Forgot your password?
typodupeerror

64-Bit Vista Kernel Will Be a "Black Box" 402

Posted by kdawson
from the abandon-all-hope-ye-who-ener-here dept.
ryanskev writes with news from RSA Europe, where a Microsoft VP spoke bluntly about the lock-down that will apply to 64-bit Vista. From the article: "Microsoft will operate 64-bit versions of Windows Vista as a tabernacle, with the kernel as the holy of holies, where only its own high priests of security may venture." While Microsoft has seemed to be making some concessions to the likes of Symantec and McAfee, considerable doubt remains as to their ultimate future.
This discussion has been archived. No new comments can be posted.

64-Bit Vista Kernel Will Be a "Black Box"

Comments Filter:
  • by Anonymous Coward on Tuesday October 24, 2006 @08:15PM (#16569960)
    I know this isn't PC to say on Slashdot.. but MS shouldn't allow undocumented hooks to the kernel. Instead they should provide an API for that.
  • I'm confused (Score:4, Insightful)

    by maynard (3337) <[j.maynard.gelinas] [at] [gmail.com]> on Tuesday October 24, 2006 @08:17PM (#16569982) Journal
    Fathi conceeded for 32-bit systems the firm will never have the amount of control over security. He said: "That train has left the station."

    For 32-bit versions of Vista, it'll be mostly as you were on security. Developers will be able to patch the kernel, only now they'll have to compete with Microsoft's own brand anti-spyware, encryption, and anti-spam offerings. Fathi lamented Microsoft had "missed a great opportunity" last time round.

    What's the difference between the 32 bit and 64 bit kernel? And what does a 'tabernacle of security' mean?

    I don't think there's a significant difference in DRM hardware between 32bit and 64bit systems. Why make the distinction? If they're going to secure Windows - why not secure Windows?
  • "Concessions to.." (Score:5, Insightful)

    by MoriaOrc (822758) on Tuesday October 24, 2006 @08:19PM (#16570026)
    Am I the only one who read the line "Making concessions to Symantec and McAffee," and the first concessions that popped into my mind were "Just a little security hole here, buffer overflow there, ect."

    I'm no fan of MS, especially when it comes to their horrible security track record. However, if they really can manage to get it right (or even significantly better) in Vista, they shouldn't be going and making concessions to the people who've been making a living off the things that were broken in their last OS.
  • by ezratrumpet (937206) on Tuesday October 24, 2006 @08:20PM (#16570034) Journal
    Microsoft wants to be responsible for its own security - more importantly, Microsoft wants to reap the financial rewards for becoming responsible for its own security. The personal home user will end up paying a bit more for lack of competition in security software, which won't matter to Microsoft - the real market is corporate sales.
  • Good luck (Score:2, Insightful)

    by gweihir (88907) on Tuesday October 24, 2006 @08:25PM (#16570092)
    Others have tried this before. Never works. Unless it uses trusted hardware, it can allways be run in emulation to facilitate analysis.

    If it uses trusted hardware, then it will have other serious problems, like making virtualisation hard or impossible, something that could make it fail entirely in the market.

    This tough act is just a smokescreen for something else. Hmmm. Do they think they could get around some (e.g. EU) interoperability requirements that way?
  • by 49152 (690909) on Tuesday October 24, 2006 @08:26PM (#16570106)
    Isn't this just another variation of security by obscurity?

    Which everyone by now should have learned does *not* work.
  • by Coopjust (872796) on Tuesday October 24, 2006 @08:27PM (#16570118)
    Either way Mcafee & Symantec will claim that it was needed later, simple business.

    If the new model seems to be secure, Mcafee and Symantec will boast about how they've kept the next generation of Windows safe.

    If the new model is less secure, McAfee & Symantec will "point out" the need for their products.

    Win win for AV companies...
  • by AHumbleOpinion (546848) on Tuesday October 24, 2006 @08:30PM (#16570168) Homepage
    Isn't this just another variation of security by obscurity? Which everyone by now should have learned does *not* work.

