6 ms·

> At this point I'm convinced that the entire antivirus industry is a scam scheme for the most part. I was always under the impression that Microsoft does not

> At this point I'm convinced that the entire antivirus industry is a scam scheme for the most part. I was always under the impression that Microsoft does not fix or is extremely slow at fixing particular virus-allowing bugs due to their business model of licensing access to system features, you have to access to be able to build an antivirus software. I don't know Windows internals but I imagine that your usual game or text editor does not have and cannot gain access to kernel, bootloader etc, that AVs have.

grishka 5y ago
I don't know much about more modern Windows, but I'm fairly certain that on XP and earlier anything that ran on behalf of the administrator (the only user on most home installations) could trivially load arbitrary code into the kernel. I'm not sure how UAC affects this on Vista and newer.
- muricula 5y ago
  These days you need to have your kernel driver signed by Microsoft or edit your boot config options to put the machine in an insecure state mostly useful for testing. To get it signed you need to pass a basic test suite which MS provides (and can be gamed). https://docs.microsoft.com/en-us/windows-hardware/drivers/install/driver-signing https://docs.microsoft.com/en-us/windows-hardware/drivers/in...
  - mananaysiempre 5y ago
    > These days you need to have your kernel driver signed by Microsoft However, this is required only for a “proper” kernel driver specifically; kernel code execution can still be accomplished without any signing at all using /dev/kmem-like mechanisms, which Microsoft explicitly does not consider a bug[1]. > or edit your boot config options to put the machine in an insecure state mostly useful for testing. Or fiddle with undocumented registry settings (used, among other things, to support upgrades from Windows 7 installations with unsigned drivers) and suppress signing checks for your driver even outside of testing mode[2]. > To get it signed you need to pass a basic test suite which MS provides [...]. You also need to register a business entity and cough up upwards of 300 USD/yr for a Microsoft-approved EV code signing cert[3] before that, which is the biggest hurdle for me at least. I have to say, even if this new Microsoft is not the same as old Microsoft, it sure looks very similar from some angles. [1] https://github.com/ionescu007/r0ak#is-this-a-bugvulnerability-in-windows https://github.com/ionescu007/r0ak#is-this-a-bugvulnerabilit... [2] https://geoffchappell.com/notes/security/whqlsettings/index.htm https://geoffchappell.com/notes/security/whqlsettings/index.... [3] https://docs.microsoft.com/en-us/windows-hardware/drivers/dashboard/get-a-code-signing-certificate https://docs.microsoft.com/en-us/windows-hardware/drivers/da...
    - philistine 5y ago
      The new Microsoft is limited to their cloud offerings. The Windows division, when looking from the outside, is still the same.
muricula 5y ago
Microsoft isn't slower at fixing security vulnerabilities than other OS vendors. It turns out identifying and fixing issues in a piece of software as large as an OS is hard. Access to system features is not restricted by licensing, although I believe there is some source code which is licensed to AV vendors. Independent companies do write their own AVs without interacting with MS much at all besides some fairly basic driver signing processes which anyone who writes a kernel driver these days has to go through. MS does not have unique business reasons for shipping insecure code, and ships an OS which is as secure as they come these days in the form of the xbox. I used to work for an AV vendor and then the MS security team but now work for another OS vendor.
mschuster91 5y ago
> I was always under the impression that Microsoft does not fix or is extremely slow at fixing particular virus-allowing bugs due to their business model of licensing access to system features, you have to access to be able to build an antivirus software. That's bollocks. Unlike Apple which requires Apple's blessing ("entitlement") to access "sensitive" APIs or to load kernel-mode drivers (and is known to randomly grant or deny them), all you need for distribution of a Windows driver is an EV Code sign certificate (from Vista and above) and additionally from Windows 10 onwards to submit the binary to Microsoft for attestation (which likely means they'll run static analysis to check for malware and that's it). It should not take an experienced programmer more than a couple of weeks to develop the kernel-mode interface of a basic anti-virus/firewall solution that monitors process, registry, file and network access and passes the data to an user-mode analyzer (the latter are the easiest, all you need there is a simple filter driver)... the stuff where it gets tricky is when AV vendors access internal kernel APIs and data structures to check for malware modifications to hide itself. Malware doesn't care much if Microsoft updates something it needs, but AV software should not break down after a kernel upgrade, which is why the stakes for AV vendors are so much higher. What Microsoft does sell is access to the source code via the Shared Source program [2] - while there is no official program aimed at AV vendors, you can bet that there is a separate program available for the half-dozen major AV vendors there are. As for "MS is so slow at fixing bugs": the one thing Microsoft cares and what guarantees it the money it makes is backwards compatibility and operating stability. You can take virtually all major Windows 95-era software and it will run unmodified on a modern Windows 10 machine, well over 25 years after its publication - a promise that the Linux kernel upholds but the userland (distributions) does not give a fuck about, and Apple doesn't care much about software written for obsolete platforms at all (see e.g. dropping Rosetta and 32-bit support after the last hardware based on them went obsolete). And unlike Apple, Microsoft has to check all updates in kernel and user land against a literal shitton of hardware combinations and software to make sure no bugs are introduced. [1]: https://docs.microsoft.com/en-us/windows-hardware/drivers/dashboard/attestation-signing-a-kernel-driver-for-public-release https://docs.microsoft.com/en-us/windows-hardware/drivers/da... [2]: https://www.microsoft.com/en-us/sharedsource/ https://www.microsoft.com/en-us/sharedsource/
- SpikeDad 5y ago

grishka 5y ago

I don't know much about more modern Windows, but I'm fairly certain that on XP and earlier anything that ran on behalf of the administrator (the only user on most home installations) could trivially load arbitrary code into the kernel. I'm not sure how UAC affects this on Vista and newer.

