Vista DRM Prevents Kernel Tampering 428
mjdroner writes "A ZDNet blog reports on a new DRM feature for Vista that 'protects' the kernel from tampering. The blog quotes a Microsoft document: 'Code (CI) protects Windows Vista by verifying that system binaries haven't been tampered with by malicious code and by ensuring that there are no unsigned drivers running in kernel mode on the system.' The blog says that much of the DRM in Vista is simply a port from XP, but that this feature is new to the OS."
Coercion? (Score:5, Interesting)
Re:Coercion? (Score:5, Insightful)
Re:Coercion? (Score:4, Interesting)
The information here [microsoft.com] also tell that drivers that load at boot time must contain a digital signature (I'm talking regardless of 32/64-bit platform now). There's also other cases where a signature is required, and in all these cases it has to be from an authority "Windows trusts" (read: Microsoft).
While this "combats open source", it's really just the certification authority where "money = trustworthiness" stupidity applied all over. They made VeriSign et al. grow big, and now Microsoft will try to grow big(ger) using the same idea. Microsoft will defend themselves with that they can't let just about any authority without insight in how Windows works and lacking Microsoft's guidance to sign because then they could sign code that did harm to Windows. I guess both are kind of right.
Re:Coercion? (Score:5, Informative)
Re: (Score:3, Interesting)
Indeed. How long will it be before some company gets a driver signed that (intentionally or not) allows arbitrary code to be executed as a subroutine in its 'trusted' context? As soon as that happens, they're back to square one...
Re: (Score:3, Insightful)
Unfortunately this seems like it will also put an end to binary patching of system files, which means we'll be stuck with acceleration. In XP the only way to remove acceleration involves patching win32.sys to JMP past the accelera
Re:Coercion? (Score:4, Informative)
Except in Vista, 99% of drivers DON'T reside and CAN NO LONGER reside in kernel space. Other than very special and limited applications (videocard drivers), most drivers are FORCED to be loaded in userspace.
The system is more stable because a crappy printer driver won't blue-screen your system, and the printer driver (and others) achieve the same functionality they had in kernel space using the new Windows Driver Model.
Although signing drivers costs $money, only companies like nVidia actually have to. The new DRM only protects kernel space, and the new kernel FORCES 99% OF ALL DRIVERS to reside in userspace. Kernel protection isn't a problem because most people can't put drivers there anyway.
Re: (Score:3, Informative)
So how do they access the hardware if they're not in ring 0?
The Windows Driver Model provides an interface to do this. The software calls kernel functions, and the KERNEL accesses the hardware.
This lets drivers reside in user mode, yet still talk to the hardware. Keeps things nice and stable, and DOESN'T require signing.
Re:Coercion? (Score:5, Insightful)
Independant developers should sue. MS is completly locking them out of the platform.
Developers.Developers.developers. Indeed...
Re: (Score:2, Insightful)
Anyone who has a need to write kernel-level drivers can almost certainly toss $500 a year at a certificate. Compared to the cost of, say, manufacturing hardware, this is noise.
Re:Coercion? (Score:5, Insightful)
It doesn't matter, though, because if you make it too hard to write software for Windows, people will stop. They'll find another platform that is more enticing to them. It won't happen immediately, of course. But it'll happen.
Re: (Score:3, Informative)
Re: (Score:3, Insightful)
The OWNER of the system should have full control. Whomever has the root password should have full control of the entire system from top to bottom. Even with a corporate desktop,the ultimate user of the machine is the COMPANY and not the drone employee.
Re: (Score:3, Insightful)
Unsigned platforms only have the kind of future you say if WE permit them to have that future. I, for one, will not allow that in my own house-hold, nor any company that I start. There are better ways to dealing with security and i
Re: (Score:3, Informative)
I'd say 50% of the drivers I install under XP warn me that they're unsigned. The ones from larger companies like nVidia are usually later updated to include said signing, but the others remain unsigned indefinitely - especially for older or more obscure hardware.