    Actually it does work. Where people go wrong is using it as their sole security measure. In concert with various other good practices obscurity is good.
  • by QuantumG (50515) <qg@biodome.org> on Tuesday October 24, 2006 @08:31PM (#16570180) Homepage Journal
    Yeah, and no-one really needs more than 640k of ram.
  • by EmbeddedJanitor (597831) on Tuesday October 24, 2006 @08:35PM (#16570230)
    Just because it is "yours" (debatable point in the case of software), does that mean you should be allowed to modify it? Depending on where you live, you probably are not allowed to do tweaks/mods on various things that you own - including the wiring in your house.

  • by Skowronek (795408) <skylark@una l i g n e d.org> on Tuesday October 24, 2006 @08:35PM (#16570232) Homepage
    I'm running some applications (logic synthesis) that need a few gigabytes of RAM. It's really nice to be address that linearly instead of stuff like highmem.

    So, it's not about the integers, it's about the pointers (logically).
  • by Anonymous Coward on Tuesday October 24, 2006 @08:38PM (#16570262)
    That'll lead to ugly hacks when the developers find that the API either doesn't allow them to do what they need to do, or it's otherwise buggy and needs to be worked around.

    It's enough trouble writing solid modules for the Linux or FreeBSD kernels, and the source code to those is open and widely available. When your module code runs into problems, you can easily see what's going on in other portions of the kernel. It's a very, very useful debugging tool.

    Now take this Vista kernel API you speak of. It'll end up being just like the Win32 API. Often times developers had to resort to undocumented calls in order to get their application to perform a certain task. This sort of shooting-in-the-dark coding leads to bugs and security glitches. Even if you understand 98% of what an undocumented API does, it's that remaining unknown 2% that'll fuck you, your product, and your customers over in the end.

    Reliable and secure software comes from the developers having a complete understanding of the systems they're working with and building upon. By limiting developer access to such knowledge, they'd be directly promoting buggy, insecure software.

  • by EmbeddedJanitor (597831) on Tuesday October 24, 2006 @08:39PM (#16570284)
    Yup. Like parent, I detect MS putting a PR spin on this. They've done this often enough in the past - telling people that the old stuff was crap to get people to but the new.

    Given that Joe Public no longer believes MS has control over security, they need to build some new mental images to sell. 64-bit black boxes sound pretty solid.

  • Sayonara, Symantec (Score:5, Insightful)

    by Cid Highwind (9258) on Tuesday October 24, 2006 @08:43PM (#16570334) Homepage
    There's going to be a kybosh on naughty developers mucking about with the 64-bit kernel; patching will be banned.


    If it will stop crapware like StarForce and the Sony rootkit from sneaking extra drivers in, bring on the kibosh. People who want to tinker can use one of the fine Open Source operating system kernels [kernel.org] that run on 64-bit Intel machines. Those that just want to play games or run Office can feel a little bit safer from malware.

    Sorry Symantec, but after dealing with the disaster that is Norton Internet Security, I won't shed a tear when I read that you've filed for Chapter 7.
  • by postmortem (906676) on Tuesday October 24, 2006 @08:43PM (#16570338) Journal
    Will not go very well, at least in beginning. This enhanced security won't sell it. There won't be drivers for some existing stuff ever. Seems that MS wants to push this version and keep 32-bit as legacy, but in the end when end user can't make it work as well as 32-bit, it is just going to slip and create confusion. In long run it may pay off, when systems and components are designed for 64-bit, until then, 32-bit will be preference. I wonder if any of corporate users are going to put 64-bit on employeees workstations in upcoming months -it seems as a big risk without much gain.
  • by Psykechan (255694) on Tuesday October 24, 2006 @08:44PM (#16570360)
    For 32-bit versions of Vista, it'll be mostly as you were on security
    Translation: You're screwed! Upgrade to 64 bit ASAP (P.S. some of your software won't work)

    Defender has already become the most popular download ever from Microsoft
    If I was MS, I certainly wouldn't brag about anti-malware being the most popular application.

    referring to third parties being able to patch 64 bit Vista - "It's just not the way the box was designed...we're putting a stop to that."
    Great. What happens when MS doesn't quickly put out a patch... no choice on using the good samaritan patches anymore, you just have to sit and twiddle your thumbs.

    referring to ever being able to secure 32 bit Windows - "That train has left the station."
    I think it's more like the Windows train has left the station. Why bother to convert to 64 bit Windows? Switch to something else as soon as possible.
  • by misleb (129952) on Tuesday October 24, 2006 @08:51PM (#16570438)
    Preventing programs and drivers from tampering with internal OS structures is not security through obscurity any more than preventing people on the internet from accessing your computer directly (firewall) is security through obscurity.

