请输入您要查询的百科知识:

 

词条 Kernel Patch Protection
释义

  1. Technical overview

  2. Advantages

  3. Criticisms

     Third-party applications  Weaknesses  Antitrust behavior 

  4. References

  5. External links

Kernel Patch Protection (KPP), informally known as PatchGuard, is a feature of 64-bit (x64) editions of Microsoft Windows that prevents patching the kernel. It was first introduced in 2005 with the x64 editions of Windows XP and Windows Server 2003 Service Pack 1.[1]

"Patching the kernel" refers to unsupported modification of the central component or kernel of the Windows operating system. Such modification has never been supported by Microsoft because, according to Microsoft, it can greatly reduce system security, reliability, and performance.[1] Although Microsoft does not recommend it, it is possible to patch the kernel on x86 editions of Windows; however, with the x64 editions of Windows, Microsoft chose to implement additional protection and technical barriers to kernel patching.

Since patching the kernel is possible in 32-bit (x86) editions of Windows, several antivirus software developers use kernel patching to implement antivirus and other security services. These techniques will not work on computers running x64 editions of Windows. Because of this, Kernel Patch Protection resulted in antivirus makers having to redesign their software without using kernel patching techniques.

However, because of the design of the Windows kernel, Kernel Patch Protection cannot completely prevent kernel patching.[3] This has led to criticism that since KPP is an imperfect defense, the problems caused to antivirus vendors outweigh the benefits because authors of malicious software will simply find ways around its defenses.[4][5] Nevertheless, Kernel Patch Protection can still prevent problems of system stability, reliability, and performance caused by legitimate software patching the kernel in unsupported ways.

Technical overview

The Windows kernel is designed so that device drivers have the same privilege level as the kernel itself.[2] Device drivers are expected to not modify or patch core system structures within the kernel.[1] However in x86 editions of Windows, Windows does not enforce this expectation. As a result, some x86 software, notably certain security and antivirus programs, were designed to perform needed tasks through loading drivers that modify core kernel structures.[2][3]

In x64 editions of Windows, Microsoft began to enforce restrictions on what structures drivers can and cannot modify. Kernel Patch Protection is the technology that enforces these restrictions. It works by periodically checking to make sure that protected system structures in the kernel have not been modified. If a modification is detected, then Windows will initiate a bug check and shut down the system,[2][4] with a blue screen and/or reboot. The corresponding bugcheck number is 0x109, the bugcheck code is CRITICAL_STRUCTURE_CORRUPTION.

Prohibited modifications include:[4]

  • Modifying system service tables
  • Modifying the interrupt descriptor table
  • Modifying the global descriptor table
  • Using kernel stacks not allocated by the kernel
  • Modifying or patching code contained within the kernel itself,[4] or the HAL or NDIS kernel libraries[5]

Kernel Patch Protection only defends against device drivers modifying the kernel. It does not offer any protection against one device driver patching another.[6]

Ultimately, since device drivers have the same privilege level as the kernel itself, it is impossible to completely prevent drivers from bypassing Kernel Patch Protection and then patching the kernel.[7] KPP does however present a significant obstacle to successful kernel patching. With highly obfuscated code and misleading symbol names, KPP employs security through obscurity to hinder attempts to bypass it.[2][8] Periodic updates to KPP also make it a "moving target", as bypass techniques that may work for a while are likely to break with the next update. Since its creation in 2005, Microsoft has so far released two major updates to KPP, each designed to break known bypass techniques in previous versions.[2][9][10]

Advantages

Patching the kernel has never been supported by Microsoft because it can cause a number of negative effects.[3] Kernel Patch Protection protects against these negative effects, which include:

  • Serious errors in the kernel.[11]
  • Reliability issues resulting from multiple programs attempting to patch the same parts of the kernel.[12]
  • Compromised system security.[2]
  • Rootkits can use kernel access to embed themselves in an operating system, becoming nearly impossible to remove.[11]

Microsoft's Kernel Patch Protection FAQ further explains:

{{quotation|Because patching replaces kernel code with unknown, untested code, there is no way to assess the quality or impact of the third-party code...An examination of Online Crash Analysis (OCA) data at Microsoft shows that system crashes commonly result from both malicious and non-malicious software that patches the kernel.|{{cite web |url=http://www.microsoft.com/whdc/driver/kernel/64bitpatch_FAQ.mspx |title=Kernel Patch Protection: Frequently Asked Questions |date=22 January 2007 |accessdate=22 February 2007}}}}

Criticisms

Third-party applications

Some computer security software, such as McAfee's McAfee VirusScan and Symantec's Norton AntiVirus, worked by patching the kernel on x86 systems.{{citation needed|reason=but NIS2010/11 works on my version of WIn7x64 :/|date=January 2011}} Anti-virus software authored by Kaspersky Lab has been known to make extensive use of kernel code patching on x86 editions of Windows.[13] This kind of antivirus software will not work on computers running x64 editions of Windows because of Kernel Patch Protection.[14] Because of this, McAfee called for Microsoft to either remove KPP from Windows entirely or make exceptions for software made by "trusted companies" such as themselves.[15]

Symantec's corporate antivirus software[16] and Norton 2010 range and beyond[17] worked on x64 editions of Windows despite KPP's restrictions, although with less ability to provide protection against zero-day malware.

