Please create an account to participate in the Slashdot moderation system

 


Forgot your password?
Close
typodupeerror
×
Microsoft

Microsoft Pushes for Windows Changes After CrowdStrike Incident 86

Posted by msmash from the how-about-that dept.
In the wake of a major incident that affected millions of Windows PCs, Microsoft is calling for significant changes to enhance the resilience of its operating system. John Cable, Microsoft's vice president of program management for Windows servicing and delivery, said there was a need for "end-to-end resilience" in a blog post, signaling a potential shift in Microsoft's approach to third-party access to the Windows kernel.

While not explicitly detailing planned improvements, Cable pointed to recent innovations like VBS enclaves and the Azure Attestation service as examples of security measures that don't rely on kernel access. This move towards a "Zero Trust" approach could have far-reaching implications for the cybersecurity industry and Windows users worldwide, as Microsoft seeks to balance system security with the needs of its partners in the broader security community.

The comment follows a Microsoft spokesman revealed last week that a 2009 European Commission agreement prevented the company from restricting third-party access to Windows' core functions.
This discussion has been archived. No new comments can be posted.

Microsoft Pushes for Windows Changes After CrowdStrike Incident More

Microsoft Pushes for Windows Changes After CrowdStrike Incident

Comments Filter:

  • False (Score:5, Informative)

    by drinkypoo ( 153816 ) <drink@hyperlogos.org> on Friday July 26, 2024 @10:13AM (#64657274) Homepage Journal

    The comment follows a Microsoft spokesman revealed last week that a 2009 European Commission agreement prevented the company from restricting third-party access to Windows' core functions.

    No, the agreement prevented the company from restricting third-party access to Windows' core functions as long as they themselves were using them for competing products.

    If Microsoft wants to restrict access to those core functions from themselves as well then they can absolutely do that.

    • What you seem to be missing is MS wouldn't have allowed their drivers to download unverified defs that caused half the world to experience major outages. This is why MS should be able to reject third party drivers that - for example - download shit from the Internet.

      • "MS wouldn't have allowed their drivers to download unverified defs that caused half the world to experience major outages."

        Are we talking about the same company? The very same week they pushed a Windows update that caused me to have downtime AGAIN, just a few days after I had to go in to the office to have the Clownstroke problem fixed. It also could not be fixed remotely.

        • You are not the Internet. I can't think of an MS rollout this bad. It's pretty much impossible because half their customers block automatic updates.

      • What you seem to be missing is MS wouldn't have allowed their drivers to download unverified defs that caused half the world to experience major outages. This is why MS should be able to reject third party drivers that - for example - download shit from the Internet.

        I think Microsoft can refuse to endorse drivers that do things like that. There is an MS driver signing program called Windows Hardware Quality Labs that requires third party driver authors to jump through some hoops and subject their code to Microsoft's scrutiny -- and Crowdstrike's driver was WHQL certified, which means it had Microsoft's explicit stamp of approval as trustworthy. They should not have done that, IMO, not without requiring rigorous proof that the downloadable bytecode interpreter was inca

        • MS doesn't know their driver is doing something like that. MS doesn't have the time/resources to examine each driver in depth. CrowdStrike runs the HLK tests and then submits their driver package. Microsoft probably just does some basic analysis to make sure it is not malware.

    • Re: (Score:2)

      by gweihir ( 88907 )

      Obviously. But all the moronic assholes that deeply believe their chosen God Microsoft can do not wrong have to find some lie to make it so. Hence they claim crap like that.

    • If Microsoft restricts both themselves and competitors from low-level kernel access, they would've made Windows into less of a general-purpose operating system, so I'd prefer if they didn't.

      The real failure here was CrowdStrike releasing untested updates to a file loaded by a low-level kernel module/driver. MS seems to want to start locking down Windows and isn't letting a crisis go to waste.

  • Liability (Score:5, Insightful)

    by Dan East ( 318230 ) on Friday July 26, 2024 @10:18AM (#64657290) Journal

    It seems to me that this absolves Microsoft of a lot of liability. If 3rd party software has low-level enough access to the OS to make the OS non-functional, then either that software, and / or the people that made the decision to install that software, bear the actual liability.

    Now, the public perception and optics of the thing is something else entirely, as this was reported in the news as "Microsoft Windows" products failing at first, and not blaming CrowdStrike initially (as that detail wasn't really known).