    -matthew
  • by Zeinfeld (263942) on Tuesday October 24, 2006 @09:01PM (#16570560) Homepage
    As I understand it, Windows Vista 64bit Edition will simply not allow kernel drivers to load unless they are signed with Microsoft's private key. Which means that you'll need to either exploit kernel bugs to load your own code (which they'll plug eventually) or boot off a CD and patch the kernel files on disk to disable this checking (which will be hard to do without destablizing the whole system). If that's what we're talking about (and I have no idea if it is) how can you possibly be in favour of it? I mean, it sounds like The Right To Read all over again.

    Thats exactly what I want. I do not want to have any software patch the kernel.

    If there is no way for the spyware to patch the kernel I don't need McAfee or Symantec there at all. First thing I do with a new home machine is to strip off the AV software provided by Dell as cramware. Machines run so much faster and more reliably without. Then I turn off AutoRun and hook it up to my internal network which has twin SPI firewalls.

    I have never had a virus but I have had machines go wonky because of buggy AV code.

    I want to have as few kernel mode device drivers as is possible. Printers should not require kernel mode, nor should video cameras etc. Only the bare essentials talking directly to the DMA interfaces should ever use kernel mode.

    I don't need to run my code in kernel space and I don't think anyone else does either.

  • by QuantumG (50515) <qg@biodome.org> on Tuesday October 24, 2006 @09:14PM (#16570694) Homepage Journal
    kernel overflows.. same way you modify a linux kernel after it's had the "no more modules may be installed" bit turned on. See, it's really easy for hackers, they just grab the latest kernel bug that has been found and plug it in to their rootkit. Same with dodgee spyware people. But legitimate software developers can't do that. It'd be unethical.
  • You can bet this is going to make life very hard for the folks like VLC or anyone who wants to do something clever with the audio system. Wonder how they are going to push it, however? Sure, they can go for attrition, and make sure all new machines come with Vista, but there are a lot of Win32 machines out there that have more than enough CPU. There were some big jumps from the 200mhz-600mhz range, but now with 2-3ghz more or less normal and no 'got to have it' devices like USB3 this is going to be a tough sell. Heck, even with DirectX 10 being reserved for Vista, game publishers would be suicide to go after that market for a couple years. While it might give a few more FPS, you can bet the vice-like grip on hardware will doom any of the older games from running on the system... I mean, heck, if you could access the video, you might just try to display content without the secret hardware handshake.
  • Re:I'm confused (Score:4, Insightful)

    by QuantumG (50515) <qg@biodome.org> on Tuesday October 24, 2006 @09:28PM (#16570824) Homepage Journal
    Signed by who though? I have no idea. Is it signed by any code signing certificate issued by Microsoft? How hard is it to get one of those? Sounds like a nice thing for hackers to steal and sell to spyware makers.
  • by the eric conspiracy (20178) on Tuesday October 24, 2006 @09:41PM (#16570948)
    This makes me think of Kid-Proof caps. Only the kids will be able to open the cap to get into the kernel. Users who want to install legit stuff, forget it.

  • by gweihir (88907) on Tuesday October 24, 2006 @09:58PM (#16571088)
    ...but could you cite some examples?

    One thing would be the Xbox hack, although that involved an attack on the hardware as well.

    There are counless successful projects to port Linux to some closed (i.e. black-box) hardware.
  • by tkrotchko (124118) * on Tuesday October 24, 2006 @10:09PM (#16571172) Homepage
    Probably because the 64 bit version will break a lot of code. For example a lot of TV boards write their own drivers (for better or worse) and these won't work. Anything that writes it's own driver or have to get to ring 0 will break.

