5 ms·

I suppose I was expecting something more authoritative here. They confirm that there was an attempted read-out-of-bounds, as CrowdStrike said, but that's not re

I suppose I was expecting something more authoritative here. They confirm that there was an attempted read-out-of-bounds, as CrowdStrike said, but that's not really new information at this point. I suppose we'll need to wait for more detailed analysis from CrowdStrike at some point. This post explains why security software has historically run in kernel-mode, and really seems to be pushing new technology that Microsoft has that would push security vendors into user-mode (with APIs that attempt to assist with many of the reasons why they have historically used kernel-mode). Crowdstrike already runs in user-mode on both Mac and Linux (from what I can tell), and it seems like running in user-mode on Windows would significantly lessen the risk of catastrophic failures like a blue-screen-of-death. I know the bulk of the failures here belong to CrowdStrike, but I can't help but think about the fact that Apple kicked security vendors out of kernel-mode a ways back, and that if Windows had done similarly, an issue like this probably wouldn't have been possible. By even offering kernel-mode options to external vendors, I believe Microsoft is creating risk for themselves.

Rinzler89 2y ago
> I can't help but think about the fact that Apple kicked security vendors out of kernel-mode a ways back, and that if Windows had done similarly, an issue like this probably wouldn't have been possible Like others already said, Microsoft already tried to do that with PatchGuard in 2006 with the launch of Windows Vista and the likes of Symantec and McAfee complained to the EU about this would harm the sales of their products, so the EU told Microsoft to not do it in 2009[1]. Apple has the luxury of a small market share on the desktop PC space to not attract the attention of the regulators, plus a user base that's used to Apple constantly rewriting the OS, deprecating APIs, switching CPU architectures, etc. without giving a fuck about breaking backwards compatibility or cutting off developers access to OS features their products use and getting away with it, luxuries that Microsoft doesn't have. IMHO, sticking with Window's default security and not using third party anit-malware has made Windows vastly more secure and rulabile than it was in the days when you'd be looking on installing the likes of Symantec or McAfee for your "protection" which ended up acting like malware after a while throwing dark patterns at you to milk more subsection fees, so as much as it hurts their sales, it's important for the regulators to understand that security is far more important than the regulations they put on Windows for Internet Explorer and Media Player and just like Apple's apps-store, it's sometimes better to let the original product maker handle security and not leave the product open at all points just so some of these bandits can make a living selling security for it. It's like foxes complaining to regulators how chicken wire is a threat to their existence. [1] https://stratechery.com/2024/crashes-and-competition/ https://stratechery.com/2024/crashes-and-competition/
- rrix2 2y ago
  [flagged]
  - Rinzler89 2y ago
    That's an interesting theory. Do you have any sources for this? Because so far there has been no technical arguments to support your PoV.
    - spott 2y ago
      Wasn’t the whole regulatory argument that Microsoft was using kernel mode in their security software, while trying to relegate third party security software to user land? In that case, regulators stepped in and made Microsoft open up kernel mode to level the playing field.
      - jojobas 2y ago
        So how's that different from Apple's security features in the kernel?
        spott 2y ago
        I don’t understand this world well enough to describe it well, but my understanding is that the security features in the kernel are different in purpose from the security features of something like an antivirus.
        jojobas 2y ago
        There's XProtectDetection, it downloads signatures and checks executables. I'd say it's in the ballpark.
        spott 2y ago
        Does XProtect use kernel extensions? It also isn’t a separate product, it is bundled with the OS.
whimsicalism 2y ago
The EU requires MS to provide kernel-level access to security vendors due to their crazy anti-compete provisions
- dmattia 2y ago
  This seems to be only partially true when I read into it. The EU said that Microsoft would need to move their security tools into user-space (or at least to use the same APIs as are available in user-space). If they did that (like Apple has done), they could kick everyone out of kernel-space if they wanted.
TillE 2y ago
> pushing new technology that Microsoft has that would push security vendors into user-mode This doesn't exist. It's briefly hinted at in their conclusion, but right now it's simply not there. There is no userspace equivalent of filesystem minifilters, ObRegisterCallbacks, etc.
- dmattia 2y ago
  This is fascinating, thank you for the info! If I am understanding, it would have then been difficult/impossible for CrowdStrike to create a user-mode only sensor without these equivalent APIs. So I guess I'm not sure I see validity in the claims of those blaming the EU here. It seems as though the EU would have allowed Microsoft to kick users out of kernel-space if they had APIs that allowed making security products in user-space. Like Linux/Mac already appear to have.
  - extraduder_ire 2y ago
    I don't think they would have had to provide those APIs in the EU, so long as their own security products were "kicked out" as well. That's kind of complicated to achieve in a permanent and provable way. Though, windows has had support for eBPF for about two years now.
    - TillE 2y ago
      Windows eBPF support is experimental and currently provides hooks for packet filtering stuff and nothing else. I would be delighted if their long-term solution is eBPF which provides full anti-malware hooks, but again it's unfortunately not there yet.
__MatrixMan__ 2y ago
I agree. Microsoft's core competency has traditionally been backwards compatibility, but if each security vendor can tamper with windows at the deepest level and is allowed to continue explore all of the ways that they can leverage that... What you end up with is a fleet of different windowses, each diverging further with time. It dilutes the benefits brought by investment into the stability of the system because whatever fights are won in one fragment must be refought in others before you can have confidence in the stability of all fragments. It seems like madness to me.
michaelt 2y ago
> Crowdstrike already runs in user-mode on both Mac and Linux (from what I can tell), Crowdstrike provides a Linux kernel module, and expects users to manually install an extra Secure Boot key for it, as part of their corporate laptop setup procedure. This has always seemed inadvisable to me, but checkbox checkers gotta check checkboxes I guess.
- wazzaps 2y ago
  They also support (and recommend I think?) an eBPF-based sensor
GordonS 2y ago
For one thing, being difficult to kill is huge selling point for EDR - move it to user space and it's a lot easier to kill.
- pas 2y ago
  A kernel-space watchdog (that checks integrity of the image) would be much easier than a filter that updates from the internet. Sure, the whole thing is definitely a hard problem, but CS fucking up even the most basic QA **and** error handling ... it just shows how ridiculous their whole claim to having super fancy technology is.
  - __MatrixMan__ 2y ago
    Agreed, but focusing on their QA practices is sort of like criticizing your burglar for not wiping their feet at the window.