    • Just as an example of the kinds of software Microsoft could produce if it had sole and exclusive access to its own OS's internal functions. Indeed, no software on the planet could compete with Microsoft's software if Microsoft exclusively is permitted and able to use the core functions of the MS-Windows OS. Office is already the de facto standard for word processing and spreadsheet creation in the MS ecosystem; this would absolutely let Microsoft complete the vendor lock-in Bill Gates was always seeking b

      • Re: (Score:2)

        by tlhIngan ( 30335 )

        Just as an example of the kinds of software Microsoft could produce if it had sole and exclusive access to its own OS's internal functions. Indeed, no software on the planet could compete with Microsoft's software if Microsoft exclusively is permitted and able to use the core functions of the MS-Windows OS. Office is already the de facto standard for word processing and spreadsheet creation in the MS ecosystem; this would absolutely let Microsoft complete the vendor lock-in Bill Gates was always seeking bef

  • WAAHH " The EU will just have to let us lock our rivals out via uncompetative pactices again

    • oh like apple is doing for macs, iphones. And samsung is doing for their phones? e fuses, locked bootloaders, and proprietary firmwares.

      no linux alloed there either... lol double standards much? there are more phones in the world than windows PCs, and they are all arguably computing devices.

      • When you're a convicted monopolist, you are held to a different standard. Although Apple and the other phone makers SHOULD have unlocked bootloader's. https://en.m.wikipedia.org/wik... [wikipedia.org]

        • I don't like this argument. It's still not OK to follow monopolistic, anti-competitive business practices even if you haven't yet been convicted of anything related in court. The world of Big Tech is increasingly dominated by products with surrounding ecosystems and online services that are doing everything they can to trap users inside their walled gardens. This isn't in the best interests of anyone except the Big Tech companies who succeed in doing so.

      • Apple's behavior on phones is inexcusable, and the EU is finally working on fixing that too.

        You can install whatever you want on a Mac. Not sure what you're on about there.

        • My inclusion of Mac is because macos allows no kernel access from user space, and the driver ecosystem is more tight.

          my argument is thus: systems with tighter restriction have less malware. full stop. no moral judgments. Security will always be counter to freedom. no argument there.

          If you care about freedumb, you like old westerns bank robberys, crypto scams, popup ads, school shootings etc. all for it. go linux and unlocked hardware.
          If you like law and order, lockdown and restriction is proven to really be

    • windows store only! (we will allow win32 apps) & no censorship!
      adult only games allowed as well.

  • NT4 (Score:5, Informative)

    by neilo_1701D ( 2765337 ) on Friday July 26, 2024 @10:24AM (#64657308)

    BS by Microsoft.

    In Windows NT up until 3.51, drivers lived in user space. Because of perceived sluggishness of NT, in NT 4 drivers moved into kernel space. This gave a performance boost, but at the cost of system stability. In the book "Showstopper", Dave Cutler (architect of NT) railed against this sort of thing precisely because of the instability it allowed.

    macOS absolutely prohibits anything other than Apple code running in kernel space, yet CrowdString's Falcon operates there just fine.

    CrowdStrike caused the disaster, for sure. But Microsoft laid the foundation for this disaster back in 1994.

    • Dave Cutler (architect of NT) railed against this sort of thing precisely because of the instability it allowed.

      ....and yet most drivers in Linux live in kernel space and it is very stable. Perhaps Windows should require drivers to be Open Source and then more people woud be able to find and fix the bugs?

      • Re:Linux (Score:5, Informative)

        by cbm64 ( 9558787 ) on Friday July 26, 2024 @11:06AM (#64657420)

        ....and yet most drivers in Linux live in kernel space and it is very stable.

        Well, Crowdstrike did the excact same thing to Linux servers earlier this year, sending them into kernel panic. https://www.tomshardware.com/s... [tomshardware.com]

        • article answered my question:

          ```
          Linux users do seem to have more recourse for issues like this - including switching to an eBPF "User Mode"
          ```

          "what does Crowdstrike need that they can't get as root?"

          Sounds like a userland daemon is just fine.

          Sure, some extra CPU processing perhaps but unless you're an actual router that's probably fine.