    So the 32 bit will be if you want anything to run, the 64 bit will be for people who want to play DRM'd content on their PC. Maybe an exaggeration, but I think that's about it.

  • by Anonymous Coward on Tuesday October 24, 2006 @10:09PM (#16571182)
    "Microsoft will operate 64-bit versions of Windows Vista as a tabernacle, with the kernel as the holy of holies, where only its own high priests of security may venture."


    And there are thousands of Philistines, including some very 1337 H4x0r5, at the gates ...

  • by jZnat (793348) * on Tuesday October 24, 2006 @10:14PM (#16571230) Homepage Journal
    It's "Mac", not "MAC". MAC is an acronym: Media Access Control [address] [wikipedia.org]. Mac is short for Macintosh.

    And Apple makes most of its money from selling hardware, so I sincerely doubt they'll drop that and try to squeeze money out of selling an operating system exclusively.
  • by Sloppy (14984) on Tuesday October 24, 2006 @10:25PM (#16571310) Homepage Journal

    The kernel has a reputation for being not particularly bad.

    The reason the kernel is an issue, is that the new "threat" against Windows security is the owner/administrator of the machine. Microsoft needs to try to implement DRM, in order to get into bed with the media companies and sell music and Zunes to play it. You can't implement DRM if the user can patch the kernel to work around the DRM. Thus, they're going to try to prevent end-users from having the capacity to modify this behavior of their own computer.

    The "security companies" are taking collateral damage from this, because their applications have to intercept all reads/writes (to files, the network, whatever) in order to scan all data against a blacklist of known malware [ranum.com] in order to try to protect the comically fragile userspace. This scanning is implemented through kernel patches, I guess.

  • by quanticle (843097) on Tuesday October 24, 2006 @10:37PM (#16571402) Homepage

    firefox kicked their assess with the better browser. Mac could do the same with the better platform.

    How has Firefox "kicked their ass"? I'm not trying to defend IE, but last I saw, it still had nearly 90% of the marketshare. That's the kind of market domination that many companies would kill for.

  • by Chris Burke (6130) on Tuesday October 24, 2006 @10:38PM (#16571408) Homepage
    That's partly true*, but the reason that security through obscurity is derided is because it is typical of a mindset that has implications beyond just using obscurity as a security mechanism on top of other well-formed policies. Very often, obscurity is the only measure used, in large part because of a lack of substantive review of the other security policies that would reveal their endimic flaws. The belief is "what others don't know can't hurt us". Even worse is that "others" is often not "black hats" but "customers".

    The NSA is a good example of an organization that uses security through obscurity well. They employ the best cryptographers and system designers around, but they are also not about to tell anyone how those systems work. If you did know exactly what they were doing, though, you would still find them to be some of the most secure systems anywhere.

    Microsoft, on the other hand, has a history of using obscurity as a method of covering up embarassing security flaws. They do not have a history of having the best security. Do I think that Microsoft intends to hide the internals of their kernel as part of a comprehensive security regime in which obscurity is only the last layer thus making Vista an impregnable fortress, or is this an attempt by Microsoft to squelch competition from other AV vendors under the guise of fixing their tarnished security image? Well, it's obvious what I think. Which do you think it is?

    * The fundamental problem with security through obscurity is that you can't count on it. Either a clever hacker will figure it out, or an insider will leak or exploit information about the system. Your system must be as secure as you know how to make it assuming that your enemy has full knowledge of the system. Only then does layering obscurity on top of that make sense as an additional mechanism. Otherwise it's a false sense of security.
  • by Anonymous Coward on Tuesday October 24, 2006 @10:39PM (#16571414)
    hate to burst your bubble but not retaining emails is the policy of MANY large companies. It is not done purely because they are trying to play dirty, people say stupid things in emails that can easily be taken out of context if you don't know the receiving and sending parties. By ensuring the policy is that old mail MUST be deleted they also don't have a huge burden of searching massive terabytes of mail stores everytime some company or person wants to order them to hand over XYZ emails. PS the burst lawsuit is just yet another example of leech like companies using the law to tie up other companies resources in the hope they will settle. I have no sympathy for scum like them.
  • by IamTheRealMike (537420) <mike@plan99.net> on Tuesday October 24, 2006 @10:46PM (#16571484) Homepage
    Yeah, ok. There's so many things wrong with your world view that I'm having trouble understanding where to start.

