|
|
|
|
Windows Secrets Newsletter • Issue 107 • 2007-05-10 • Circulation: over 270,000 |
|
Contents TOP STORY: Driver signing is a failure for Vista KNOWN ISSUES: Readers' revelations on DEP and software discounts WACKY WEB WEEK: The world's first IT professional PC TUNE-UP: How to spot your enemies on the Internet OVER THE HORIZON: Dangerous .doc files and phishing attacks PATCH WATCH: Critical patches for Exchange and your workstations YOUR SUBSCRIPTION: How to change your address or unsubscribe |
|
For links to every subtopic in this issue, scroll down to the
Index |
|
ADS
|
|
TOP STORY Driver signing is a failure for Vista
Why digital signing matters to you To create a driver for the 64-bit version of Vista, a software developer first obtains a Class 3 software-publishing certificate from an approved Microsoft certificate authority (such as VeriSign). That certificate is then used to digitally "sign" (apply identifying code) to the product. The certifying authority is supposed to require identification and do the necessary research to make sure the driver comes from a legitimate applicant. Drivers often need to operate at what is called the kernel level — the very core of the operating system. The privileged nature of the kernel means that it needs special protection. Any compromise to the kernel can potentially bring down the entire system. Consequently, Microsoft is anxious to protect the kernel, especially since "rootkits" can use drivers and kernel-level software to hide from the operating system. There's another reason Microsoft is anxious to secure this key part of Vista, however. The company is promoting Digital Rights Management (DRM), which is used by copyright holders to restrict the use of content. Because Microsoft wants Vista positioned as a platform that is safe for protected content, it needs its operating system to stop hacker code from intercepting media streams. Software could, for example, redirect music from a PC's sound card and send it to the hard disk instead. How driver signing works Digital signing seeks to make visible the source of kernel-mode software. If the 64-bit version of Vista determines that a 64-bit driver doesn't have a signature from an accepted authority, the operating system will prevent it from loading. But, of course, once a certificate is issued, it's somewhat out of the hands of the trusted certificate authority. A vendor with a valid certificate could still produce buggy or malicious code using the certificate, or sell it to someone else who could. More likely, a stolen certificate could be published on the Web and used by hackers to produce their own brand of malware. In theory, once such a compromise is discovered, Microsoft can revoke the certificate (which, in the case of a hardware driver, would disable all products from the certificate holder). This could be done via a Windows Update that tells Vista to block the signature in question. The new world order of x64 Vista drivers Microsoft has long encouraged the digital signing of software. Signed software is intended to let users know the source of a downloaded program. Users can then presumably decide whether it comes from a "trusted" source. Digital signing also lets Microsoft identify the developer of a program that has crashed, assuming users choose to send Microsoft an error report when the fault occurs. With Windows Vista, Microsoft has taken advances in code-signing technology further, making digital signing a requirement in some cases. Here are just a few of the new driver-signing requirements (or "features," as Microsoft calls them) for Vista:
Digital signing does nothing to stop hackers Unfortunately, driver signing, as it is currently implemented by Microsoft, appears to be creating more obstacles for developers and customers than it is for hackers. Even before the final beta of Vista was released, the Black Hat Briefings hacking conference demonstrated how easily the driver-signing security could be defeated, as described in an eWeek article. Vista's release candidates didn't fare much better. Researches at India's NV Labs were able to devise a product called Vbootkit that bypasses driver-signing protection in RC1 and RC2. Finally, experts at Symantec's Security Response Advanced Threat Research group recently announced in a PDF report that they had succeeded in disabling the new restrictions on 64-bit Vista after just one week of testing. How digital signing burdens developers If driver signing hasn't been an impediment to serious hackers, it has been a roadblock for legitimate developers of Vista drivers. Obtaining the necessary certificate for digital signing reportedly costs US$500 per year (less if a developer signs a multi-year agreement). Once obtained, the certificate has to be kept secure, since a stolen and published certificate could be used by anyone to sign a driver. Then there are the technical hurdles, such as those needed to meet Microsoft's WHQL signing requirements. In a recent analysis of Windows' content protection schemes, Peter Gutmann, researcher at the University of Auckland's Department of Computer Science, writes, "The vast majority of drivers running on PCs today aren't signed, not so much because the developers couldn't be bothered, but because the WHQL process that produces the signed drivers is so slow that they're obsolete by the time they've been approved by Microsoft (and even some of the WHQL-certified ones are still pretty flaky)." Evidence of this situation isn't hard to find. Complaints about the lack of sound, mouse, and video drivers for Vista — months after its Jan. 30 consumer release — are rife, including an APC Magazine article by James Bannan. One angry user, consultant Dan Goldman, has created a Web site advocating a class-action lawsuit against Nvidia and some of its partners for video drivers that claimed to be "Vista