Slashdot Log In
Security Firm Bypasses Patch Guard
Posted by
kdawson
on Sat Oct 28, 2006 02:19 PM
from the routing-around-it dept.
from the routing-around-it dept.
filenavigator writes, "This week the security firm Authentium found a workaround for Patch Guard, the security feature Microsoft has embedded into the 64-bit version of Windows. It is supposed to keep out unsigned drivers, kernel modifications, and security company competitors. With Authentium's workaround it can be turned off, software installed, and turned right back on. Microsoft immediately responded by saying their reckless ways are endangering the security of Windows users and that they will disable this hack quickly."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
The Aura of Patchiness! (Score:2, Funny)
Reckless? (Score:5, Insightful)
Spelling correction. (Score:5, Funny)
Parent
Re:Spelling correction. (Score:4, Funny)
Parent
Backasswards compatibility (Score:3, Insightful)
It would seem to me that backwards compatibility is, once again, a security hole.
Re: (Score:3, Informative)
Re: (Score:3, Insightful)
As a security company, Authentium ought to know how to handle exploits properly. Presumably if they had a trusting relationship with Microsoft, they'd let them know about it quietly. Instead, they announced it publicly, using it as a bargaining chip against Microsoft in case it reneges on its promise to provide adequate APIs for security vendors.
M
Reckless (Score:2, Insightful)
Let it be said again. (Score:4, Insightful)
If Microsoft hadn't been so assholeish about it, no one would have needed to circumvent their "protections".
LK
Re: (Score:2)
Re:Let it be said again. (Score:5, Insightful)
Parent
Re:Let it be said again. (Score:5, Insightful)
Parent
Re: (Score:3, Insightful)
Politeness (Score:5, Funny)
Rather nice way to say "Thanks, we will fix this right away" eh?
'obvious' bug. (Score:4, Interesting)
If such an obvious bypass has not been considered, how many other such issues exist that are yet undiscovered?
Then, the supposed 'fix' is to disallow writing raw disk sectors for any non kernel code. This will only work when not allowing for things like disk editors and recovery tools, because those would need ways to bypass this and this just opens up new attack vectors.
MS PhotoEditor will outperform Adobe by 100x (Score:5, Insightful)
Yeah, sure it is a far fetched conspirational theory. Mods, before you mod it troll or offtopic or wierd or paranoid, take a look at the comments in the code outed by MainSoft. Obsolete version of Windows NT code. But it had numerous comments like, "Private entry point for Jim to get Excel access memory faster". Private entry points, calls that take shortcuts through several application layers and protocols... that is how security holes are made. Such close nexus between application coders and OS coders is the reason why such api-layers are violated.
Parent
Re:MS PhotoEditor will outperform Adobe by 100x (Score:5, Informative)
PatchGuard is only there to discourage apps that hook the syscall table (an inherantly unsafe operation) and make other modifications to the kernel's private, volaitle internal interfaces. When Windows NT was written, the MS devs never expected 3rd party devs to go poking around with the kernel's private interfaces, and are rightly disgusted when those 3rd party software programs cause problems because of it. Compare this to Linux: you are free to maintain your own custom build of the kernel, but in the mainline, all the kernel interfaces are so volaitle, every minor revision is binary incompatible with the rest. You'd never get a device driver accepted into the mainline if it depended on private interfaces that break every revision, even on a source level. Microsoft is well within their prerogative to make changes the Windows kernel's internal, private interfaces. This doesn't work too well when 3rd party apps are dependent on them never changing, especially when Windows crashes because of it. PatchGuard is a technical speed bump to make it harder for 3rd party software companies to screw with the kernel's internals. Microsoft knows that it's an unwinnable arms race [msdn.com], but hope that the 3rd parties will decide it's just easier to stick to the kernel's public interfaces. Microsoft is willing to create new stable public interfaces to support the necessary behavior.