          • Linux users do seem to have more recourse for issues like this - including switching to an eBPF "User Mode"

            That is senseless garbage from Tomshardware. Firstly users do not get a choice of how software is implemented. It's left up to the companies who do it.
            Secondly CrowdStrike does use eBPF. And it was precisely their eBPF process which triggered a kernel panic https://access.redhat.com/solu... [redhat.com]

        • Re: (Score:1)

          by Anonymous Coward

          ....and yet most drivers in Linux live in kernel space and it is very stable.

          Well, Crowdstrike did the excact same thing to Linux servers earlier this year, sending them into kernel panic. https://www.tomshardware.com/s... [tomshardware.com]

          That ended up being a Linux kernel bug that Crowdstrike found and a patch has fixed (thanks to the Register for the links):
          https://news.ycombinator.com/i... [ycombinator.com] +
          https://github.com/torvalds/li... [github.com]

          CrowdStrike Engineering identified a bug in the Linux kernel BPF verifier, resulting in unexpected operation or instability of the Linux environment. In detail, as part of its tasks, the verifier backtracks BPF instructions from subprograms to each program loaded by a user-space application, like the sensor. In the bugged kernel versions, this mechanism could lead to an out-of-bounds array access in the verifier code, causing a kernel oops.

          So no - not the same problem Microsoft has due to completely different operating system design.

    • Oh, so third party GPUs on x86 MacOS don't use third party kext's?

      Apple silicon MacOS doesn't need third party kernel drivers any more because they have no significant high bandwidth third party peripherals any more. I don't relish them having that level of monopoly over the hardware operating in their ecosystem.

      • Oh, so third party GPUs on x86 MacOS don't use third party kext's?

        Not since Big Sur, which deprecated that entire system. That update played havoc with all anti-virus software, even though they knew this change was coming.

        • Why are all the x86 drivers still kext's then? It's not like they gave Apple the source code, these are third party kernel drivers regardless of signing.

  • This looks bad for Microsoft and Cloudstrike, so microsoft, being microsoft, said let's lock that door and do it ourselves

    • like every other vendor in the space. Apple and all phone manufacturers give the user ZERO access to kernel space and most not even root privileges.

  • Yeah, this isn't gonna work for 10000 reasons. Anyway, Linux sitting there like "lol, docker images"

  • Fun times... (Score:5, Insightful)

    by Junta ( 36770 ) on Friday July 26, 2024 @10:42AM (#64657348)

    Brace for Microsoft to "let no good crisis go to waste". Fully expecting the "only acceptable solution" to coincidentally align with some other business objectives.

    • Brace for Microsoft to "let no good crisis go to waste". Fully expecting the "only acceptable solution" to coincidentally align with some other business objectives.

      And why not? Just go back over the last few days of Slashdot comments to see the people demanding that Microsoft do something about it, even though the only thing they can do is limit your access to the OS further locking down and Appleifying Windows.

      I'm not surprised people called for it. I'm surprised at the number of people *ON SLASHDOT* who called for it seemingly unaware of the consequences of what they are asking.

      • Re: (Score:2)

        by Junta ( 36770 )

        If you dig into the nuance, you might find fairly mild tweaks that accomplish the goal.

        At a high level, if Windows eBPF provides the facilities required for their own security software as well as competitors, then that would suffice to address the needs, perhaps together with blacklisting all traditional kernel extensions including their own that no longer need to be done that way.

        Now it was "just an example", but jumping straight to Azure connected implementation as an example gives me pause for concern as

    • This strategy is often the only way to get "hard" but important changes to be accepted.

  • 1) First create a Linux desktop shell that mimic the Windows one.

    2) Enhance the wine to include every hidden api call.

    3) sell the new and improved windows OS

    4) Profit

    • Re: (Score:2)

      by tepples ( 727027 )

      2) Enhance the wine to include every hidden api call.

      That would more or less depend on ReactOS. Wine is built to run user-mode applications, which makes the entire driver interface a "hidden API call" from the point of view of the application. Case in point is that Wine cannot run Apple Mobile Device Service, the component of iTunes that connects to an iPhone or iPad and allows transferring music to the device's music library, because it incorporates a device driver for iPhone and iPad.

      • Microsoft has compromised backwards compatibility sufficiently that Wine has a lot less distance to go before it will be able to run as much old Windows software as Windows does.

        All that's therefore really needed is enough improvements to Wine and enough changes to Microsoft's runtimes to meet it somewhere. If you want to run very old Windows software on Linux, you can do it the same way you now have to do it on Windows: Run it in a VM. Microsoft has previously supplied their operating system for this purpo

  • allow bit locker auto unlock in safe mode? auto rollback / auto disable crashing kernel mods?

