Manage updates with the Download App
October 12, 2006 11:17 AM PDT
Windows kernel protection expected to break soon
- Related Stories
-
Piecing together Windows Vista
November 8, 2006 -
European rivals turn wary eye on Microsoft
September 28, 2006 -
Rivals skirmish with Microsoft over Vista security
September 19, 2006 -
Windows defense handcuffs good guys
August 10, 2006 -
Microsoft launches 64-bit Windows
April 25, 2005 -
AMD unveils details of its 64-bit chip
September 23, 2003
Hackers will break through the protection mechanism soon after Microsoft releases Windows Vista, Aleksander Czarnowski, a technologist at Polish security company AVET Information and Network Security, said in a presentation at the Virus Bulletin event here.
"It will probably take a year or so for it to surface publicly, but I believe it will be broken earlier," Czarnowski said. "PatchGuard will be broken pretty soon after the final version is released... A lot of people who would break it will probably not make it public immediately."
Microsoft designed PatchGuard, also called kernel patch protection, to safeguard the Windows kernel against malicious code attacks. Cybercrooks have found ways to exploit the innards of Windows for malicious purposes, making the protection offered by PatchGuard key to securing the operating system, Microsoft has said. (A paper on PatchGuard is available on Microsoft's Web site.)
The technology applies only to 64-bit versions of Windows and debuted last year in Windows XP x64 Edition. However, while that Windows version was never broadly adopted, PatchGuard is set to become used more widely, when Vista hits store shelves in January and people are expected to buy PCs with 64-bit processors and 64-bit versions of the operating system.
"Kernel patch protection is not a silver bullet. We're not saying no one will ever crack it," Stephen Toulouse, a program manager in Microsoft's Security Technology Unit, wrote on his blog last week. "The point is that the situation as it exists now? attackers don't need to do any work to access the kernel at the highest level. At least with kernel patch protection, we're trying to prevent that."
There have been some claims that PatchGuard has already been compromised, but according to Microsoft it has not yet been hacked. "We're not aware as of right now that people have circumvented it," Toulouse wrote.
If PatchGuard is ever circumvented, Microsoft would fix the issue with a software update, Toulouse wrote. "Kernel patch protection can become more resilient over time due to the combination of hardware and software advancements," he wrote.
Security companies have been taking all sorts of shots at Vista. Symantec, the world's largest maker of antivirus software, has been leading the pack, closely followed by others including McAfee, Check Point Software Technologies and Panda Software.
Security companies have complained that PatchGuard, while meant to lock out bad guys, also prevents certain types of security software from running. The security software makers had gotten used to taking advantage of the Windows kernel, a move Microsoft is preventing with PatchGuard.
Tensions are flying high in the security space after Microsoft, with its $34 billion war chest, entered the market. It launched Windows Live OneCare for consumers and is readying enterprise security products. Microsoft, with its huge presence on desktops, has a built-in advantage -- an advantage that's making security firms nervous.
See more CNET content tagged:
Stephen Toulouse, security company, protection, McAfee Inc., security
76 comments
Join the conversation! Add your comment
OS with exposures like, and I quote: "... the situation as it exists
now&attackers don't need to do any work to access the kernel at
the highest level..."
Using windows, and worse depending on it, is just stupid. And this
new Patchguard, won't do much to solve the long term architectural
problems with this OS. When will people wake up and realize that
there are better solutions out there?
Like Linux ?
I've tried RC1 of 64Bit XP, my network worked right off the bat.
Linux I've tried the 64Bit version, and nothing I've tried (including 2 Months of forum Postings) would work for the WiFi.
Better yet, use NetBSD and feel secured and hibernate for rest of your life.
FreeBSD? Hibernate? Huh???
That is why MS should give the AV companies access to it now so they can protect it, surely Microsoft cannot.
A more accurate headline would have been "Some Security Experts Believe Vista Kernel Protection will Be Hacked" or "Some Security Experts Doubt Vista Kernel Protection." But neither would have been as sensational as your unjustified choice.
Shoddy journalism, if you can even call it that.
-Mister Winky
doesn't it? And by the way I personally know over a dozen people
who think Vista Kernel Protection will be hacked soon, so there is
no need to think there are only two.
Have a nice day!
The user always needs to vigilant.
:)
Windows users are the ones in denial; Windows is on the way down.
I neither deny that Windows has its flaws, nor do I accept that Windows is on its way down. I am not drustrated with it, as I have learned how to secure my machine even inside the Windows environment.
I would challenge the Linux/OSX users to try using Windows, and helping to make it a better op system....or are they too lazy to do a little work? Sounds like it to me.
fact on the way down, due to the increasing market share of
both Linux and Mac OS X. It is mathamatically impossible for
Windows to gain marketshare while their existing marketshare is
decreasing. And yes, Windows users are in denial. I use Windows
myself on occasion but more importantly I have to deal with
Windows users on a regular basis. They insist on beating their
own heads against the wall instead of doing something far less
painful - switching to something else that actually works.