You can probably say goodbye to projects like the Omega Drivers [omegadrivers.net] unless they can summon up the requisite fee every year to get their modified drivers signed.
Re:Get real (Score:4, Insightful)
Re: (Score:3, Insightful)
Hasn't stopped Sony.
But seriously, $500 is chump change to organized spammers, phishers, and malware authors and I'm sure they would spending an extra few bucks set up fake Last Vegas Limited Liability Corporations just to get access.
Not that hard to do. (Score:3, Funny)
They'll "follow the money" for sure, but to where?
Re: (Score:3, Insightful)
Re:Get real (Score:4, Insightful)
Re: (Score:3, Insightful)
Besides, can you really call it open source software when some magic third party has to "approve" your software. No, you can't.
OSS on Windows is gone.
Re: (Score:3, Insightful)
Re: (Score:2)
Re: (Score:2, Insightful)
Input drivers cannot run in user mode (Score:3, Informative)
Yes you would. A console controller conversion requires a way to talk directly to a parallel port to send first-button and next-button request signals and receive button state signals. Input device drivers have additional restrictions; Microsoft's user-mode driver framework FAQ [microsoft.com] states the following:
Many classes of software are affected (Score:5, Informative)
Installable file systems
Loopback mounts
Volume encryption
Rootkit detection
Packet sniffing
VPN software
I'm sure there are others. Vista's code signing requirement will make it difficult for any open-source program to do any of the things listed above. Large OSS projects backed by a company will probably be able to get a certificate from Microsoft and sign official builds, but third parties will be unable to modify and redistribute binaries, which is counter to the spirit of open source. I'm sure this is not an accident. Smaller OSS projects (such as installable file systems for ext3 or reiser) will most likely jsut disappear.
Re:Many classes of software are affected (Score:5, Interesting)
It's easy to shit on an idea, but the core components of a system need to be protected somehow, and while I hear a lot of whinning what I DON'T hear is anyone offering a better solution to the problem.
If someone really wants to build one of the things you mention then they'll pay the frieght. And Vista isn't open source.
Re: (Score:2)
I believe what Balmer meant was "Corporate Developers", or "Developers with $$$"... People w/o money need not apply.
Re: (Score:2)
Re: (Score:2)
Now, there are several open source OS you may use if you care to write your own device drivers, or see how they are made.
Re:Coercion? (Score:5, Interesting)
The cost of $500 a year is also not much for the Russian mob, or any other bunch of fuckweasels that want to sponsor the creation of a rootkit.
Re: (Score:3, Interesting)
-Rick
Re:Coercion? (Score:4, Insightful)
Re: (Score:2)
Re: (Score:3, Insightful)
Re:Coercion? (Score:5, Insightful)
Yeah, but it will also make it harder for people making tools to preserve Fair Use (DVD and HD-disc ripping programs, no-CD cracks for games, etc.). This is a Bad Thing.
I'll keep my Fair Use and take my chances with the rootkits, thankyouverymuch!
Re: (Score:2)
Re:Coercion? (Score:5, Interesting)
Nothing has changed for user-mode drivers. You'll still get the same old nagging wave-through dialog for unsigned drivers, now with added UAC screen flickering.
Signatures are only required for kernel-mode drivers. In 64-bit Vista, it's a hard limit: No signature, no load, period. In 32-bit, you'll get the same UAC/nag dialog as user-mode drivers. The only time you'll be affected by the lack of signatures in 32-bit Vista is when you try to play back all those awesome Blu-Ray and HD-DVD movies you've been clamoring for on your shiny new HDCP-compliant flat panel monitor. </sarcasm>
Reminder: Video drivers are user-mode in Vista.
Re: (Score:3, Funny)
Ah, but what about "Trusted[sic]" Platform Module drivers?