Rinzler89 2y ago

> I can't help but think about the fact that Apple kicked security vendors out of kernel-mode a ways back, and that if Windows had done similarly, an issue like this probably wouldn't have been possible Like others already said, Microsoft already tried to do that with PatchGuard in 2006 with the launch of Windows Vista and the likes of Symantec and McAfee complained to the EU about this would harm the sales of their products, so the EU told Microsoft to not do it in 2009[1]. Apple has the luxury of a small market share on the desktop PC space to not attract the attention of the regulators, plus a user base that's used to Apple constantly rewriting the OS, deprecating APIs, switching CPU architectures, etc. without giving a fuck about breaking backwards compatibility or cutting off developers access to OS features their products use and getting away with it, luxuries that Microsoft doesn't have. IMHO, sticking with Window's default security and not using third party anit-malware has made Windows vastly more secure and rulabile than it was in the days when you'd be looking on installing the likes of Symantec or McAfee for your "protection" which ended up acting like malware after a while throwing dark patterns at you to milk more subsection fees, so as much as it hurts their sales, it's important for the regulators to understand that security is far more important than the regulations they put on Windows for Internet Explorer and Media Player and just like Apple's apps-store, it's sometimes better to let the original product maker handle security and not leave the product open at all points just so some of these bandits can make a living selling security for it. It's like foxes complaining to regulators how chicken wire is a threat to their existence. [1] https://stratechery.com/2024/crashes-and-competition/ https://stratechery.com/2024/crashes-and-competition/