Ready Certified" and "Designed for Windows Vista." Similarly, the Techarp Web site reports that ATI shipped its Radeon X1950 GT graphics card with a "Windows Vista Certified" label on the box, despite the fact that it contained no Vista driver at all. The release notes admit that fact, in apparent contradiction to the box label. Microsoft can do better than this Microsoft cannot expect widespread adoption of its new operating system if users cannot depend on the availability of drivers to support the most popular hardware configurations. Nor will customers feel safe with Vista when experts continue to report how easy it is to poke holes in Microsoft's new defenses. Users need to demand that Microsoft simply do its job better before releasing a new operating system, providing a stronger defense against hackers without placing undue burdens on developers. Scott Dunn is associate editor of the Windows Secrets Newsletter. He is also a contributing editor of PC World Magazine, where he has written a monthly column since 1992, and co-author of 101 Windows Tips & Tricks (Peachpit) with Jesse Berst and Charles Bermant. |
|
ADS
|
|
KNOWN ISSUES Readers' revelations on DEP and software discounts By Scott Dunn Windows' Data Execution Prevention (DEP) feature provides important protection against malicious code, as I described in my May 3 article. But additional free tools reported by our readers make the feature even more accessible to users of Windows XP. Finding hardware DEP support in XP Richard Wilcox has important information that will be of interest to XP users:
Fortunately, other readers, including Stuartt Cuthill, point out that you can get this information by using a very simple freeware application, Securable, from Gibson Research Corporation. Detecting DEP settings in XP A number of readers, including Jeff Kohut, pointed out that XP users can also detect whether DEP is enabled for a particular process by downloading the free Sysinternals utility Process Explorer from Microsoft. Process Explorer mimics most features of Task Manager and can be set up to display DEP status by choosing View, Select Columns. Check DEP Status on the Process Image tab and click OK. Windows, not your browser, controls DEP One reader, identified as "Molotov," also uses Process Explorer and has a number of useful points about DEP:
However, this is not the case in Vista, which may be excluding browsers for compatibility's sake, despite the user's DEP setting. It remains the case that in Vista, IE7 is the only browser that can have DEP enabled. This requires a setting change in the Internet Properties Control Panel, as described in the May 3 article. Even more discount programs for MS software David Hightower points out a great way for home users to get Microsoft software at a terrific discount, if they work for the right employer:
Consequently, the software available to you depends on what software your organization has licensed. One reader who uses this program, Evan Orensky, wrote to say that he got a copy of MS Office 2007 Enterprise for just a fulfillment fee, which in his case was US$20, plus tax. "The license is valid for as long as you work for the company, and as long as the company maintains its Software Assurance coverage," he adds. OEM discounts can apply to end users Some readers thought an interpretation of OEM software licensing terms that we printed in the May 3 newsletter was too restrictive. Michael Sullivan writes:
Still another reader, Poul Andeersen, cites a Microsoft posting on the Small Business Community Blog stating that "OEM system builder software packs ... are not intended for distribution to end users. Unless the end user is actually assembling his/her own PC, in which case, that end user is considered a system builder as well." [emphasis added] Such a statement suggests that hobbyists who are assembling or refurbishing a system may legitimately buy OEM system builder products. More deals for Australian students Finally, Lyn Hancock writes in with another way for Australian students to get software through an academic discount.
|
|
EDITOR'S BOOKSHELF
|
|
WACKY WEB WEEK The world's first IT professional
|
|
YOUR SUBSCRIPTION The Windows Secrets Newsletter is published weekly on the 1st through 4th Thursdays of each month, plus occasional news updates. Vacation breaks occur in late August, Thanksgiving Week, and Christmas/New Year's. Publisher: WindowsSecrets.com, Attn.: #120 Editor, 1700 7th Ave., Suite 116, Seattle, WA 98101-1323 USA. Vendors, please send no unsolicited packages to this address (readers' letters are fine). Editorial Director: Brian Livingston. Editor-at-Large: Fred Langa. Associate Editor: Scott Dunn. Contributing Editors: Susan Bradley, Mark Edwards, Woody Leonhard, Chris Mosby, Ryan Russell. Research Director: Vickie Stevens. Program Director: Brent Scheffler. Managing Editor: Jody Braverman. Trademarks: Microsoft and Windows are registered trademarks of Microsoft Corporation. The Windows Secrets series of books is published by Wiley Publishing Inc. The Windows Secrets Newsletter, WindowsSecrets.com, LangaList, LangaList Plus, WinFind, Security Baseline, Patch Watch, Perimeter Scan, Wacky Web Week, the Logo Design (W, S or road, and Star), and the slogan Everything Microsoft Forgot to Mention all are trademarks and service marks of WindowsSecrets.com LLC. All other marks are the trademarks or service marks of their respective owners. HOW TO SUBSCRIBE: Anyone may subscribe to this newsletter by visiting our free signup page. WE GUARANTEE YOUR PRIVACY: 1. We will never sell, rent, or give away your address to any outside party, ever. 2. We will never send you any unrequested e-mail, besides newsletter updates. 3. All unsubscribe requests are honored immediately, period. Privacy policy HOW TO UNSUBSCRIBE: To unsubscribe from the Windows Secrets Newsletter,
|
