowns", and then fixed every security vulnerability that exists in the product in the original state in which they received it from Microsoft, this is basically snakeoil.
Also, don't we already have ASLR? The mind boggles at the stupidity of these people. Who do they seriously think is going to buy this?
Actually, forget I asked. They said their target was governments. I have no doubt they will sell thousands of licenses.
Oh yeah, I've seen builds that were 100% solid on internal testing. Not a thing wrong with it according to automated tests, scripted manual testing, smoke testing, and random usage testing. Not a thing! A million monkeys could bang on keyboards all day long and nothing would break. Much simpler programs than an entire OS, mind you. But still, they were bullet-proof, air-tight, divine works of software engineering.
Then we pushed them to production. Murphy's law is a moooootherfucker.
Captcha: enraging
Memory randomization has been around a very very very long time. It's not going to help with logical programming errors.
It is literally already implemented in every version of Windows since Vista. Windows also uses the NX/XD features in modern CPUs.
It's not going to help with logical programming errors.
It is literally already implemented in every version of Windows since Vista.
Windows has had logical programming errors before Vista.
The headline is crap, of course.
That said, it's not too hard to have a version such that you know it's unaltered when you boot each morning. You do basically a live CD, booting from a read-only lun.
Just as you separate a normal user USING the machine from an administrator account UPDATING the OS, you can have the OS basically read-only during use and set it to writeable only when you need to update the software. That change is done outside of the OS, either via the NAS or the hypervisor.
In that way, you can come in eqch morning knowing your Windows system hasn't been hacked (past tense). As soon as you open IE, though, you could get a new exploit. That exploit disappears when you shut the machine down, though.