Input drivers are still kernel mode (Score:3, Informative)
Input device drivers are still kernel mode [slashdot.org]. If you have a disability, and you want to build an assistive input device, and you can't afford $500 a year for a cert from VeriSign plus whatever your state charges to form and maintain a corporation to receive the cert (VeriSign does not sell code signing certs to sole proprietorships), tough copulating manure.
Not all drivers (Score:5, Interesting)
Modfying the kernel after that is just a matter of working out which bits (kill the code that checksums the binaries first, etc.)
Re: (Score:3, Interesting)
No info about rc2 yet, but if they didn't want to correct it in rc1, then... who knows...
Re:Not all drivers (Score:4, Funny)
Installing lockout under the guise of security. (Score:3, Interesting)
How Wonderful (Score:2, Interesting)
Re: (Score:3, Informative)
Re: (Score:2)
If you think you managed to get a 32bit driver working you weren't loading a driver - just a 32bit applicaton.
Re: (Score:2)
Obviously for hardware over a year to 18 months old it's difficult... but it's no use whinging to Microsoft. Nag the manufac
Re: (Score:2)
is Vista that fabled 8th generation OS? (Score:5, Funny)
I predict that Eighth Generation computers
will compile no programs, run no applications,
and access no data. Instead they will be
designed and tuned to give a continuously
variable spectrum of elegant and precise
error messages describing your failure to
induce them to do so."
Yay Vista!
Re: (Score:3, Funny)
Updates? (Score:4, Insightful)
Re:Updates? (Score:4, Informative)
You take a hash, and sign it with a private key. This is your signature. The loader then takes a hash of the file again. It also decrypts the signature with the public key. Compare the two. If they match, then the file hasn't been tampered with.
Tampering with this requires:
1. Tampering with the loader
2. Tampering with the public key stored in the loader (really part of #1)
3. Breaking MS's private key
4. Producing another executable with the same hash
1 and 2 are possible, but 3 and 4 are computationally hard. (The sun will have turned into a red giant long before the best-known alogrithms have found a solution, even if the hash is the relatively "weak" MD5.)
It isn't that hard (Score:4, Insightful)
Compare the two. If they match, then the file hasn't been tampered with... Tampering with this requires...
No, all that is required is to copy one key over the other in memory. Alternatively, one could modify a single comparison instruction in the loader. Then the match occurs, and the code will be allowed to load.
This is well within the range of an experienced hacker:
Re: (Score:2)
Re: (Score:3, Interesting)
/. has been anticipating this (Score:2)
On a personal level, if I cannot uses the EXT2IFS drivers on an Vista system to access my linux drives, I will keep my XP cds and simply use XP and not bother about new games (since the games I use are from 2002, I pretty much already have abandoned new games anyway) or new versions of office.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
If you have the new DDK (labeled longhorn beta DDK on my MSDN but just don't use the longhorn bits) that has the IFS kit rolled in now.
That said, writing a filesystem driver is *hard* and I would set aside 6-12 months development time for it.
Re: (Score:2)
BTW, there's a program called RFStools I think that lets you access Reiser partitions from Windows. I've only tried it once or twice, and I think just to read, but it worked for that. I don't know how complete they are.
(Besides, what are you doing using a filesystem from an alleged murder? )
Built for security or srtonger DRM (Score:2)
I wonder whether or not its engineered to make vista more secure or to strengthen windows DRM (Dark ages Replayed for the Modern era). I've got a feeling its one or the other, but not necessarily both.
Re: (Score:2)
Simple solution (Score:2)
All your base... for great justice!!!
Would be anti-DRM in the case of the Sony Rootkit (Score:3, Insightful)
Forbidden or simply sandboxed? (Score:2)
So, is this a way to prevent crashes (a la 3.5, no Ring 0 access) or is it a way to tighten the no
Ah... (Score:2)
An incomplete DRM system can be ignored if there's still enough of a real computer (tm) left that doesn't have to jump through the DRM hoops. If you can run code in a way that doesn't HAVE to check the DRM for permission to run, then all the DRM becomes is a necissary bootstrap you need before your real software starts running.
