September 3, 2012 at 12:44 am #7863Don DonzalKeymaster
More interesting reading from Mr. Grimes of InfoWorld:
Windows 8 is meeting mixed reviews, to put it mildly — just ask InfoWorld’s Woody Leonhard or J. Peter Bruzzese. Most of the negative reviews I’ve read talk about the frustrations of Metro on the desktop and the lack of a Start button.
From a security perspective, that bad press is too bad, because security improvements in Windows 8 make it one of the most secure operating systems on the planet. That might sound like hyperbole — until you consider all the new stuff that’s been rolled in. Check them out below. (Note: I am a full-tiime employee of Microsoft.)
Windows 8’s Secure Boot feature builds on the open standard UEFI (Unified Extensible Firmware Interface) specification to make Windows incredibly resistant to malicious modification from preboot to full OS booting, preventing firmware attacks. The risk of firmware-attacking malware is rising, if you believe the National Institute of Standards and Technologies, the military, and many Fortune 100 CSOs.
Prior to UEFI and Secure Boot, you would be notified about malicious firmware and OS boot code modification in Windows only if you enabled BitLocker Drive Encryption with the Platform Configuration Registers (PCRs) configured (the default). However, enabling drive encryption to get a boot integrity solution was considered overkill by many.
UEFI and Windows Secure Boot only allow code signed by pre-approved digital certificates to run during the firmware and OS boot process. If anything unsigned tries to modify the boot process (think rootkit), the UEFI-based firmware will undo the change, as does the OS. After receiving a healthy and validated handoff from the firmware, it continues to ensure that only pre-approved, digitally signed code can be run.
Although other OSes can and will use UEFI secure boot, Windows 8 and Windows Server 2012 are the only OSes in which it will be enabled by default. Other than Google’s Chromium OS, few other popular OSes have plans to implement UEFI-like protections or are still arguing about how to pull it off and when to implement.
Windows 8 extends its safe boot protection by ensuring that pre-approved antimalware software gets loaded before malware can take control. Previously, malware could “walk the interrupt vector chain” and get in front of the OS or antimalware software. Once that happened, it wasn’t Microsoft’s or your OS anymore. Now pre-approved antimalware software always gets loaded ahead of the malicious programs, which improves the chances of detection and removal.
SmartScreen is the feature that has made Internet Explorer one of the safest browsers you can run. It has prevented millions of IE users from being infected each day. It does so using a combination of application reputation and website reputation and by looking for malicious behaviors.
For entire article & links:
September 4, 2012 at 8:05 am #49558cyber.spiritParticipant
im studying mcitp and i love microsoft what great news thanx
September 4, 2012 at 4:47 pm #49559SephStormParticipant
I’m not convinced. It sounds like this secure boot will cripple certain implementations. When I hear “it continues to ensure that only pre-approved, digitally signed code can be run.” I am reminded of when I had to modify windows to allow an unsigned driver to run so I could use a device to watch tv on my pc. I am skeptical of how this may effect dual boot systems, as well as cracking passwords on business computers (bitlocker is a pain in the neck…)
early launch, im sure hackers will find a way around it. And i’ve never found smart screen filter or i.e.’s download scanning to be effective, however i dont remember seeing reviews of either of these features, anyone seen one?
September 4, 2012 at 8:54 pm #49560Jamie.RParticipant
I have had little play with Windows 8 at the moment I am not a big Fan. I think so many people have gotten used to Windows 7 that this will be a bit like xp and be around for years as many companies have started to implement it.
September 5, 2012 at 9:16 pm #49561dynamikParticipant
I’m not convinced. It sounds like this secure boot will cripple certain implementations. When I hear “it continues to ensure that only pre-approved, digitally signed code can be run.”
I am skeptical of how this may effect dual boot systems, as well as cracking passwords on business computers (bitlocker is a pain in the neck…)
September 5, 2012 at 9:37 pm #49562ElevenParticipant
Since kernel mode code signing has already been bypassed in Windows, I don’t see why can’t Secure Boot be bypassed.
September 13, 2012 at 1:17 am #49563sternoneParticipant
Bah, most business still run windows XP anyway ;D
You must be logged in to reply to this topic.