Mac OS X, Linux, and Windows all have flaws, no kidding. They
are all works in progress. For the majority of users, and not just
those who have "learned how to secure (their) machine", Mac OS
X presents by far the most elegant and rock solid operating
system. Windows doesn't even come close on the features they
copy, much less on anything Microsoft deems original.
I have personally used Windows, and I help Windows users
switch all the time. It is common for them to disbelieve how easy
it is to use an operating system like Mac OS X. They often ask
"What's the catch?" Well, dragonfly, there is no catch.
By the way it is not the job of Linux or Mac OS X users to help
make Windows a better operating system any more than it is a
Windows user's job to improve Linux or Mac OS X. It has nothing
to do with laziness. We choose not to use Windows regularly for
a reason. Windows is a necessary evil, for now, but many people
will drop it completely at the first opportunity. The only hope for
Microsoft is to get busy on the successor to Vista, and do it right
this time.
Have a nice day!
I used Windows for my entire life up until last year when I got sick of it. I got tired of not being able to finish working on my projects without having the program they were in freezing.
I don't know if that was the fault of my PC which was a middle of the line Acer or Windows XP.
I just got sick of it, I didn't want to waste any more time when I could be working.
I looked for an alternative. I went to my local John Lewis (store) and looked in the computer department and got talking to some of the staff, I told them what I wanted a PC for, stuff like pictures, video and just to work on and surf the internet, preferabley without daily restarts.
In the end, after much faffing about, I got an iMac.
It was the best purchase I ever made.
I've not had a single major problem in over a year. I don't have any Norton of McAfee AV software to clog things up, I can just work, in peace, doing what I want/need to do without being asked if I want to,' clean up my desktop' or be moaned at.
Most switchers used Windows once, and either got sick of it or git a virus one too many times.
Before you say it was my fault my Acer was rubbish I tried to keep it up to date, but it refused to install service pack two and other updates.
Oh and most people are too lazy to spend time to get their system to work. That's why I spend no more time messing around with drivers or install CDs, everything so far has just worked, thought that basically amounts to a second monitor, two printers and some other stuff.
Why don't you try a Mac? If you have say what you thought was wrong.
This is not a fanboy post, it's my experience so don't bash too hard please.
<a class="jive-link-external" href="http://marketshare.hitslink.com/report.aspx?qprid=5" target="_newWindow">http://marketshare.hitslink.com/report.aspx?qprid=5</a>
If Windows is in a nosedive, provide some alternate data (hint: you won't find any).
-Mister Winky
The rest are the real intelligent OS-savy superior people (especially those 3.88% ones)!
This news is a prediction, nothing more. We all know nothing is perfect (sorry Apple fanboys). And Windows is certainly not perfect either. But even if/when it is cracked, that doesn't mean Vista will instantly turn into an insecure OS, as long as Microsoft manages to patch those holes reasonably quickly, hackers won't ever have as simple job as they have now, where they have open easy access to the dll's.
trying to get into the news with that incredible forcast? Of
course it'll be broken. Everybody knows that.
Charles R. Whealton
Charles Whealton @ pleasedontspam.com
even more frustrating are all the f&^*&^ing fanboys. Nothing keeps
people away from OS X and Linux like the users of OS X and Linux.
maybe you should just stick with Windows. You'll find more
company there.
Have a nice day!
Now let us look what looks secure design. If service need to be run on some port below 1024 then it needs system privelege to open that port. That it is ok, but why that service keep system privilege? Why not change permissions to some other unpriveledged account that has no privilege of executing code in kernel space? That is not so hard to do. That is bad design. And as long there is bad design in start microsoft will never have secure OS.
This is applicable to other OS-es, like linux and OS X but, on linux superuser account is used only for mainterence, not internet browsing, and similar stuff. And on OS X superuser account is disabled (eg. you can not log in as root). Good design? It can be better... But it is satisfying for now.
Example: Apache web server won't run as superuser :) That is good. And if someone compromise apache he won't be able to execute code in kernel space. He will have to work harder to gain root privilege, and if you also use some stack protection algoritms and maybe novel's apparmor you are safe from most attacks.
Just my opinion.
Greetings.
However, no one can predict how long it will take to crack. Hopefully it will be later rather than sooner.
On the subject of OS's and fanboys (refuse to spell it fanbois like all the "cool" people), all this commotion over MS vs *nix vs Apple is disgusting. It really only comes down to personal preference. 99% of any arguments for or against any of the popular OS's is anecdotal.
My preference is (don't have a heart attack now) Windows. Linux is great! In fact, that's what I'm doing with my profession right now. I'm a Sr Linux Test Engineer for a company called Neoware (www.neoware.com). I also do some development with the project: mostly shell scripting but sometimes C and C++, also some x86 asm in nasm. BASH is super-powerful and it's always a rewarding feeling to get something to compile and actually work in Linux. Every day with Linux is a new challenge and it's so much fun. However, the harsh reality of the situation is that not everyone is an engineer/developer. Not everyone has the time to fsck around w/ the OS for hours just to get a damn app to compile. No matter how fun it is for me, it invariable sucks for the other 99 % of the population. This is where Windows comes in. It just works, plain and simple. Users need not know how the hell it works behind the sceens. They can be shielded from esoteric terminology likes kernels and compiling and permissions etc... The computer becomes a tool in Windows; A means to and end rather than an end in and of itself.
