Microsoft Caves on Vista Security

By Larry Seltzer  |  Posted 2006-10-16 Print this article Print

Opinion: Will the security companies making trouble for Microsoft be appeased by the changes the company has agreed to make? They should be, but that's no guarantee.

Security is security, but business is business I guess. It wasnt worth it to Microsoft to stick to its positions on PatchGuard and the Windows Security Center. The details arent in yet, but based on Microsofts vague initial statements it appears that the company has essentially acceded to Symantecs position on PatchGuard and is trying to finesse matters on the Security Center. The security companies that raised the initial stink are understandably waiting for details, but it probably makes sense for Microsoft to try to make most of them happy enough to shut up and let it ship Vista without raising a further stink.
A computer security expert speaking at the Virus Bulletin conference predicts that hackers will crack the controversial kernel anti-tampering technology within a year of the final release of Windows Vista. Click here to read more.
Symantecs position on PatchGuard has been to create a set of APIs through which certified vendors could install code that bypassed PatchGuard through defined mechanisms. In a recent blog Symantec put it this way:
  • Symantec has provided Microsoft with recommend APIs that will allow legitimate, authorized and certified security vendors to leverage the same capabilities that we have in prior versions of Windows.
  • Symantec has been asking for these capabilities for well over one year now and therefore these concerns are not a new development to Microsoft.
  • Symantec has repeatedly suggested that Microsoft establish a new certification model that will certify legitimate vendors who seek to extend the Windows Vista kernel. This certification, on top of existing driver certification steps, will ensure that certified vendors are not attempting to bypass Windows DRM and that certified vendors are not malicious and are making genuine enhancements to Windows Vista.
Microsoft security personnel have told me about this proposal in the past and said it makes them nervous, and I can see why. Consider it an increase in the attack surface of 64-bit Windows relative to the current design of PatchGuard. But still, it does fit with Microsofts style of doing things, and if the certification program is run fairly and carefully its not likely introduce malware directly. Im more worried about vulnerabilities in the security programs themselves opening up the Windows kernel to attack, but this is probably not a major problem for two reasons: 1) the set of Windows Vista systems is a large target, the set of Vista systems running any particular vulnerable version of a security product much less so; and 2) as Symantec notes, its possible for third parties, after signing their code properly, to install boot-time kernel drivers. This code could also expose the kernel, but banning third-party code is hardly the answer. The problem security vendors had with the Vista Security Center was that they cant completely replace it, as they could with Windows XP. When you install a third-party product on XP it will likely shut down the XP Security Center and replace it with the third partys tray/control panel program. Next page: Microsoft tries to settle objections about its Security and Welcome Centers.

Larry Seltzer has been writing software for and English about computers ever since—,much to his own amazement—,he graduated from the University of Pennsylvania in 1983.

He was one of the authors of NPL and NPL-R, fourth-generation languages for microcomputers by the now-defunct DeskTop Software Corporation. (Larry is sad to find absolutely no hits on any of these +products on Google.) His work at Desktop Software included programming the UCSD p-System, a virtual machine-based operating system with portable binaries that pre-dated Java by more than 10 years.

For several years, he wrote corporate software for Mathematica Policy Research (they're still in business!) and Chase Econometrics (not so lucky) before being forcibly thrown into the consulting market. He bummed around the Philadelphia consulting and contract-programming scenes for a year or two before taking a job at NSTL (National Software Testing Labs) developing product tests and managing contract testing for the computer industry, governments and publication.

In 1991 Larry moved to Massachusetts to become Technical Director of PC Week Labs (now eWeek Labs). He moved within Ziff Davis to New York in 1994 to run testing at Windows Sources. In 1995, he became Technical Director for Internet product testing at PC Magazine and stayed there till 1998.

Since then, he has been writing for numerous other publications, including Fortune Small Business, Windows 2000 Magazine (now Windows and .NET Magazine), ZDNet and Sam Whitmore's Media Survey.

Submit a Comment

Loading Comments...
Manage your Newsletters: Login   Register My Newsletters

Rocket Fuel