Security Firm Bypasses Patch Guard 122
filenavigator writes, "This week the security firm Authentium found a workaround for Patch Guard, the security feature Microsoft has embedded into the 64-bit version of Windows. It is supposed to keep out unsigned drivers, kernel modifications, and security company competitors. With Authentium's workaround it can be turned off, software installed, and turned right back on. Microsoft immediately responded by saying their reckless ways are endangering the security of Windows users and that they will disable this hack quickly."
Reckless? (Score:5, Insightful)
Reckless (Score:2, Insightful)
Let it be said again. (Score:4, Insightful)
If Microsoft hadn't been so assholeish about it, no one would have needed to circumvent their "protections".
LK
Remember what "security" means (Score:5, Insightful)
To users, security is about protecting the machine from external threats.
To Microsoft, security is about protecting the machine from everyone, including the owner and admin.
To users, security is about protecting the user's personal data and ability to use the machine.
To Microsoft, security is about protecting someone's data (not necessarily the user's) from everyone (perhaps including the user).
To the computer's owner, the machine is entirely their own domain, and exists for their own benefit to maximize their own interests.
To Microsoft, the machine is partitioned and not all of it belongs to the owner, ultimately to maximize Microsoft's interests.
To the computer's owner, their relationship to Microsoft is that the computer owner is the customer.
To Microsoft, their relationship to the computer's owner, is that the owner is both a customer and a product.
The conclusion: (Score:3, Insightful)
Re:Banging head against cement.... (Score:4, Insightful)
Wait, wait. . . (Score:2, Insightful)
Backasswards compatibility (Score:3, Insightful)
It would seem to me that backwards compatibility is, once again, a security hole.
MS PhotoEditor will outperform Adobe by 100x (Score:5, Insightful)
Yeah, sure it is a far fetched conspirational theory. Mods, before you mod it troll or offtopic or wierd or paranoid, take a look at the comments in the code outed by MainSoft. Obsolete version of Windows NT code. But it had numerous comments like, "Private entry point for Jim to get Excel access memory faster". Private entry points, calls that take shortcuts through several application layers and protocols... that is how security holes are made. Such close nexus between application coders and OS coders is the reason why such api-layers are violated.
Wayback Machine... (Score:1, Insightful)
I haven't had a machine with one of those in at least 5 years. I also don't have a 5 1/4" floppy drive anymore. Both turn a modern dual-core machine into an Apple ][e class machine.
In all seriousness, why is this even supported in 64bit Vista?
Memory is no longer a constraint in a 64bit system. If you can afford $450+ (widely leaked price) for the non-crippled Vista, you can afford the RAM. And if you're running a server, paging = death, even when using 15k RPM drives.
Re:Let it be said again. (Score:5, Insightful)
Re:Reckless? (Score:3, Insightful)
As a security company, Authentium ought to know how to handle exploits properly. Presumably if they had a trusting relationship with Microsoft, they'd let them know about it quietly. Instead, they announced it publicly, using it as a bargaining chip against Microsoft in case it reneges on its promise to provide adequate APIs for security vendors.
Microsoft, on the other hand, didn't say "thanks for letting us know, so we can patch it - just make sure you disclose the information in the proper way". Instead they're quoted as asking Authentium to "abandon the tactic" - clearly they view the very existence of the exploit as an embarrassment, even as a threat, and don't expect Authentium to play friendly and just hand over the details.
Ideally, the two companies should be working together against malicious software writers to secure users' computers. Seen from that point of view, isn't the whole situation a little weird?
thoughts on patchguard (Score:5, Insightful)
Also, a lot of people are really talking it up about how Microsoft sucks and patchguard is just another flawed attempt at security by a company that doesn't know its ass from its elbow (or something to that nature)...but I haven't seen much if any effort by any of the other mainstream OSes to prevent kernel patching at all. It is downright trivial to write a Linux kernel module which hooks all sorts of critical data structures, same with FreeBSD and Solaris.
Is it the argument of the anti-patchguard people that if it can't be done perfectly, lets not even bother?
I guess the major driving point of my being a Microsoft apologist in this case is that, at least from an academic point of view, the kernel is supposed to be the only software which accesses these low level things and abstracts out interfaces for the rest of the software to utilize...the kernel shouldn't be exposing anything like direct disk access, or kernel space memory to user space....ever, under any circumstances. do that and things like rootkits are an awful lot harder to make in the first place.
Some Linux distros are starting to get the point by limiting and sometimes eliminating entirely access to
The way I see it, Microsoft may not be perfect, but at least they are trying.
proxy
Re:Wayback Machine... (Score:1, Insightful)
Swap
If you have memory in abundance, put a first priority swap onto a RAM disk and a small secondary one on a hdd. This gives the advantages of a fast swap, at the cost of real RAM, with the advantage of the OS managing it like swap, and enough memory for your usual needs.
Re:Wayback Machine... (Score:3, Insightful)
Re:Let it be said again. (Score:5, Insightful)
Re:Let it be said again. (Score:3, Insightful)