    No, Zeinfelds world view is entirely sane and very defensible. I agree with him.

    Let's review a few facts:

    • The collapse of residential computer security has meant that virtually nobody can keep their Windows machine secure anymore. Not even gurus. There are just way too many 0-day exploits for browsers and others out there, even for Firefox.
    • The usage of rootkits on Windows is now a common technique, often used to hide spyware. Once the machine has been rootkitted it is impossible to repair short of wiping the system clean and starting from scratch. But because of the first point, this is not practical.
    • Thanks to the first and second points doing business on the internet is rapidly becoming difficult or impossible. It started with online casinos and porn sites, but is spreading to "clean" business too. How can you run a company when any 16 year old with a botnet can shut you down at a whim?

    The foundation of any security system is the kernel. If the kernel is not running in a known state, you have no security system - period.

    There is absolutely zero point in having user accounts, authentication, file permissions and so on if programs can load code into the kernel ... which they can, because for historical reasons Windows programs require admin rights, and even if they didn't, ultimately any program can ask the user to do something on its behalf and most will.

    The solution is clear - forbid any unknown code from loading into the kernel. Only then can you have a sane system built on solid foundations. It is not a "right to read" scenario, because you can still mark individual drivers as loadable in Vista IIRC if you put it into developer mode (which makes it clear that you are in a special mode), but even if it wasn't, it'd be a price worth paying to help fix the internet.

  • by kerrle (810808) on Tuesday October 24, 2006 @10:46PM (#16571486) Journal
    In fact, rootkits and kernel infesting malware have been on the rise in Windows the last few years, and are much more common than you seem to think.

    Having kernel hooks wouldn't help AV programs detect this if the malware was well written and had already attached itself - you often need to get out of the environment to detect such problems, as with a live CD. After it was infected, anything the kernel reported would be suspect.

    The trick to catching malware is covering the vectors through which it enters the system. No more, no less. The grandparent is spot on as far as I'm concerned.
  • by gelfling (6534) on Tuesday October 24, 2006 @11:00PM (#16571610) Homepage Journal
    64bit Windows will see deployment in the server room on corporate data centers. In this area security is secondary to audit compliance. Server ops will turn on the default Win64 kernel security and it will do whatever it does. Auditors will check the AV box and move on to the next server. Everyone is happy. Server ops has one less thing to do and auditors have an easier job of auditing. I know that's cynical but that's how it works.

    Let's remember that the reason Windows is in the server room in the first place is because MS sold it on the premise that's easier to run. Not faster, not with less hardware, not even with fewer people but with a lower skill set. Cheaper. So embedded security is not about security, it's about skill sets. Set it, forget it, hope for the best. If it smashes on the rocks then everyone did their best anyway and no one can be held accountable.
  • by bruno.fatia (989391) on Wednesday October 25, 2006 @12:05AM (#16572028)
    * Don't use known buggy software
    * Don't run unknown binaries
    Basically the 1st excludes Windows; The second excludes any non-open-source application. Shouldn't you just quit and go take a walk then?
  • by greenbird (859670) on Wednesday October 25, 2006 @12:12AM (#16572070)
    The solution is clear - forbid any unknown code from loading into the kernel.

    Unfortunately that's not the solution Microsoft chose. What they did is make a kernel that will only load code that has been approved by and paid a toll to Microsoft the amount of which is determined by Microsoft. That's vastly different than what you presented as the solution. On my Linux box unknown code is not permitted to load in the kernel but I'm the one who determines what is loaded into the kernel not Microsoft and there is no required payoff to allow code to load into the kernel.

  • by IamTheRealMike (537420) <mike@plan99.net> on Wednesday October 25, 2006 @01:01AM (#16572416) Homepage
    There have been enough zero-day image loader exploits pushed out via advertising networks that you don't have to have done anything wrong or inadvisable to get infected these days.
  • by ultranova (717540) on Wednesday October 25, 2006 @02:42AM (#16573094)

    No, it's subtly different. Microsoft are the gatekeepers because that lets them pull the plug on any kernel code that is found to be malicious.