And from what I've seen so far, a completely protected system simply isn't worth the inconvenience for a general compute
Re: (Score:2)
Re: (Score:2)
But they have to realize it first, and do so before they get locked in. That's the hard part about fighting DRM.
Optimism (Score:2, Funny)
Re: (Score:2)
I'm hoping for a year. That gives Vista enough time to spread to make it impossible to make large-scale re-engineering, and will also give people enough time to learn what DRM actually means for them. Let the people suffer enough that they'll hate DRM and view the DRM-breaking hackers as heroes.
Re: (Score:3, Interesting)
There are PCs with TPM chips that are at that level now but they're still fairly rare - in general a PC is still an open architecture.
Uhh (Score:2)
Re: (Score:2)
Already broken by Blue Pill (Score:5, Informative)
Re: (Score:2)
Since you don't have to page everything (it is a function of the OS after all), it is possible to not page out critical CI drivers, thus preventing re-writing of critical DRM signature code.
Freedom is Slavery (Score:3, Insightful)
That, and I really like the Free Software TUN/TAP driver for Windows.
great for my mom (Score:2)
Thank god, I am done with Windows (Score:2)
OS X is NOT perfect, nor is Linux. But, OS X is a lot closer then Windows AND Linux. Don't get me wrong, Linux has its place. As a server. I will use nothing but it for a server, but for a workstation it still has a long
Comment removed (Score:5, Insightful)
DRM? (Score:2)
Protecting the core parts of the system against tampering is a perfectly good security measure, and it has been done by anti-virus software for years. It's also being done on Linux; at least one rootkit detector does it.
to protect revenue (Score:2)
There has been some discussion of money changing hand to be licensed by MS as a kernel driver. This is not necessarily a bad thing, because not everything needs be in the kernel. One can imagine, however, that this would be a cheap way for sponsored applications to gain validity, sort of a membership to the BBB.
Ultimately
Why don't they get it? (Score:3, Insightful)
Even with chip level security I'd be drilling into chips and hot wiring them if needed or purchase pre hot wired hardware if the modification equipment was beyond my means. I will never stop striving for control of my own property even if control is an illusion.
No Colinux on Vista (Score:3, Informative)
The real reason for the kernel DRM (Score:3, Insightful)
When the Windows DRM was cracked, how long did it take for Microsoft to issue a fix? A couple of days.
When there is an IE security issue, how long does it take for Microsoft to issue a fix? Weeks, months, sometimes not at all.
Just the facts, maam (Score:3, Informative)
2. Win64 (whether Vista, 2003, and XP) requires signed drivers unless you boot up in "debug" mode. Win32 does not, although it will warn you.
3. If you have any unsigned drivers running (Win64 OR Win32), certain "trusted path" applications (i.e. DRM-enabled video players) will not run. Basically, the content author says "I only give permission to watch this video if your system is trusted" (for some definition of trusted, as defined by the content author). Microsoft is providing a way to certify your system as trusted. Without this certification, you don't have permission of the content author to view the content. (Workarounds will be found, I am sure, but legally, that's how it works.)
4. Microsoft will issue a PIC (driver signing certificate) to pretty much anybody with a valid code publishing certificate from an accepted certification authority. Currently, "accepted certification authority" means Verisign, but MS claims to be willing to entertain other applicants. It is the certification authority that gets the $500, not Microsoft.
5. The point of the signature is identification, not security. Basically, Microsoft wants to be able to identify the author of any kernel-mode code running on Win64. Stable? Well written? That is a completely separate matter covered by a different process. The idea is that if a kernel-mode driver does something stupid/illegal like sniff for passwords, Microsoft wants to be able to track down the author and possibly blacklist/revoke the driver signing certificate if flagrant violations are found.
