Expert: Hackers Will Break Vistas PatchGuard

A computer security expert speaking at the Virus Bulletin conference predicts that hackers will crack the controversial kernel anti-tampering technology within a year of the final release of Windows Vista.

MONTREAL—A computer security expert is predicting that hackers will crack the controversial PatchGuard kernel anti-tampering technology coming in Windows Vista within one year of its release.

Alexander Czarnowski, chief executive of Avet, in Warsaw, Poland, said he believes its inevitable that the technology will be broken once the final version of Windows Vista is released to manufacturing.

"A lot of things get changed from beta to beta, so people are waiting for a final version. It might get broken immediately but it might be a year before its made public," Czarnowski said during a presentation at the Virus Bulletin conference here.

Resource Library:

The PatchGuard technology, which was introduced in Windows Server 2003 Service Pack 1 x64 and Windows XP x64 almost two years ago, monitors the kernel to prevent third parties from extending or replacing kernel services. It effectively serves as an anti-rootkit mechanism, blocking the insertion of kernel-mode stealth malware.

For advice on how to secure your network and applications, as well as the latest security news, visit Ziff Davis Internets Security IT Hub.

However, hackers and security researchers have already started discussing ways to bypass the technology.

A security researcher associated with the Metasploit Project has already published an Uninformed.org essay that proposes several different techniques that could be used to bypass PatchGuard.

The technology is at the core of a bitter dispute between Microsoft and anti-virus vendors over access to sensitive parts of the new operating system. Symantec and McAfee argue that PatchGuard will limits their ability to integrate security software into Vista, but Microsoft insists the technology is crucial to securing the operating system.

Microsoft has launched a stand-alone Windows Vista Security landing page featuring information about the security work being built into the operating system. The page includes a white paper on PatchGuard.

Microsoft has also release of list of anti-virus vendors that are providing free trials of security software that can be used with Vista. The companies include CA, F-Secure and Trend Micro.

Check out eWEEK.coms for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEK.com Security Center Editor Larry Seltzers Weblog.

Reader Comments: Expert: Hackers Will Break Vistas PatchGuard >>> Be the FIRST to comment on this article!

>>> More Network Security & Hardware Articles          >>> More By Ryan Naraine