The company maintains that it has built a version of its Authentium ESP Enterprise Platform that can bypass PatchGuard without setting off the desktop alarms produced by the security feature when the Vista kernel is compromised. ESP Enterprise, an SDK sold by Authentium to telecommunications carriers and so-called managed services providers, offers virus protection, anti-spyware, data recovery, firewall and transaction security capabilities.
Post a Comment
Member since:
2006-10-25
While I understand how MS holding the keys to the kernel away from other security vendors had a bad side, isn't its complete opening also bad?
They can now install anti-virus that can bypass PatchGuard and not send off any alerts, so what stops a virus from doing the same thing?
PatchGaurd is broken? This doesn't bode well for Vista's built in security.
Member since:2006-06-28
Member since:
2006-04-09
[joke mode]
Watch out for Steve Ballmer's flying chair!
[serious mode]
Is anyone REALLY surprised with these news? Just to give us an idea, look at this poll held by vnunet. At the time I wrote this, these were the results:
Would you trust Microsoft's Windows Vista security?
• Yes, absolutely - 1%
• No, I would still want to deploy third-party security technologies - 92%
• It is too early to tell yet - 6%
http://www.vnunet.com/articles/pollresults/2167127
Edited 2006-10-25 16:55
Member since:2006-06-24
And a look at the same results page reveals:
---
Would you trust Microsoft's Windows Vista security?
• Yes, absolutely - 40%
• No, I would still want to deploy third-party security technologies - 57%
• It is too early to tell yet - 2%
---
So it appears that it's not as cut and dried as you think.
And I think the results would have gone the other way if they asked:
No, I would still want to deploy third-party security technologies that hacks into the kernel.
Edited 2006-10-26 06:04
Member since:2006-09-22
Oh, please, don't be such a moron. It's mostly because people like you that most non Linux users hate us.
While Vista has no chance of making it to my PC, this is really bad news, if someone can bypass the checks in that way with a security tool, someone else can make it with a virus, a spyware or any other malware.
Anyway, I'm pretty sure that MS will fix this before launch, so it's an non-issue.
Member since:2006-04-21
It's mostly because people like you that most non Linux users hate us.
If non-Linux users don't think a breach like this is laughable at best, serious at worst, I don't think indications of my amusement are going to have any effect either way. And what does this have to do with users anyway? Most users probably can't code for **** (myself included), but when your OS vendor can't, it's BAD news.
While Vista has no chance of making it to my PC, this is really bad news, if someone can bypass the checks in that way with a security tool, someone else can make it with a virus, a spyware or any other malware.
Sounds like you think I'm gloating about how many people are going to be suckered by this. And you'd be wrong. I just find it funny that a company with such a high reputation and sense of self-worth is so clueless.
Anyway, I'm pretty sure that MS will fix this before launch, so it's an non-issue.
Maybe. It should never have finished this close to launch, though, (assuming Vista isn't going to be delayed again), so I'm not so sure.
Edited 2006-10-25 18:40
Member since:2006-04-21
Member since:2006-06-01
If non-Linux users don't think a breach like this is laughable at best, serious at worst, I don't think indications of my amusement are going to have any effect either way. And what does this have to do with users anyway? Most users probably can't code for **** (myself included), but when your OS vendor can't, it's BAD news.
I assume you struck Debian off you list of approved Linux distros when their servers were hacked.
Member since:2006-04-21
This is completely different. Debian is known for high quality software and servers that got hacked once. Microsoft is known for undeservedly ubiquitous software and a long and continuing string of embarrassing failures covered up with cynically Stalinist revisionist propaganda.
Member since:
2006-03-10
Member since:2005-07-06
Member since:2006-09-29
Member since:
2006-09-14
Member since:
2005-07-06
O'Donnell said that Authentium has informed Microsoft of its work, and that the software company asked it to abandon the tactic and wait for its new APIs, but he indicated that his company has no plans to do so.
Would you trust Authentium with that sort of attitude? sorry, if I was running a business, I sure as hell wouldn't trust my business security on products that are hackware based.
The kernel access who-ha is nothing more than a marketing ploy by the big two anti-virus companies, not only to justify them not having to invest money into their product and get it up to speed - god knows what the f--k they've been doing whilst Windows Vista has been getting developed, but to also some how try to slander Microsoft over the fact that Microsoft has released a very good anti-virus/security suite which doesn't royally suck like Symantec and McAfee products do.
How many people here, work in IT and find that 90% of the calls relate to issues pertaining to the crap products that are developed by Symantec and McAfee - if it isn't Nortons stuffing up email settings, its McAfee anti-virus bringing a once speed machine to the speed of an old lady walking down the street with a zimmerframe.
Edited 2006-10-25 18:14
Member since:2005-07-07
Member since:2006-04-21
Member since:2005-10-05
I think a more accurate description is that he's advocating supporting software that doesn't use undocumented tricks in the system or straight out hackery to do a job when it's not necessary to do so. The only AV companies complaining about this change in the 64-bit version of Vista (Which is already present in the x64 Edition of XP) are the ones who are not willing to rewrite their software to work on the new platform.
This kind of attitude leads to software the compromises system stability and ultimately security itself since the two are so intertwined.
Member since:2005-07-06
No, why should I trust my business to a company who relies on unstable, constantly changing, hacked up kernel level api's that could possibly cause unknown damage to my system integrity when I could rely my business on software developed using the publicly supported and maintaed API's so that when I do apply patches from Microsoft for Windows, I know that my security software will just keep on ticking withouy any problems.
Microsoft makes API's available to the public for a reason; they'll maintain it, support it; so if you write your application for them, you're pretty much assured that it'll work in the future.
This company in question, however, is basing their product on a set of API's which are undocumented, unmaintained and only for internal use; in otherwords; Microsoft has NO obligation to maintain those API's, so if they need to change something in a future update, you'll be in deep shit when you find that your hackware based application no longer works because the internal/hidden kernel api's it relies on to run, no longer exist, have been significantly change or simply their 'hack' no longer works because Microsoft has addressed the 'vulnerability'.
Like I keep saying, every time these companies do something stupid like opening their mouth and whine, it moves me closer to the idea of paying for Microsoft's security suite.
Member since:
2005-12-18
When a program of any kind attempts to modify the kernel on a system running PatchGuard, which is already available in 64-bit versions of Microsoft's Windows XP OS, the computer produces a blue screen and stops all other Windows applications from running.
Isn't that a DoS vulnerability? I hope secunia takes notice of this!!! :-D
Edited 2006-10-25 18:27
Member since:2005-07-22
Member since:
2006-06-01
Lets say I buy Authentium, and Patchguard or the mysterious API's that allow bypassing are modified (say by the RTM version of Vista) and all my servers blue screen.
Will I install the "new and improved version" of Authentium?
I don't think so.
Patchguard has been in Windows 2003 since SP1. Thats 1.5 years. Its funny Authentium never broke it until now ...
Member since:2006-01-06
Member since:
2006-10-25
Member since:
2006-01-02
PatchGuard had been broken long before (check out the excellent www.uninformed.org, which contains a paper describing how it works and how to break it). These anti-virus guys just used their research.
The whole point of PatchGuard is not really to secure the machine but to prevent external companies from modifying critical kernel data structures. Having this system in place allows Microsoft to make updates to Windows which expose rootkits down the line. It turns what was before a totally impossible problem (how to tell whether or not a rootkit has infected windows) to a more solvable problem (what are the common ways to get around PG and how to nullify them). PatchGuard allows Microsoft to break rootkits through Windows Update. It also prevents "legitimate" programs from behaving like rootkits, so rootkit detection tools won't have false-positives.
