Text 12270, 61 rader
Skriven 2006-07-28 21:30:28 av /m (1:379/45)
Ärende: Developers cry foul over Windows kernel security
========================================================
From: /m <mike@barkto.com>


http://www.theregister.co.uk/2006/07/28/ms_kernel_security_controversy/

===
Recently introduced security measures by Microsoft will make it more difficult
to integrate third-party security tools with Windows, according to a rival
personal firewall firm.

Agnitum reckons that the introduction of Kernel Patch Protection by Microsoft
will force independent security software vendors to adopt the same tactics as
hackers in order to get their code to work.

Security researchers at Agnitum - best known for its Outpost personal firewall
product - reached this conclusion after an analysis of Microsoft's Kernel Patch
Protection approach. The technology is designed to limit the exposure of
Windows machine to rootkits, which are forms of malware that hide their
presence on infected systems, by restricting access to low-level kernel
functions.

But Agnitum thinks the approach is susceptible to reverse engineering attacks
by skilled hackers, while preventing legitimate software developers from
installing software at the kernel level, unless ISVs similarly reverse-engineer
access to the OS kernel. Such an approach would make it more difficult to
install and maintain independent security products on Windows, Agnitum argues.
Hackers, by contrast, have no need to fret about compatibility issues.

"As the vendor of Outpost Firewall Pro, we have to install at the kernel
level," said Alexey Belkin, chief software architect at Agnitum. "In addressing
the potential problem of not being able to install Outpost on new versions of
Windows, we have discovered that it is possible to drill past the new security
measures introduced by Microsoft - if we use the same techniques used by
hackers."

Kernel Patch Protection protects low-level system activities such as the file
and registry operations of the Windows kernel. Program that gains access to the
kernel can, for instance, hide a folder on the hard disk and make it impossible
to delete that folder using standard tools. The technology is slated for
delivery with Windows Vista and 64-bit versions of Windows. Agnitum describes
Microsoft's approach as misguided, if not deliberately anti-competitive.

"Microsoft made a logical move with this attempt to protect Windows against
rootkits," said Mikhail Penkovsky, vice president of sales and marketing at
Agnitum. "Unfortunately, it doesn't really resolve the problem, and also makes
it a great deal more difficult for independent security software developers to
be fully compatible with Windows."

"Nobody knows if Microsoft has done this intentionally, but we can't avoid the
suspicion that this move may have been designed to force users to rely on
Microsoft and only Microsoft for Windows security," he added. R
===

Windows already has a firewall, why in the world would Microsoft want to make
it easy for third parties to install another firewall, one that cannot be
bypassed by Microsoft phone-home software?

 /m

--- BBBS/NT v4.01 Flag-5
 * Origin: Barktopia BBS Site http://HarborWebs.com:8081 (1:379/45)