Microsoft Locking Out Anti-Virus Makers?

twitter writes "Anti-virus makers have more to fear than stonewalling by Microsoft if a report by Agnitum, maker of Outpost Personal Firewall, is right about recent trusted computing changes. All the problems were summarized in a choice Register quote, 'In addressing the potential problem of not being able to install Outpost on new versions of Windows, we have discovered that it is possible to drill past the new security measures introduced by Microsoft - if we use the same techniques used by hackers.'"

Microsoft is just isolating itself

[The Real Toad King]

By making its kernel and software more closed, they're just locking out new developers and applications. If they keep this up, Windows may only be able to run Microsoft Software.

Microsoft's Principles?

[pieterh]

So how does this fit with Microsoft's 12 Windows Principles [microsoft.com]?

Oh hang on, nowhere in those principles does it mention anything about giving competitors open access to Windows systems. Maybe this one:

"Microsoft is committed to designing and licensing Windows (and all the parts of the Windows platform) on terms that create and preserve opportunities for application developers and Web site creators to build innovative products on the Windows platform -- including products that directly compete with Microsoft's own products."

Translation: We love products that compete with us, so long as they run on Windows, because it just means you're doing the R&D work for us. Hey, that's how we got to be so large, by taking ideas from other people, so why stop now?

Re:Microsoft is just isolating itself

[DoraLives]

If they keep this up, Windows may only be able to run Microsoft Software.

This is precisely what they're looking to do, and it would appear as if their short-term vision has completely blinded them to the long-term consequences of what they're doing. I wish them all the success in the world with it.

Better Summary

[RightSaidFred99]

"Our software doesn't work, we're pissed."

They are basically saying that they want the existing weak kernel model to continue to be supported because at least it allows them to do things they way they have been for a long time. This is, of course, stupid. It's like my locksmith not wanting me to get a new door because his equipment won't work with it, even if the new door theoretically provides the basis for better security long-term.

I'm not saying the new intercept model is great, I'm saying the answer isn't "leave it like it was". Instead of whining, why don't they engage Microsoft and figure out what exactly they need. Regardless of what your average wanker things, Microsoft will NOT be in a good situation if Vista turns out to be a dud security-wise. They want it to work.

Re:Microsoft is just isolating itself

[RightSaidFred99]

They're not locking anybody out. It's silly to think that developers should have full access to every single internal structure or API call. It's called "bad design principle". It means they can't change things internally.

The real problem may just be limitations in the API they _ARE_ providing. That's fine, work with them on it. Don't whine that their internal structures and kernel level calls are changing - you are NOT supposed to use those anyway.

They Started With Device Drivers

[LaNMaN2000]

Mirosoft started treating device driver that were not 'certified' for Windows XP differently in the installation process. the certification process is expensive and I have had numerous drivers that generated warning prompts because the manufacturers did not pay the Microsoft tax. I had a feeling that it would only be a matter of time before Microsoft created its own 'digital signature' like process for certifying system or application software.

Re:ORly?

[tyler.willard]

Ya RLY. Too easy? At ring 0 *everything* is, and should be, visible/alterable. That's the whole point of ring 0 existing in the first place. There is another concern as well: If Redmond locks out 3rd party security and utility vendors from full ring 0 access they become the only ones able to provide the most powerful utilities and security products. As it stands now, SoftICE has been discontinued and sysinternals has been acquired. I don't particularly relish the idea of having to take MS's word for what's happening down in kernel or having theirs being the only powerful security/utility products availble.

Microsoft can barely keep up with patching IE...

[TheNoxx]

How exactly are they going to keep up with all of the new viruses/trojans/etc released for Vista? I know it's supposed to be "so goddamn secure", but nothing's foolproof, let alone a silly little MS product.

I dread to think how bad the current state of spyware/adware and malicious code would be if MS made themselves the end-all for anti-virus protection in XP. What a monumental fuckup Vista will be.

Re:ORly?

[Anonymous Coward]

It's not just a matter of not having the tools... Trusted Computing hardware allows the running of encrypted code. You'll never know what Microsoft is upto, because your own PC hardware works to stop you.

Old Arguments: Users vs the Monopoly

[buckhead_buddy]

While Linux, BSD, and (past) OSX developers are used to an open kernel, Microsoft has a long tradition of security through obscurity. Microsoft has also not had a problem with rolling over competitors and even collaborators with a lock-out technology when they feel they are in a position to make more money. Those arguments are common and they won't even make a blip on the conciousness of most people.

What would really get Microsoft to pull it's greedy hands out of making "security services" the next extension of its monopoly powers? I think it would be when the Ralph Naders, and liability lawyers take Microsoft becoming the sole provider as admission of making a product with a faulty design and trying to profit from it.

If you want to make Microsoft open it's doors and keep it's hands off the security market, then you need to make noise about this new tactic as being a tacit admission of faulty products and trying to profit from supplying the broken product and the fixes. Perhaps then, Microsoft might be eager to open the kimono for third party or independent review.

