Post Sat Oct 21, 2006 7:40 pm

Microsoft Caves on PatchGuard, Appeases Symantec

Security is security, but business is business I guess.

It wasn't worth it to Microsoft to stick to its positions on PatchGuard and the Windows Security Center. The details aren't in yet, but based on Microsoft's vague initial statements it appears that the company has essentially acceded to Symantec's position on PatchGuard and is trying to finesse matters on the Security Center.

The security companies that raised the initial stink are understandably waiting for details, but it probably makes sense for Microsoft to try to make most of them happy enough to shut up and let it ship Vista without raising a further stink.

Symantec's position on PatchGuard has been to create a set of APIs through which certified vendors could install code that bypassed PatchGuard through defined mechanisms.


In a recent blog Symantec put it this way:

- Symantec has provided Microsoft with recommend APIs that will allow legitimate, authorized and certified security vendors to leverage the same capabilities that we have in prior versions of Windows.
- Symantec has been asking for these capabilities for well over one year now and therefore these concerns are not a new development to Microsoft.
- Symantec has repeatedly suggested that Microsoft establish a new certification model that will certify legitimate vendors who seek to extend the Windows Vista kernel. This certification, on top of existing driver certification steps, will ensure that certified vendors are not attempting to bypass Windows DRM and that certified vendors are not malicious and are making genuine enhancements to Windows Vista.

Microsoft security personnel have told me about this proposal in the past and said it makes them nervous, and I can see why. Consider it an increase in the attack surface of 64-bit Windows relative to the current design of PatchGuard.

But still, it does fit with Microsoft's style of doing things, and if the certification program is run fairly and carefully it's not likely introduce malware directly.

I'm more worried about vulnerabilities in the security programs themselves opening up the Windows kernel to attack, but this is probably not a major problem for two reasons: 1) the set of Windows Vista systems is a large target, the set of Vista systems running any particular vulnerable version of a security product much less so; and 2) as Symantec notes, it's possible for third parties, after signing their code properly, to install boot-time kernel drivers. This code could also expose the kernel, but banning third-party code is hardly the answer.

For full story:,1895,2031755,00.asp