    • allow bit locker auto unlock in safe mode? auto rollback / auto disable crashing kernel mods?

      In short, yes. Snapshot functionality should be used for every update which has the potential to break the system. It is already there in the system and used for updates and driver installs. This software may interfere with its function in this circumstance, in which case it should be improved so that this is not possible. And any kernel driver which self-updates should not only be required to use it, but should also be allowed no mechanism to self-update which does not make use of it.

  • Why does MS need to make changes ? Didn't the say it was the fault of the EU.

    https://www.yahoo.com/news/microsoft-says-eu-blame-worlds-145503555.html

    Did Microsoft lie ? Looks like it

  • Every so often, I see Microsoft do something regarding Windows security. The driver model changing in Vista, which made sense. However, there are things like the AI based app scanner that came out a year or two ago, in addition to AuthentiCode signing.

    So, VBS Enclaves are taking a page from Qubes OS, as well as shielded VMs and running shielded VMs in a protected memory space, this sets up a fence, but if the OS is compromised, a keylogger and something grabbing screenshots could exfiltrate or modify what

  • You want resilience? (Score:5, Insightful)

    by devslash0 ( 4203435 ) on Friday July 26, 2024 @11:26AM (#64657482)

    Disable forced automatic updates for everyone. Let people choose if and when their business is ready to perform updates. This is the biggest threat to resilience modern software is facing these days.

    • That's the entire business proposition of CrowdStrike. They sell themselves as a service you can outsource these decisions to. If you don't want this kind of support, you can just use MS Defender, which does allow you to hold back such change until you can vet them.

    • Disable forced automatic updates for everyone. Let people choose if and when their business is ready to perform updates.

      This is first line security software. Businesses will voluntarily force the update ASAP on everyone. Not doing so opens them up to zero days. The problem here is that the fault could be triggered by simple algorithmics. Crowdstrike already gives businesses the option of when to update *the software*. Windows already gives users the option to delay windows updates, and businesses full control of how to apply windows updates.

      But virus definition files, network analytics, and similar threat detection systems r

      • Not doing so opens them up to zero days. Was I born yesterday? Doesn't a zero day mean you were open to the risk the whole time, but then wait for the patch to be available? I bet the reboots for this CrowdStrike update weren't even important, it was probably just routine bug fix/features for their software, not even the core OS.

        • Doesn't a zero day mean you were open to the risk the whole time, but then wait for the patch to be available?

          Yes, which you then apply the moment it comes out. This is basically how network and malware security work. You identify something in the wild (zero day attack) and roll out an update to address it straight away.

          We're not talking about software bugs here.

    • If you're running a security tool without updating it regularly, you may as well just uninstall it, as it's not going to do you a lot of good without updates to handle whatever the latest and greatest threats are (which were specifically designed to bypass the previous version).

      If I understand correctly for this crowdstrike incident, the issue was not a new version of the software, just a new version of the data package that it uses, which in turn caused the old/existing version of software to crash. I d
    • You can already disable forced automatic updates through group policy.
  • "This move towards a "Zero Trust" approach" Well there goes Microsoft's business model.
    • "Zero Trust" really just means don't trust anyone except ourselves. In Microsoft's case it means don't trust the administrator / device owner, work against them. Fun fact, neither work out in practice because one person does not equal a society, and owners dislike property ordering them around.

      Which goes doubly so for computers due to the fact that very few individuals have the knowledge to, much less actually, build a full system from the silicon to the apps. Modern computing is a collaborative work by
  • > Cable pointed to recent innovations like VBS enclaves and the Azure Attestation service as examples of security measures that don't rely on kernel access.

    Windows is the problem. As it it can't seperate kernel and user space or tell the difference between open and run.

    > This move towards a "Zero Trust" approach could have far-reaching implications for the cybersecurity industry and Windows users worldwide, as Microsoft seeks to balance system security with the needs of its partners in the broad

  • Posturing (Score:5, Insightful)

    by bill_mcgonigle ( 4333 ) * on Friday July 26, 2024 @11:48AM (#64657564) Homepage Journal

    Half the Fortune 500 CEO's wanted to know why they were down while Big Tech was up and their CIO's had to explain that Big Tech runs on Linux and the CEO's all then said, "why the fuck are you in my office instead of moving our shit to linux?" and so Microsoft has to respond with, "nah, you don't need to do that".

