AOH :: ISN-3133.HTM

Expert: Hackers Will Break Vista's PatchGuard

Expert: Hackers Will Break Vista's PatchGuard
Expert: Hackers Will Break Vista's PatchGuard,1895,2029031,00.asp 

By Ryan Naraine
October 12, 2006

MONTREAL -- A computer security expert is predicting that hackers will 
crack the controversial PatchGuard kernel anti-tampering technology 
coming in Windows Vista within one year of its release.

Alexander Czarnowski, chief executive of Avet, in Warsaw, Poland, said 
he believes it's inevitable that the technology will be broken once the 
final version of Windows Vista is released to manufacturing.

"A lot of things get changed from beta to beta, so people are waiting 
for a final version. It might get broken immediately but it might be a 
year before it's made public," Czarnowski said during a presentation at 
the Virus Bulletin conference here.

The PatchGuard technology, which was introduced in Windows Server 2003 
Service Pack 1 x64 and Windows XP x64 almost two years ago, monitors the 
kernel to prevent third parties from extending or replacing kernel 
services. It effectively serves as an anti-rootkit mechanism, blocking 
the insertion of kernel-mode stealth malware.

However, hackers and security researchers have already started 
discussing ways to bypass the technology.

A security researcher associated with the Metasploit Project has already 
published an essay that proposes several different 
techniques that could be used to bypass PatchGuard.

The technology is at the core of a bitter dispute between Microsoft and 
anti-virus vendors over access to sensitive parts of the new operating 
system. Symantec and McAfee argue that PatchGuard will limits their 
ability to integrate security software into Vista, but Microsoft insists 
the technology is crucial to securing the operating system.

Microsoft has launched a stand-alone Windows Vista Security landing page 
featuring information about the security work being built into the 
operating system. The page includes a white paper on PatchGuard.

Microsoft has also release of list of anti-virus vendors that are 
providing free trials of security software that can be used with Vista. 
The companies include CA, F-Secure and Trend Micro.

Visit the InfoSec News store! 

Site design & layout copyright © 1986-2014 CodeGods