The only thing I can think of that you might be talking about for reduced performance is if you meant no intermediate buffering when you said "direct disk write". The FILE_FLAG_NO_BUFFERING and FILE_FLAG_WRITE_THROUGH [microsoft.com] buffering options are unrelated to direct disk access (which actually means bypassing the filesystem to access the block device directly). Write through and unbuffered IO aren't going anywhere.
As for special hooks that MS applications get into the OS that no one else gets, how about an actual example?
Parent
Remember what "security" means (Score:5, Insightful)
To users, security is about protecting the machine from external threats.
To Microsoft, security is about protecting the machine from everyone, including the owner and admin.
To users, security is about protecting the user's personal data and ability to use the machine.
To Microsoft, security is about protecting someone's data (not necessarily the user's) from everyone (perhaps including the user).
To the computer's owner, the machine is entirely their own domain, and exists for their own benefit to maximize their own interests.
To Microsoft, the machine is partitioned and not all of it belongs to the owner, ultimately to maximize Microsoft's interests.
To the computer's owner, their relationship to Microsoft is that the computer owner is the customer.
To Microsoft, their relationship to the computer's owner, is that the owner is both a customer and a product.
Re: (Score:2)
Re: (Score:2)
To Microsoft, security is about protecting someone's data (not necessarily the user's) from everyone (perhaps including the user).
the population of the US is 300 million.
at any given moment there must be millions of users running a PC without advanced skills or technical support. no help desk. no system adminstrator. no geek living next door with a clue to what has gone wrong and how to fix it.
in that co
Banging head against cement.... (Score:2)
1. Microsoft historically cannot secure it's own operating system.
2. Microsoft wants to charge for securing it's operating system.
3. Microsoft makes it difficult for *others* to secure it's operating system.
Yeesh...
1. Ford historically makes cars that explode.
2. Ford wants to charge extra for a car with "
Re:Banging head against cement.... (Score:4, Insightful)
Parent
Re: (Score:2)
But if you actually use their OS it makes no sense because the fox is guarding the chicken coop.
Re: (Score:2, Funny)
1. Uncle Ben [unclebens.com] historicly produces meals that make me constipated. 2. Uncle Ben wants to charge extra for meals that wont make me constipated. 3. Uncle Ben makes it hard for others to take a shit.
The conclusion: (Score:3, Insightful)
RTFA! (Score:2)
Anyways, good riddance that this company found another way around...
Re: (Score:2)
Next time I'll be more careful. [wikipedia.org]
Obscurity... (Score:3, Interesting)
If you can package it to put it into a black box, someone's either going to open it, poke at it for a response, or figure out how to replace it. And especially with computers, they'll figure out how to use it in a more general way than you intended.
If you cannot accept that your ideas, no matter how big or well-crafted, are just a part of the greater ocean of ideas, then as long as your ideas can be used, your ideas are going to be swept away against your wishes. Until the nature of humanity is changed, that is the nature of the way we deal with ideas (and thus software/hardware). I personally find much more comfort in that dynamic than pain - there are many more ways to use that dynamic rather than fight against the ocean, so to speak.
Ryan Fenton
Bit of a stretch (Score:3, Interesting)
Re: (Score:2)
Wait, wait. . . (Score:2, Insightful)
Re: (Score:2)
Funny thing is that it's useless, it won't stop people from copying data or emulating hardware.
At least not until the hardware itself is able to recognize Windows and refuse to run everything else. And even then, it is a hard problem to solve.
Re: (Score:2)
Dear Microsoft... (Score:2)
Seriously, did they think this wouldn't be broken? This has become a bad joke. Big company uses software to protect their code, rag tag team of coders breaks it, big company throws a hissy fit, we all laugh at and mock the company.
How many more times must this happen before someone at one of these megalithic corporations realizes all they're doing is reinventing the wheel over...and over...and over again?
Nice Anti-Microsoft blurb - good job, editors (Score:5, Informative)
Uhm. Yes. According to -some- security company competitors whose entirely livelihood depends on Windows being as insecure as it is? Certainly not according to Microsoft itself.
"Microsoft immediately responded"
really?