rrix2 2y ago
[flagged]
- Rinzler89 2y ago
  That's an interesting theory. Do you have any sources for this? Because so far there has been no technical arguments to support your PoV.
  - spott 2y ago
    Wasn’t the whole regulatory argument that Microsoft was using kernel mode in their security software, while trying to relegate third party security software to user land? In that case, regulators stepped in and made Microsoft open up kernel mode to level the playing field.
    - jojobas 2y ago
      So how's that different from Apple's security features in the kernel?
      - spott 2y ago
        I don’t understand this world well enough to describe it well, but my understanding is that the security features in the kernel are different in purpose from the security features of something like an antivirus.
        jojobas 2y ago
        There's XProtectDetection, it downloads signatures and checks executables. I'd say it's in the ballpark.
        spott 2y ago
        Does XProtect use kernel extensions? It also isn’t a separate product, it is bundled with the OS.

whimsicalism 2y ago

The EU requires MS to provide kernel-level access to security vendors due to their crazy anti-compete provisions

dmattia 2y ago
This seems to be only partially true when I read into it. The EU said that Microsoft would need to move their security tools into user-space (or at least to use the same APIs as are available in user-space). If they did that (like Apple has done), they could kick everyone out of kernel-space if they wanted.

TillE 2y ago

> pushing new technology that Microsoft has that would push security vendors into user-mode This doesn't exist. It's briefly hinted at in their conclusion, but right now it's simply not there. There is no userspace equivalent of filesystem minifilters, ObRegisterCallbacks, etc.

dmattia 2y ago
This is fascinating, thank you for the info! If I am understanding, it would have then been difficult/impossible for CrowdStrike to create a user-mode only sensor without these equivalent APIs. So I guess I'm not sure I see validity in the claims of those blaming the EU here. It seems as though the EU would have allowed Microsoft to kick users out of kernel-space if they had APIs that allowed making security products in user-space. Like Linux/Mac already appear to have.
- extraduder_ire 2y ago
  I don't think they would have had to provide those APIs in the EU, so long as their own security products were "kicked out" as well. That's kind of complicated to achieve in a permanent and provable way. Though, windows has had support for eBPF for about two years now.
  - TillE 2y ago
    Windows eBPF support is experimental and currently provides hooks for packet filtering stuff and nothing else. I would be delighted if their long-term solution is eBPF which provides full anti-malware hooks, but again it's unfortunately not there yet.

__MatrixMan__ 2y ago

I agree. Microsoft's core competency has traditionally been backwards compatibility, but if each security vendor can tamper with windows at the deepest level and is allowed to continue explore all of the ways that they can leverage that... What you end up with is a fleet of different windowses, each diverging further with time. It dilutes the benefits brought by investment into the stability of the system because whatever fights are won in one fragment must be refought in others before you can have confidence in the stability of all fragments. It seems like madness to me.

michaelt 2y ago

> Crowdstrike already runs in user-mode on both Mac and Linux (from what I can tell), Crowdstrike provides a Linux kernel module, and expects users to manually install an extra Secure Boot key for it, as part of their corporate laptop setup procedure. This has always seemed inadvisable to me, but checkbox checkers gotta check checkboxes I guess.

wazzaps 2y ago
They also support (and recommend I think?) an eBPF-based sensor

GordonS 2y ago

For one thing, being difficult to kill is huge selling point for EDR - move it to user space and it's a lot easier to kill.

pas 2y ago
A kernel-space watchdog (that checks integrity of the image) would be much easier than a filter that updates from the internet. Sure, the whole thing is definitely a hard problem, but CS fucking up even the most basic QA **and** error handling ... it just shows how ridiculous their whole claim to having super fancy technology is.
- __MatrixMan__ 2y ago
  Agreed, but focusing on their QA practices is sort of like criticizing your burglar for not wiping their feet at the window.