OS-X... eh, It's ok. Unix kernel, intuitive software, lots of sparkle. For me though, I just don't care for it. Nothing particularly special or defining about it. Seems kind of fisher-price. Don't have a heart attack. This is, again, my personal preference and I do realize that the Mac world has the most passionate, fanatic, Michael Moore loving, uber-liberal, elitist, zealots in the show. They do love their Macs don't they. <sigh>
Use whatever works for ya, but don't try to shove your preference down other people's throats. The reality is, if you are competant and tech-savvy enough, you can chose any OS and be happy with it.
Very, very few programs in linux have to be compiled by the end-user, and the handful that do are a simple 3 line process.
It is not like the user has to comb through the code and translte into machine code.
I wish everyone would get off their high-horses and realise that we live in a free world where each and every person can decide what OS he/she wants to use. Furthermore, it would be great if people would stop trying to convert everyone else to other OSs - just let people use whatever they want to use.
Finally, every OS has its pros/cons and discussing them objectively is great, but I hate it when people judge others on the basis of what OS they use.
This is the main reason for using windows, 99% of the people out there cant bother to screw around trying to find a program to work on their proprietary system, or that will compile to work on their particular variant of linux, unix, bsd, etc.
Locking everyone out of the windows kernel, even the security people, is a good thing. If they bothered to actually "innovate" as they say that having access to the kernel allows them to do (although what they call innovate is what i call making a new user interface for 10 year old crappy code) If security companies can get past it or uninstall windows security features, how much harder is it for hackers to do it? hackers wont likely reinstall windows's security programs when they uninstall them either, so i agree with Microsoft's stance that the USER should do it if they want to do it, not a program do it for them.
If a user buys a security package and it expires, and the windows one doesnt expire, they will move back to the windows one, rather than pay money for some expensive solution that just replaces somethin windows already can do for you. Windows also has ZIP-file shell integration, yet i use 7-Zip, because i prefer the right click shell extension to the extract wizard that Windows offers, but i browse the zip files with Windows's integrated ZIP-file ability. Microsoft wants Windows to be a tool to the user, to help them do what they want to do, and not having to open a seperate program to see inside a ZIP file helps me EVERY DAY. Is Winzip losing customers? maybe. Do they have no possible way to innovate to get people to buy software from them? hardly. 7-Zip beats Winzip any day, and its free, so i use it, thats my preference, i just happen to like fast, easy, small, and efficient archive programs that work with dozens of archive formats as opposed to bloated ones that support one or two.
When Windows Firewall was added to windows, people no longer had to deal with getting a virus that installed itself before the user could update windows and get an anti-virus and firewall after a fresh install, and i like that. Its free, its very useful, its out of the way and works in the background when i dont need to change it, and it works. Norton and McAfee software packages are huge, intrusive, get in the way, slow everything down, and make you have to configure alot of options to get them working good, plus they charge you money for updates every year. I'll never use their products because of that.
Once i move to Vista and can have a system kernel that wont let me run .exe's and get some nasty virus that ruins my machine without needing a stupid program to constantly scan every file i download or run in memory, ill never look back. Mind you the 10GB size of the Vista C:\Windows folder turns me off, but i have a 160GB hard drive. Id rather have a 90% full hard drive than 50MB worth of my memory and 10% of my processor bogged down by internet security suites if i dont have to, and patchguard will go a LONG way towards that.
If microsoft is forced to remove patchguard, i would try and grab it from vista rc2 and get it to work in the retail version. Just because the security companies dont want to have to actually do work to continue selling products, doesnt mean i should have to go without security unless i dish out more money than i already have on my computer.
Why is security even "sold"? it should have been a feature long ago, but microsoft cant do it because they know the "security" companies dont want that, thats why they pay people to make viruses.
A peer of mine and I do a lot of similar work and even collaborate on projects. He uses XP, I use Windows 2000. There is nothing that his system will do that mine won't. We compile the same source code, play the same games, network the same way, run similar application suites, etc.
What does vista give you besides eye-candy? More DRM, more kernel protection, more limits on what you can and cannot do with YOUR computer. But, what does it let you do that your present system cannot do? Nobody has yet to answer that question. Until that 'something' is defined, there is really zero value in buying Vista.
I recently lost a power supply that cost me a CPU/Motherboard. I installed the new parts on my Win2K box, added some RAM, a disk drive, upgraded my DVD drive, changed video card and a few other things. Rebooted. The system prompted me for the new drivers... I'm fully up and running with a dozen hardware changes in less than 3 hours. Try that with XP! Try that with Vista!!
If it ain't broke, don't fix it. On person wrote that 99% of users need a system that just works. What percentage know to properly migrate a windows system such that everything works and all the files, applications and such are there too? Not many.