3 ms·

How does MS carry the blame? Perhaps by signing a driver that can remotely load & execute code... Otherwise they were forced to NOT lock down the kernel at Vis

by jve 2y ago

How does MS carry the blame? Perhaps by signing a driver that can remotely load & execute code... Otherwise they were forced to NOT lock down the kernel at Vista time.

Daviey 2y ago
By not providing a sane interface for security tools to exist. It should not have been possible for CS to fubar the whole system like this. Imagine if your bios vendor made it trivial for an application to brick your hardware. Yes, you'd blame the software, but you'd also be asking why the bios didn't protect the system. In Linux eBPF is a sane interface which CS now use. MS are now developing their own eBFP interface, but it's only a early concept.
- jve 2y ago
  I found your opinion, expanded: https://www.computerweekly.com/news/366598838/Why-is-CrowdStrike-allowed-to-run-in-the-Windows-kernel https://www.computerweekly.com/news/366598838/Why-is-CrowdSt... According to former Windows developer David Plummer, Microsoft does, in fact, offer a number of APIs for third-party antivirus security. “CrowdStrike defaults to kernel mode, presumably because it needs to do things that can’t be done from user mode,” Plummer said in a YouTube video. “And to me, that’s where Microsoft could be responsible, because on the Windows platform, to the best of my knowledge, some of the CrowdStrike security functionality requires deep integration with the operating system that can only be currently achieved on the kernel side.” Microsoft has a number of APIs including Windows Defender Application Control API and the Windows Defender Device Guard, which Plummer said provide mechanisms for controlling application execution and ensuring that only trusted code runs on the operating system. He said that the Windows Filtering Platform (WFP) allows applications to interact with the network stack without requiring kernel level code. However, quoting sources within Microsoft, Plummer claimed that the company had actually “tried to do the right thing” by developing an advanced API designed specifically for security applications such as that from CrowdStrike. “This API promised deeper integration with the Windows operating system, offering enhanced stability, performance and security,” he added. But the EU 2009 ruling effectively prevented such integration as it could potentially have given Microsoft an unfair advantage. However, Ian Brown, an independent consultant on internet regulation, argued that Microsoft should have better security controls, rather than attempting to put the blame of the CrowdStrike crash on the EU anti-competition commission. In a blog, he wrote: “For technology-dependent societies’ resilience, OS kernel-level software and equivalents on socially critical infrastructure systems (like travel, healthcare and banking) need to be very carefully tested (and ideally run on top of a formally verified microkernel) and controlled. But OS monopolists shouldn’t be making the final decisions about precisely what those controls look like, where they have implications for competition.”

by jve 2y ago

How does MS carry the blame? Perhaps by signing a driver that can remotely load & execute code... Otherwise they were forced to NOT lock down the kernel at Vista time.

Daviey 2y ago

By not providing a sane interface for security tools to exist. It should not have been possible for CS to fubar the whole system like this. Imagine if your bios vendor made it trivial for an application to brick your hardware. Yes, you'd blame the software, but you'd also be asking why the bios didn't protect the system. In Linux eBPF is a sane interface which CS now use. MS are now developing their own eBFP interface, but it's only a early concept.

jve 2y ago
I found your opinion, expanded: https://www.computerweekly.com/news/366598838/Why-is-CrowdStrike-allowed-to-run-in-the-Windows-kernel https://www.computerweekly.com/news/366598838/Why-is-CrowdSt... According to former Windows developer David Plummer, Microsoft does, in fact, offer a number of APIs for third-party antivirus security. “CrowdStrike defaults to kernel mode, presumably because it needs to do things that can’t be done from user mode,” Plummer said in a YouTube video. “And to me, that’s where Microsoft could be responsible, because on the Windows platform, to the best of my knowledge, some of the CrowdStrike security functionality requires deep integration with the operating system that can only be currently achieved on the kernel side.” Microsoft has a number of APIs including Windows Defender Application Control API and the Windows Defender Device Guard, which Plummer said provide mechanisms for controlling application execution and ensuring that only trusted code runs on the operating system. He said that the Windows Filtering Platform (WFP) allows applications to interact with the network stack without requiring kernel level code. However, quoting sources within Microsoft, Plummer claimed that the company had actually “tried to do the right thing” by developing an advanced API designed specifically for security applications such as that from CrowdStrike. “This API promised deeper integration with the Windows operating system, offering enhanced stability, performance and security,” he added. But the EU 2009 ruling effectively prevented such integration as it could potentially have given Microsoft an unfair advantage. However, Ian Brown, an independent consultant on internet regulation, argued that Microsoft should have better security controls, rather than attempting to put the blame of the CrowdStrike crash on the EU anti-competition commission. In a blog, he wrote: “For technology-dependent societies’ resilience, OS kernel-level software and equivalents on socially critical infrastructure systems (like travel, healthcare and banking) need to be very carefully tested (and ideally run on top of a formally verified microkernel) and controlled. But OS monopolists shouldn’t be making the final decisions about precisely what those controls look like, where they have implications for competition.”