3 ms·
> pushing new technology that Microsoft has that would push security vendors into user-mode This doesn't exist. It's briefly hinted at in their conclusion, but
by TillE 2y ago
> pushing new technology that Microsoft has that would push security vendors into user-mode
This doesn't exist. It's briefly hinted at in their conclusion, but right now it's simply not there.
There is no userspace equivalent of filesystem minifilters, ObRegisterCallbacks, etc.
- dmattia 2y agoThis is fascinating, thank you for the info! If I am understanding, it would have then been difficult/impossible for CrowdStrike to create a user-mode only sensor without these equivalent APIs. So I guess I'm not sure I see validity in the claims of those blaming the EU here. It seems as though the EU would have allowed Microsoft to kick users out of kernel-space if they had APIs that allowed making security products in user-space. Like Linux/Mac already appear to have.
- extraduder_ire 2y agoI don't think they would have had to provide those APIs in the EU, so long as their own security products were "kicked out" as well. That's kind of complicated to achieve in a permanent and provable way. Though, windows has had support for eBPF for about two years now.
- TillE 2y agoWindows eBPF support is experimental and currently provides hooks for packet filtering stuff and nothing else. I would be delighted if their long-term solution is eBPF which provides full anti-malware hooks, but again it's unfortunately not there yet.