    And by "malicious" we mean "Disney doesn't like it".

    After all, it's not the user who's being protected here, it's the media corporations Microsoft is trying to sell Windows as a distribution channel to.

    Alternatively, it could be "Provides good native OpenGL acceleration". After all, portable applications would be the death of Windows.

  • by David Off (101038) on Wednesday October 25, 2006 @04:15AM (#16573822) Homepage
    or to paraphrase: Marketing
  • by ajs318 (655362) <sd_resp2 AT earthshod DOT co DOT uk> on Wednesday October 25, 2006 @05:24AM (#16574392)
    The problem with microkernels is that you're putting the "fence" where it looks pretty -- not where it's practical. The appropriate place for the fence is where the minimum amount of data has to cross it, and that's not necessarily where it contains the minimum amount of code.

    Device drivers must, at some level, have a kernel component; because nothing in userland is allowed to talk to I/O ports. Only the kernel can do that. At the very least there must be a kernel component which accepts an instruction to read or write an I/O address and returns a result, via some method which is available to userland software. Of course, if you have a totally generic kernel driver which allows any userland program arbitrary access to any I/O ports without checking, then you have just knocked down the fence altogether. So a kernel driver needs to have at least some sanity-checking built into it.
  • by Lorkki (863577) on Wednesday October 25, 2006 @06:16AM (#16574760)

    The problem is that a black box is always running in an unknown state - it's entirely a trust issue between you and the vendor, regarding the solidity of their authentication methods, security protocols and limitations on execution privileges. If a key is compromised, a way is found to bypass the authentication process or there's a suitably buggy driver, all bets are off again.

    Of course, proclaiming "no unknown code may run in kernel mode" does make security a much simpler issue; you can bet the farm on how the gate holds, instead of putting locks on doors.

  • by Ed Avis (5917) <ed@membled.com> on Wednesday October 25, 2006 @06:21AM (#16574798) Homepage
    I do not want to have any software patch the kernel.
    That's your choice, and since it is your computer you should have the right to decide what gets loaded into the kernel and what doesn't. But what Microsoft is doing is different to that. They are saying that they get to decide what gets loaded into the kernel and what doesn't. So if you or anybody else want to load your own device drivers, you can't. On the other hand, if Microsoft decide that some kernel feature is needed - say, blocking the ability to record sound output to a file - then they can put it in and you have no say in the matter.

    I don't need to run code in kernel space either, but I need to have the right to do so in order not to be held hostage by one particular company that decides what I can and cannot do with my own computer.
  • by ettlz (639203) on Wednesday October 25, 2006 @06:31AM (#16574878) Journal
    Microsoft claimed that Windows NT 3.51 was a microkernel. It wasn't. It wasn't even close. Even they dropped the claim with NT 4.0.
    — Andrew S. Tanenbaum. The microkernel part of NT is so insignificant (basically it's just a message passer, see the ReactOS people's comments) it might as well not be called anything special. There's so much high-level stuff packed into the Executive that it makes NT look even more monolithic than Linux.
  • by phoenix321 (734987) * on Wednesday October 25, 2006 @09:23AM (#16576512)
    You cannot cover all incoming vectors, there's just too many of 'em. And every program you run opens another, no thanks. With the kernel reasonably trustworthy sealed-off from anything, you may have a chance of recovering from any other disaster without re-installing everything but the kitchen sink. Then you can trust the kernel to report processes, file permissions and dir contents correctly, which can then be correctly terminated.

    A compromised kernel allows you neither: dir contents are inaccurate, malware has its processes hidden from the taskmanager, its files from the explorer and whatever deletion requests your antivirus software issues, they're not going to be carried out at all. As long as you can't trust the kernel, everything you try is moot and converse, if you can trust the kernel, you can start repairing the system from secure sources (cdrom, intranet etc.). And since nothing can wedge itself too deep anywhere, repairing and cleaning should be feasible, at least.

There are three kinds of people: men, women, and unix.

Working...