Microsoft Caves on Vista Security

Microsoft Caves on Vista Security
( Page 1 of 2 )

Opinion: Will the security companies making trouble for Microsoft be appeased by the changes the company has agreed to make? They should be, but that's no guarantee.Security is security, but business is business I guess.

It wasnt worth it to Microsoft to stick to its positions on PatchGuard and the Windows Security Center. The details arent in yet, but based on Microsofts vague initial statements it appears that the company has essentially acceded to Symantecs position on PatchGuard and is trying to finesse matters on the Security Center.

The security companies that raised the initial stink are understandably waiting for details, but it probably makes sense for Microsoft to try to make most of them happy enough to shut up and let it ship Vista without raising a further stink.

Resource Library:

A computer security expert speaking at the Virus Bulletin conference predicts that hackers will crack the controversial kernel anti-tampering technology within a year of the final release of Windows Vista. Click here to read more.

Symantecs position on PatchGuard has been to create a set of APIs through which certified vendors could install code that bypassed PatchGuard through defined mechanisms.

In a recent blog Symantec put it this way:

• Symantec has provided Microsoft with recommend APIs that will allow legitimate, authorized and certified security vendors to leverage the same capabilities that we have in prior versions of Windows.
• Symantec has been asking for these capabilities for well over one year now and therefore these concerns are not a new development to Microsoft.
• Symantec has repeatedly suggested that Microsoft establish a new certification model that will certify legitimate vendors who seek to extend the Windows Vista kernel. This certification, on top of existing driver certification steps, will ensure that certified vendors are not attempting to bypass Windows DRM and that certified vendors are not malicious and are making genuine enhancements to Windows Vista.

Microsoft security personnel have told me about this proposal in the past and said it makes them nervous, and I can see why. Consider it an increase in the attack surface of 64-bit Windows relative to the current design of PatchGuard.

But still, it does fit with Microsofts style of doing things, and if the certification program is run fairly and carefully its not likely introduce malware directly.

Im more worried about vulnerabilities in the security programs themselves opening up the Windows kernel to attack, but this is probably not a major problem for two reasons: 1) the set of Windows Vista systems is a large target, the set of Vista systems running any particular vulnerable version of a security product much less so; and 2) as Symantec notes, its possible for third parties, after signing their code properly, to install boot-time kernel drivers. This code could also expose the kernel, but banning third-party code is hardly the answer.

The problem security vendors had with the Vista Security Center was that they cant completely replace it, as they could with Windows XP. When you install a third-party product on XP it will likely shut down the XP Security Center and replace it with the third partys tray/control panel program.

Next page: Microsoft tries to settle objections about its Security and Welcome Centers.

>>> More Network Security & Hardware Articles          >>> More By Larry Seltzer