Antivirus software made by competitors ESET,[18] Trend Micro,[19] Grisoft AVG,[20] avast!, Avira Anti-Vir and Sophos do not patch the kernel in default configurations, but may patch the kernel when features such as "advanced process protection" or "prevent unauthorized termination of processes" are enabled.[21]

Microsoft does not weaken Kernel Patch Protection by making exceptions to it, though Microsoft has been known to relax its restrictions from time to time, such as for the benefit of hypervisor virtualization software.[6][22] Instead, Microsoft worked with third-party companies to create new Application Programming Interfaces that help security software perform needed tasks without patching the kernel.[12] These new interfaces were included in Windows Vista Service Pack 1.[23]

Weaknesses

Because of the design of the Windows kernel, Kernel Patch Protection cannot completely prevent kernel patching.[7] This led the computer security providers McAfee and Symantec to say that since KPP is an imperfect defense, the problems caused to security providers outweigh the benefits, because malicious software will simply find ways around KPP's defenses and third-party security software will have less freedom of action to defend the system.[15][24]

In January 2006, security researchers known by the pseudonyms "skape" and "Skywing" published a report that describes methods, some theoretical, through which Kernel Patch Protection might be bypassed.[25] Skywing went on to publish a second report in January 2007 on bypassing KPP version 2,[26] and a third report in September 2007 on KPP version 3.[27] Also, in October 2006 security company Authentium developed a working method to bypass KPP.[28]

Nevertheless, Microsoft has stated that they are committed to remove any flaws that allow KPP to be bypassed as part of its standard Security Response Center process.[29] In keeping with this statement, Microsoft has so far released two major updates to KPP, each designed to break known bypass techniques in previous versions.[2][9][10]

Antitrust behavior

In 2006, the European Commission expressed concern over Kernel Patch Protection, saying it was anticompetitive.[30] However, Microsoft's own antivirus product, Windows Live OneCare, had no special exception to KPP. Instead, Windows Live OneCare used (and had always used) methods other than patching the kernel to provide virus protection services.[31] Still, for other reasons a x64 edition of Windows Live OneCare was not available until November 15, 2007.[32]

