Re: How will PatchGuard change kernel programming?

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance

Comments inline:

"David J. Craig" <Dave@xxxxxxxxxxxxx> wrote in message
news:uZJAMp$7GHA.4572@xxxxxxxxxxxxxxxxxxxxxxx
I don't agree that McAfee has been avoiding or even inhibiting Microsoft
from producing APIs to permit better addon security products. There is a
much improved registry monitoring interface. There is also a much
improved file system filter stack via the minifilter model that solves a
lot of problems that gave so many people using old source code versions of
filemon so many problems.

Actually, I and others at some conferences have asked for additional kernel
API's that would have helped security checking. In some cases I got
reports back that the big two did fight against this with claims that
Microsoft was helping their competitors.


Some of the problem with security companies is that Microsoft has become
a competitor. How can they ask for something without giving away their
trade secrets to a competitor?

How is saying something like, we want an extension to the PsLoadImageNotify
routine to all termination of a process that is running a non-trusted file
letting out their secrets. The items the kernel should be extended for are
things that appear in a lot of papers (including marketing blurbs from the
big two!).

It is ironic that the big two are waving the flag of protect the little
guy. For instance, try running a kernel debugger on a system with their AV
product. Depending on the version you will either get no AV (with no
warning it is disabled) or the system will crash (at least once I corrupted
a disk due to this approach). These guys do this to "protect their IP", of
course it makes it real fun to find out that the reason your file system is
crashing is that they assumed things about the file system interface that
aren't true. My favorite was a version of a product that knew if your file
system had multiple streams it was NTFS, and would make assumptions on
legal calls, and buffering methods based on the presence of a stream!

It is ironic that PatchGuard has been around for over 2 years and now
finally the big two are complaining. This stuff was announce in 2004,
where were they then? I do know I had a conversation with a firm that
would not identify themselves on PatchGuard, I suggested ways their product
could be made to work without hooking, and the response was "Are you
kidding, that kind of development cost would hurt our profits".


--
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
http://www.windrvr.com
Remove StopSpam from the email to reply



.

Relevant Pages

  • [UNIX] Buffer Overflow in ISO9660 File System Component of Linux Kernel
    ... Get your security news from a reliable source. ... The Linux kernel performs no length checking on ... symbolic links stored on an ISO9660 file system, ... In order to exploit this vulnerability, an attacker must be able to mount ...
    (Securiteam)
  • Re: How will PatchGuard change kernel programming?
    ... from producing APIs to permit better addon security products. ... much improved registry monitoring interface. ... trade secrets to a competitor? ... file system is crashing is that they assumed things about the file system ...
    (microsoft.public.win32.programmer.kernel)
  • Re: FSI Indices with translates the answer
    ... directory of the file system that one is within, ... there are other MV dbms products that have virtually no security ... MV vendors should provide that functionality required by "ALL" users. ... when you fire anyone who points out problems ...
    (comp.databases.pick)
  • Re: For the AdaOS folks
    ... A mall with one or two doors on the outside to be ... > only makes sense to choke the security at a minimal number ... > that exist within the file system. ... While it is not the entire answer to network ...
    (comp.lang.ada)
  • Re: Linux security
    ... that is in Windows NT-based systems out of the box. ... Why do you want that fine level of control? ... level of control over security?" ... a file system is a different beast altogether. ...
    (Ubuntu)