Yes, this presents some inconvenience for small or not-for-profit organizations that want to write drivers. In most cases (something like WinPCap), I suspect they'll be able to find a "sponsor" organization willing to sign the driver. Other drivers can really never be trusted (CoLinux, for example) because the driver loads arbitrary externally supplied code into the kernel, so sponsors might be more hesitant to sign them (their certificate would probably be blacklisted).
On the other hand, it means that any rootkit/sniffer/malicious driver will have a name and address associated with it -- very handy for picking up the trail of the author (or at least shutting him/her down via certificate revocation).
Meh. (Score:3, Interesting)
(I personally don't grok x86 ASM well enough to do this. But some people do.)
As with privacy, the question is "who watches the watchers?"
Re:innovative (Score:5, Insightful)
If anything I would argue that rootkit.com is a more legit distribution mechanism than Sony.
Re: (Score:2)
Of course, the first bug in a signed driver that allows unsigned code to be loaded into the kernel is a class break for the entire system. It sounds like in typical corporate fashion that Microsoft has been working hard to inconvenience lawful customers while doing little to stop the people who are deliberately unlawful.
Re:innovative (Score:5, Insightful)
But aren't most spambot trojans business assets ? After all, spam makes money - that's why spammers bother - so rootkits are business assets for blackhat hackers, even more so than they are for Sony.
No, these poor hackers are simply trying to protect their right to profit - just like Sony. And if that means taking the control of the computer away from its owner, well, surely you agree that that's a small price to pay to ensure that those damn users aren't depriving them of those profits, right ? Sony certainly seems to...
Re: (Score:2)
.... who are just trying to protect their business assets: the spam....
Re: (Score:3, Funny)
Re: (Score:2)
Quis custodiet ipsos custodes (Score:5, Insightful)
As Apple just learned with their TPM kernel extension, all that hackers need to do is replace the binary that verifies all other binaries, and the "goodies" are up for grabs.
Re: (Score:2)
Interesting... where can I read more about this?
Re:Quis custodiet ipsos custodes (Score:4, Informative)
The project is sometimes referred to as OSX86, I think. They release updates just about every time Apple has a major update, and at least very recently you could get a version of OSX that could run on generic x86 hardware, at the same version as what's available on Macs.
From what I understand, the difficulty of all this really isn't replacing the kernel, but more like ensuring there are good drivers for non-Apple hardware. In any event, the situation seems very different to me, between Apple locking OSX to Apple hardware and Microsoft locking the kernel in general.
Re: (Score:3, Interesting)
Re: (Score:3, Informative)
Apple however, had distributed unprotected versions of 10.4.1 prior to that. And a large amount of the kernel is open-source. There's no assurance you can do that with Windows.
Re: (Score:3, Interesting)
At some time during execution of the validation process, the CPU computates a yes or no answer based on a number of bytes of input. Whether or not there is a validator for the validator is not known, but you can simply disassemble both of them, NOP out the entire validating sub-routine (or figure out which result is 'yes'), and voila. Well, it won't be this simple, the validation will probably be deliberately complicated, but the result os always the same, "no, not valid", or "yes, run it in kernel mode".
Re:HMmmmm (Score:4, Informative)
Nothing. Go to another signing-company, then.
I don't know about Vista, but XP has multiple root-certs from well-known signing companies pre-installed (verisign, etc). Pick one of them. If they all think that your driver "isn't good enough", then it probably isn't. BTW, "not good enough" usually means that they think the code in question is malware (win which case it's *good* that it be rejected) or piracy-ware (which would piss off the "information wants to be free" types) of some sort.
The other main reason for sigs is to ensure that a driver that you obtain wasn't mucked with. For example, if you download an ATI driver from some site and that driver has malware inserted into it, it likely won't have a digital sig, or at least not one that matches the driver or is valid, so it won't run.