muricula 5y ago
These days you need to have your kernel driver signed by Microsoft or edit your boot config options to put the machine in an insecure state mostly useful for testing. To get it signed you need to pass a basic test suite which MS provides (and can be gamed). https://docs.microsoft.com/en-us/windows-hardware/drivers/install/driver-signing https://docs.microsoft.com/en-us/windows-hardware/drivers/in...
- mananaysiempre 5y ago
  > These days you need to have your kernel driver signed by Microsoft However, this is required only for a “proper” kernel driver specifically; kernel code execution can still be accomplished without any signing at all using /dev/kmem-like mechanisms, which Microsoft explicitly does not consider a bug[1]. > or edit your boot config options to put the machine in an insecure state mostly useful for testing. Or fiddle with undocumented registry settings (used, among other things, to support upgrades from Windows 7 installations with unsigned drivers) and suppress signing checks for your driver even outside of testing mode[2]. > To get it signed you need to pass a basic test suite which MS provides [...]. You also need to register a business entity and cough up upwards of 300 USD/yr for a Microsoft-approved EV code signing cert[3] before that, which is the biggest hurdle for me at least. I have to say, even if this new Microsoft is not the same as old Microsoft, it sure looks very similar from some angles. [1] https://github.com/ionescu007/r0ak#is-this-a-bugvulnerability-in-windows https://github.com/ionescu007/r0ak#is-this-a-bugvulnerabilit... [2] https://geoffchappell.com/notes/security/whqlsettings/index.htm https://geoffchappell.com/notes/security/whqlsettings/index.... [3] https://docs.microsoft.com/en-us/windows-hardware/drivers/dashboard/get-a-code-signing-certificate https://docs.microsoft.com/en-us/windows-hardware/drivers/da...
  - philistine 5y ago
    The new Microsoft is limited to their cloud offerings. The Windows division, when looking from the outside, is still the same.

muricula 5y ago

Microsoft isn't slower at fixing security vulnerabilities than other OS vendors. It turns out identifying and fixing issues in a piece of software as large as an OS is hard. Access to system features is not restricted by licensing, although I believe there is some source code which is licensed to AV vendors. Independent companies do write their own AVs without interacting with MS much at all besides some fairly basic driver signing processes which anyone who writes a kernel driver these days has to go through. MS does not have unique business reasons for shipping insecure code, and ships an OS which is as secure as they come these days in the form of the xbox. I used to work for an AV vendor and then the MS security team but now work for another OS vendor.

mschuster91 5y ago

> I was always under the impression that Microsoft does not fix or is extremely slow at fixing particular virus-allowing bugs due to their business model of licensing access to system features, you have to access to be able to build an antivirus software. That's bollocks. Unlike Apple which requires Apple's blessing ("entitlement") to access "sensitive" APIs or to load kernel-mode drivers (and is known to randomly grant or deny them), all you need for distribution of a Windows driver is an EV Code sign certificate (from Vista and above) and additionally from Windows 10 onwards to submit the binary to Microsoft for attestation (which likely means they'll run static analysis to check for malware and that's it). It should not take an experienced programmer more than a couple of weeks to develop the kernel-mode interface of a basic anti-virus/firewall solution that monitors process, registry, file and network access and passes the data to an user-mode analyzer (the latter are the easiest, all you need there is a simple filter driver)... the stuff where it gets tricky is when AV vendors access internal kernel APIs and data structures to check for malware modifications to hide itself. Malware doesn't care much if Microsoft updates something it needs, but AV software should not break down after a kernel upgrade, which is why the stakes for AV vendors are so much higher. What Microsoft does sell is access to the source code via the Shared Source program [2] - while there is no official program aimed at AV vendors, you can bet that there is a separate program available for the half-dozen major AV vendors there are. As for "MS is so slow at fixing bugs": the one thing Microsoft cares and what guarantees it the money it makes is backwards compatibility and operating stability. You can take virtually all major Windows 95-era software and it will run unmodified on a modern Windows 10 machine, well over 25 years after its publication - a promise that the Linux kernel upholds but the userland (distributions) does not give a fuck about, and Apple doesn't care much about software written for obsolete platforms at all (see e.g. dropping Rosetta and 32-bit support after the last hardware based on them went obsolete). And unlike Apple, Microsoft has to check all updates in kernel and user land against a literal shitton of hardware combinations and software to make sure no bugs are introduced. [1]: https://docs.microsoft.com/en-us/windows-hardware/drivers/dashboard/attestation-signing-a-kernel-driver-for-public-release https://docs.microsoft.com/en-us/windows-hardware/drivers/da... [2]: https://www.microsoft.com/en-us/sharedsource/ https://www.microsoft.com/en-us/sharedsource/

SpikeDad 5y ago