Windows Vista SP1 to Disable Activation Exploits

By Peter Galli  |  Posted 2007-12-04 Print this article Print

Users with counterfeit or nonvalidated software will no longer only get reduced access to features and functionality.

Microsoft will use the upcoming release of Windows Vista Service Pack 1 to disable the two most widely used exploits of the operating system's activation process, as well as do away with the system that reduces access to features and functionality for those users with counterfeit or nonvalidated software.

The Vista SP1 update will make changes to the underlying code to prevent the two primary types of exploits that pirates currently use to generate counterfeit versions of Windows Vista: the OEM BIOS exploit and the Grace Timer exploit.

The moves come even as Microsoft officials say piracy is on the decline. "We're seeing indications from internal metrics, like WGA validation failures, that the Vista piracy rate is less than half that of [Windows] XP today," Alex Kochis, Microsoft's group product manager for Windows Genuine Advantage, told eWEEK.

The OEM BIOS exploit has two basic variants. The first involves directly editing system files and the BIOS of the motherboard to present information to indicate to the system that the copy of Windows had been installed by an OEM in a factory environment.

The other variant is software-based and tries to do the same thing by intercepting some of the calls to the BIOS and returning a result expected in a factory-based install, Kochis said.

For its part, the Grace Timer exploit resets the 30-day grace time limit between installation and activation. One of these, known as the 2099 hack, pushes that out to the year 2099.

Click here to read more about Windows Vista SP1.

Kochis acknowledged that any user who chooses not to install the SP1 update would not be affected by these changes.

Vista SP1 will also bring changes to the customer experience with the Windows Genuine Advantage program, especially how it differentiates genuine from nongenuine systems in Windows Vista, as well as with Windows Server 2008 when it is released in the first quarter of next year.

Users whose systems are identified as counterfeit or have not been validated as genuinewill be presented with clear and recurring notices about the status of their system and how to get a genuine copy.

This is a change in tactics from the current approach for Windows Vista, where counterfeit systems go into a state called reduced functionality mode, which essentially suspends, after 30 days, a number of features of the system until the user takes action to get genuine.

To read more about the tools Microsoft is using to combat Vista piracy, click here.

Microsoft saw Vista SP1 as an opportunity to make these changes in line with recent feedback from some of its larger enterprise and public sector customers, who felt the move to reduced functionality mode was an anti-piracy measure for the consumer and small-business space, Kochis said.

"Under this new system, no features will be disabled. Instead it will be a notification-based experience similar in some ways to what we have done with XP. A user of a system that has not been activated and gone through the 30-day grace period to activate will, when logging in on the 31st day, see a dialog box on a plain black background," he said. "That will give them two options: Activate Windows now, which will bring up all the options to do this, and activate Windows later, which takes them directly to their desktop, which will be exactly the same as it had been the last time they used it, except that there will be a plain black background and a message in the lower right hand corner over the system tray telling them that their copy of Windows is not genuine."

In addition, every hour a balloon reminder will appear from the system tray asking them to activate Windows, and the desktop background will be switched back to black if the color had been changed.

Microsoft fixes a glitch that shut down Vista validation. Read more here.

Some analysts, such as Chris Swenson at the NPD Group, said Microsoft's anti-piracy moves are already paying off and its integrated anti-piracy campaign is starting to show results.

"Microsoft is listening to feedback from its early adopters with this move," Swenson told eWEEK. "If you look at Intuit's failed efforts at implementing product activation technology in some of its consumer products awhile back, it generated a great deal of ill will among consumers by taking a more hard-line approach. Microsoft has decided to implement a softer approach. I think Microsoft wants to play it safe and make sure that its enterprise customers are not caught in a bind because of some activation mixup."

Page 2: Windows Vista SP1 to Disable Activation Exploits

This new approach and the changes delivered through SP1 are only the beginning of the notifications experience for Vista, Kochis said. "We are going to watch closely what happens with this and look to customers for feedback. ... If we find that we need to do more and say more and present more to the end user, we will do that," he said.

However, Microsoft will not consider reverting to the reduced functionality option that had existed until now, he said.

The notifications measure already in place in Windows XP and the anti-piracy features in Vista have been fairly successful in limiting piracy and have been foundational in cracking down on the various ways of bypassing Windows product activation, Kochis said.

In its last fiscal quarter, Microsoft reported that about 5 percent of Windows desktop OEM revenue growth was attributable to declines in piracy. The company has also taken legal action against more than 1,000 dealers of counterfeit Microsoft products over the past year and has taken down more than 50,000 illegal online software auctions, he said.

Microsoft released a Vista update to fight the "Frankenbuild" monster. Read more here.

"Customers who are victims of piracy and the reseller channel stand to benefit the most from this program and push," Kochis said, adding that all copies of Windows Vista will still require activation and the system will continue to validate from time to time to verify that systems are activated properly.

Check out's Windows Center for Microsoft and Windows news, views and analysis.

Peter Galli has been a financial/technology reporter for 12 years at leading publications in South Africa, the UK and the US. He has been Investment Editor of South Africa's Business Day Newspaper, the sister publication of the Financial Times of London.

He was also Group Financial Communications Manager for First National Bank, the second largest banking group in South Africa before moving on to become Executive News Editor of Business Report, the largest daily financial newspaper in South Africa, owned by the global Independent Newspapers group.

He was responsible for a national reporting team of 20 based in four bureaus. He also edited and contributed to its weekly technology page, and launched a financial and technology radio service supplying daily news bulletins to the national broadcaster, the South African Broadcasting Corporation, which were then distributed to some 50 radio stations across the country.

He was then transferred to San Francisco as Business Report's U.S. Correspondent to cover Silicon Valley, trade and finance between the US, Europe and emerging markets like South Africa. After serving that role for more than two years, he joined eWeek as a Senior Editor, covering software platforms in August 2000.

He has comprehensively covered Microsoft and its Windows and .Net platforms, as well as the many legal challenges it has faced. He has also focused on Sun Microsystems and its Solaris operating environment, Java and Unix offerings. He covers developments in the open source community, particularly around the Linux kernel and the effects it will have on the enterprise.

He has written extensively about new products for the Linux and Unix platforms, the development of open standards and critically looked at the potential Linux has to offer an alternative operating system and platform to Windows, .Net and Unix-based solutions like Solaris.

His interviews with senior industry executives include Microsoft CEO Steve Ballmer, Linus Torvalds, the original developer of the Linux operating system, Sun CEO Scot McNealy, and Bill Zeitler, a senior vice president at IBM.

For numerous examples of his writing you can search under his name at the eWEEK Website at


Submit a Comment

Loading Comments...
Manage your Newsletters: Login   Register My Newsletters

Rocket Fuel