Happens every time they change something

[Sycraft-fu]

Prrogrammers are lazy, that's just how it goes. I remember all the Strum und Drang over Windows 2000 and it's new audio model. Basically, MS did a revamp of how audio was handled in 2000. It's a much better model. However it was different from what the pro audio companies were used to so they cryed about it. I had a $600 10-channel pro card at the time. When 2k came out, I wanted to switch. However they had no 2k drivers, you had to install the NT drivers which did work, but were a pain in the ass. They said "There will never be Windows 2000 drivers, 2000 is unsuited to audio."

What they were worked up about was the kernel mixer, a subsystem that introduces 30ms of latency to audio. Now of ocurse this isn't a problem, first because the drivers are aware of this and do time compensation so it only matters for live sound-on-sound recording (meaning you are playing something that a musician is listening to and recording what they are doing) and you can bupass teh kernel mixer anyhow.

Well finally they figured that out (it's in the documentation for the new driver model) and they released a driver... That only supported 2 channels of the 10 on the card. They claimed that the new driver model didn't support more than 2 channels on a card. I e-mailed MS about this and I think they were sufficiently supprised by the stupidity of the question that they responded. they pointed out that not only could they enumerate the device as multiple 2-channel devices (as you had to do in Win98 and NT since they only supported 2 channels) but WDM could handle real multi-channel devices as well.

Some e-mails back and forth with the company and finally they came out with a functioning WDM driver for their card. These days, their cards have ONLY WDM drivers available, they don't support 98 or NT anymore. However it was like pulling teeth to get them to learn the new method of doing things. Not because it was worse, it's not, but because they just wanted to keep doing things how they had in the past.

I'm sure that's basically what this is. MS has changed the way things work, if it's better or not one can debate, but it's not to screw the AV companies over. They are just being whiny because they don't want to have to change the way they do things.

Re:Microsoft is just isolating itself

[kripkenstein]

They're not locking anybody out. It's silly to think that developers should have full access to every single internal structure or API call.

Fair enough. But, consider this: do you really believe that developers of Microsoft security products (firewall, antispyware, OneCare, etc.) will NOT have access to whatever API they ask for? That if they need access to one, a technical solution will not be devised?

Re:ORly?

[staticsage]

The only problem is no matter how many "are you sure this is OK" boxes you throw at some people, they will still blindly click Yes...

Re:Microsoft is just isolating itself

[CodeBuster]

Ok, fair enough, but to what extent is Microsoft liable if your attempted hacking, even if your purpose is noble, results in damage to the kernel? If you use a product or modify that product in a way that the manufacturer never intended then how can you say that it is the fault of the manufacturer that your modifications, hacking, or misuse cause the product to fail? The malware writers will of course do what they want and the anti-virus writers have made it their business to try and stop them. However, the anti-virus writers must accept responsibility for their own products even though they don't fully control the underlying system...that was part of the risk they took when they got into the business.

Hah

[flimflammer]

I love these controversal subject names. Really gives you that "We hate Microsoft and are damn well proud of it!"

The title just smells of "We dont like other anti-virus makers and want to block them", when the real subject is more "We're securing our kernel better than before, making it harder to dig into things people shouldn't be. Work around the changes in our internal api if you want to continue doing the things you do."

I see this as nothing more than making a mountain out of an ant hill.

Re:Microsoft is just isolating itself

[calciphus]

Microsoft never made it difficult / impossible to install a 3rd party media player on any system they've ever made. Nor did they do that with a browser. That's the line fed by money-grubbing anti-trust lawyers to uninformed users.

The primary argument the ACTUAL anti-trust lawsuit was based on was that Microsoft was leveraging the dominance of one product to the advantage of the other, giving it an "unfair competative advantage". The fact that Windows Media Player came pre-installed made paying for a product like Real Networks's RealPlayer (a particualry crappy piece of software, I might add) very unlikely for the average user. When WMP moved from being just a basic media player to including things like playlists, internet streaming (before it was called 'podcasting') and visualizers, it became a competitor for programs like WinAmp and RealPlayer. Anti-trust lawyers argued somewhat successfully that this amounted to Microsoft unfairly leveraging market dominance and discouraging competition.

Now, YOU have no problem arguing that Apple is somehow above this. Let's look at the iPod: Clearly the market leader in mobile media players, they REQUIRE you to install iTunes to load music onto it. They even go so far as to SUE other companies that make software that can download to the iPod (see: RealNetworks, WinAmp iPod plugin, etc). It isn't even for DRM stuff. Just transfering unencrypted files to and from an iPod constitutes a crime (according to Apple legal) if you aren't using iTunes. //technically// using the Windows Explorer to do so is a violation of the "terms and agreements" you apparently agree to when you buy an iPod.

So get off your high horse, Mac Zealot. All that's white and cheap plastic isn't gold.

Re:ORly?

[cheater512]

And the more boxes you throw at them the less likely they are to read it.

/me makes a automatic 'Yes' clicker and sells it for $10.