Microsoft doesn't respond anywhere in that article. In fact, page 2 (yes, it's one of THOSE articles) specifically reads:
"Microsoft representatives didn't immediately respond to calls seeking comment on Authentium's move."
So where -did- they respond?
"by saying their reckless
and that whole article doesn't contain the word 'reckless' at all. So where did they say this, again?
Mind you, the article itself is in error when on page 2 it states:
"Next Page: Microsoft defends itself."
And when you get to page 3, you get:
- a symantec spokesperson
- an industry watcher, possibly:
- Andrew Jaquith of Yankee Group
But absolutely no Microsoft. So where is Microsoft defending itself?
Don't get me wrong, I think PatchGuard probably has more holes than a slice of Swiss cheese... but the submitter's text needs redacting, and the original article could do with an -actual- statement from Microsoft.
The Microsoft statement is behind the other link (Score:3, Informative)
Perhaps this link was added to the slashdot summary after you posted your comment for all I know, but the slashdot summary that I read had two links, and I found that statement quite clearly after following the first link [intelliadmin.com]. About the 13th paragraph down in that article states, complete with the
This ranks with WMP crack (Score:2)
thoughts on patchguard (Score:5, Insightful)
Also, a lot of people are really talking it up about how Microsoft sucks and patchguard is just another flawed attempt at security by a company that doesn't know its ass from its elbow (or something to that nature)...but I haven't seen much if any effort by any of the other mainstream OSes to prevent kernel patching at all. It is downright trivial to write a Linux kernel module which hooks all sorts of critical data structures, same with FreeBSD and Solaris.
Is it the argument of the anti-patchguard people that if it can't be done perfectly, lets not even bother?
I guess the major driving point of my being a Microsoft apologist in this case is that, at least from an academic point of view, the kernel is supposed to be the only software which accesses these low level things and abstracts out interfaces for the rest of the software to utilize...the kernel shouldn't be exposing anything like direct disk access, or kernel space memory to user space....ever, under any circumstances. do that and things like rootkits are an awful lot harder to make in the first place.
Some Linux distros are starting to get the point by limiting and sometimes eliminating entirely access to
The way I see it, Microsoft may not be perfect, but at least they are trying.
proxy
Seriously (Score:2)
Re: (Score:3, Informative)
Nope,
I can build my Linux kernel without module support. Your module is not going to get loaded.
Enjoy,
Re: (Score:3, Informative)
Eivind.
Re: (Score:3, Funny)
That might fix a few Windows kernel bugs, but imagine the hordes of new bug reports you'd see instead:
"I want to start Excel, but it's in the Arathi Highlands and I keep getting PKed by a level 60!"
Biased story submission, (Score:3, Informative)
But the article reads differently. "Microsoft representatives didn't immediately respond to calls seeking comment on Authentium's move. O'Donnell said that Authentium has informed Microsoft of its work, and that the software company asked it to abandon the tactic and wait for its new APIs
Patch Guard according to Sophos (Score:2)
This posting itself only provides a direct link to a Sophos article, and does not indicate any opinion on the subject, either of mine or of my employer (whomsoever that may be - which I'm not telling you).
Unsigned drivers necessary for now (Score:2, Informative)
Best. Grammar error. Ever. (Score:2)
This is why God invented ambiguous references:
Microsoft immediately responded by saying their reckless ways are endangering the security of Windows users
Finally, admission of guilt.
Re: (Score:2)
Last time I checked anyone could write a driver for Darwin/MacOS X. No need to pay a $500 privilege to do so.
Re: (Score:3, Informative)
Sure, 64-bit means a memory cap so high it is very unlikely you will ever reach it, but what is the highest one machine is going to have? 8GB? 16GB? Even with that much memory, a paging file can sometimes increase performance. It may be because of architectural design faults. At one point L
Re: (Score:2, Interesting)
Some applications need a lot of RAM, but not all at once. So if they don't do a lot of page-outs, they are actually put a much less significant load on the overall system than the same applications would if they had to store their entire state in physical RAM.
Re: (Score:3, Insightful)