    Except they do.

    • Re:Posturing (Score:5, Insightful)

      by thegarbz ( 1787294 ) on Friday July 26, 2024 @12:20PM (#64657714)

      What makes you think Linux is a defence to that? Are you unaware that Crowdstrike caused a boot time kernel panics putting Linux machines into a boot loop less than 2 months ago? https://access.redhat.com/solu... [redhat.com]

      As usual the dumbest security measures is thinking that you solve the problem by migrating to other software rather than actually addressing your security practices and security management.

      • Re:Posturing (Score:4, Insightful)

        by swillden ( 191260 ) <shawn-ds@willden.org> on Friday July 26, 2024 @12:41PM (#64657778) Journal

        What makes you think Linux is a defence to that? Are you unaware that Crowdstrike caused a boot time kernel panics putting Linux machines into a boot loop less than 2 months ago? https://access.redhat.com/solu... [redhat.com]

        As usual the dumbest security measures is thinking that you solve the problem by migrating to other software rather than actually addressing your security practices and security management.

        Yeah, the reason Big Tech didn't go down wasn't because Big Tech uses Linux, it's because Big Tech doesn't use Crowdstrike, because Big Tech spends a lot of money on staff and processes to manage security risks. Other companies could do that, but it's really expensive and most of them don't have the scale to justify spending that much. So, instead, they outsource the job to Crowdstrike, et al... which is great when it works, and not so much when it doesn't.

      • Re: (Score:2)

        by gweihir ( 88907 )

        Clownstroke is not needed on Linux at all and it is a bad idea using it there. It, or something like it, is pretty much required on Windows. Why do you keep pushing your lie?

        • Clownstroke is not needed on Linux at all and it is a bad idea using it there.

          And there you have it ladies and gentlemen. The typical "I use Linux therefor I am secure" post combined with a complete lack of understanding of what CrowdStrike actually does (no Linux natively doesn't offer the same security features - or ... reporting features which is important if you've ever actually run an important network beyond the odd computer you have at home).

          Thanks for proving my point. Your views on security on Slashdot (not just in this story here) are exactly what I'm talking about.

          • Re: (Score:2)

            by gweihir ( 88907 )

            Well, given that you are a known incompetent, I am not impressed at all. Incidentally, there is no "Linux native".

  • I just download the fix from Canonical (or any other reputable distributor) & run it on any Windows machine. It removes all the malware permanently in less than an hour. Runs better & faster afterwards too.
  • In basic terms, a virus is a piece of software that self replicates and prevents you from accessing your computer or data. So ... is CrowdStrike a virus?

  • with access to the Windows kernel. I can't say I feel safer.

  • Perhaps MS could start tightening security by revoking the secure boot keys of Linux distros. In the name of disasters like the recent one never happening again...

    • Re: (Score:2)

      by gweihir ( 88907 )

      That would be a _really_ bad idea. I know the US does not have any anti-trust law that works, but the EU does.

  • I think they need a system for boot environment versioning, like what I can do with TrueNAS SCALE and pfSense Plus - thanks to the smarts of ZFS snapshots, and sane Linux file system layouts. Then have a BMC that watchdogs the running OS and can roll back to a previous boot env automatically after a catastrophic failure.

    • Even without using snapshots they could do an A/B system for the core of the OS and its kernel space drivers, and that also would solve this problem with even less technology. Even phones do it.

  • They are the designers of that non-resilient, insecure piece-of-trash! Any problems with it are the direct result of them not caring, messing it up and disrespecting their customers, nothing else.

  • Why wasn't it resilient before? You weren't trying already?

    Seems just like security breaches (which ironically the breaking tool was to prevent). When caught they claim they will work harder on it now.

    Capitalism at it's finest. Just like the military and their 'everything is made by the lowest priced contractor' issue (still?).

  • They were designing an API that would allow user mode access to the features that security vendors were demanding. There was (no surprise) a certification and trust process that went a lot with it.

    The EU thought that this would stop smaller companies from entering the space, even though the cost of the program were very little compared to the development costs of, well making the software itself. So, they told MS they would find them if they proceeded, so MS dropped it.

    Regulation is good overall, but this w

Slashdot Top Deals

"I'm a mean green mother from outer space" -- Audrey II, The Little Shop of Horrors

Close