References

1. ^{{cite web|url=http://www.microsoft.com/whdc/driver/kernel/64bitpatch_FAQ.mspx|title=Kernel Patch Protection: Frequently Asked Questions|publisher=Microsoft|date=22 January 2007|accessdate=30 July 2007}}
2. ^{{cite web|url=http://uninformed.org/index.cgi?v=8&a=5&p=2|author=Skywing|title=Introduction|work=PatchGuard Reloaded: A Brief Analysis of PatchGuard Version 3|publisher=Uninformed|date=September 2007|accessdate=20 September 2007}}
3. ^{{cite web|url=https://www.theguardian.com/technology/2006/sep/28/viruses.security|title=Antivirus vendors raise threats over Vista in Europe|last=Schofield|first=Jack|publisher=The Guardian|date=28 September 2006|accessdate=20 September 2007}} "This has never been supported and has never been endorsed by us. It introduces insecurity, instability, and performance issues, and every time we change something in the kernel, their product breaks." —Ben Fathi, corporate vice president of Microsoft's security technology unit
4. ^{{cite web|url=http://www.microsoft.com/whdc/driver/kernel/64bitpatching.mspx|title=Patching Policy for x64-Based Systems|publisher=Microsoft|date=22 January 2007|accessdate=20 September 2007}}
5. ^{{cite web|url=http://uninformed.org/index.cgi?v=3&a=3&p=7|title=System Images|work=Bypassing PatchGuard on Windows x64|author=skape|author2=Skywing |publisher=Uninformed|date=December 2005|accessdate=21 September 2007}}
6. ^{{cite web|url=http://uninformed.org/index.cgi?v=6&a=1&p=25|author=Skywing|title=Conclusion|work=Subverting PatchGuard Version 2|publisher=Uninformed|date=January 2007|accessdate=21 September 2007}}
7. ^{{cite web|url=http://uninformed.org/index.cgi?v=3&a=3&p=3|title=Introduction|work=Bypassing PatchGuard on Windows x64|author=skape|author2=Skywing |publisher=Uninformed|date=December 2005|accessdate=20 September 2007}}
8. ^{{cite web|url=http://uninformed.org/index.cgi?v=6&a=1&p=10|title=Misleading Symbol Names|author=Skywing|work=Subverting PatchGuard Version 2|publisher=Uninformed|date=December 2006|accessdate=20 September 2007}}
9. ^{{cite web|url=http://www.microsoft.com/technet/security/advisory/914784.mspx|author=Microsoft|title=Update to Improve Kernel Patch Protection|work=Microsoft Security Advisory (914784)|publisher=Microsoft|date=June 2006|accessdate=21 September 2007}}
10. ^{{cite web|url=http://www.microsoft.com/technet/security/advisory/932596.mspx|author=Microsoft|title=Update to Improve Kernel Patch Protection|work=Microsoft Security Advisory (932596)|publisher=Microsoft|date=August 2007|accessdate=21 September 2007}}
11. ^{{cite web|url=http://blogs.msdn.com/windowsvistasecurity/archive/2006/08/11/695993.aspx|title=An Introduction to Kernel Patch Protection|accessdate=30 November 2006|last=Field|first=Scott|date=11 August 2006|work=Windows Vista Security blog|publisher=Microsoft}}
12. ^{{cite web|url=http://www.microsoft.com/security/windowsvista/allchin.mspx|title=Microsoft executive clarifies recent market confusion about Windows Vista Security|accessdate=30 November 2006|last=Allchin|first=Jim|authorlink=Jim Allchin|date=20 October 2006|publisher=Microsoft}}
13. ^{{cite web|url=http://uninformed.org/index.cgi?v=4&a=4&p=10|author=Skywing|title=Patching non-exported, non-system-service kernel functions|work=What Were They Thinking? Anti-Virus Software Gone Wrong|publisher=Uninformed|date=June 2006|accessdate=21 September 2007}}
14. ^{{cite news |first=Elizabeth|last=Montalbano|title=McAfee Cries Foul over Vista Security Features|url=http://www.pcworld.in/news/index.jsp/artId=4587538|publisher=PC World|date=6 October 2006|accessdate=30 November 2006}}
15. ^{{cite web|url=http://news.softpedia.com/news/Microsoft-Increasing-Security-Risk-with-Vista-37014.shtml|title=Microsoft Increasing Security Risk with Vista|last=Samenuk|first=George|publisher=McAfee|date=28 September 2006|accessdate=8 July 2013}}
16. ^{{cite web|url=http://www.symantec.com/enterprise/products/sysreq.jsp?pcid=1008&pvid=805_1|title=Symantec AntiVirus Corporate Edition: System Requirements|accessdate=30 November 2006|year=2006|publisher=Symantec}}
17. ^{{cite web|url=http://us.norton.com/internet-security|title=Symantec Internet Security product page|accessdate=26 January 2011|year=2011|publisher=Symantec}}
18. ^{{Cite web|url=http://www.eset.com/products/64bit.php|title=High-performance threat protection for the next-generation of 64-bit computers|last=|first=|date=2008-11-20|publisher=ESET|archive-url=https://web.archive.org/web/20081120071411/http://www.eset.com/products/64bit.php|archive-date=2008-11-20}}
19. ^{{cite web|url=https://imperia.trendmicro-europe.com/us/products/enterprise/officescan-client-server-edition/system-requirements/index.html|title=Minimum System Requirements|publisher=Trend Micro USA|accessdate=5 October 2007}}
20. ^{{cite web |url=http://www.grisoft.com/doc/324/us/crp/3 |title=AVG Anti-Virus and Internet Security - Supported Platforms |publisher=Grisoft |accessdate=5 October 2007 |archiveurl=https://web.archive.org/web/20070827082857/http://www2.grisoft.com/doc/324/us/crp/3 |archivedate=27 August 2007 |deadurl=yes |df= }}
21. ^{{cite news |first = Robert |last = Jaques |title = Symantec and McAfee 'should have prepared better' for Vista |url = http://www.vnunet.com/vnunet/news/2167016/symantec-mcafee-should-prepared |publisher = vnunet.com |date = 23 October 2006 |accessdate = 30 November 2006 |deadurl = yes |archiveurl = https://web.archive.org/web/20070927195203/http://www.vnunet.com/vnunet/news/2167016/symantec-mcafee-should-prepared |archivedate = 27 September 2007 |df = }}
22. ^{{cite news|url=http://www.infoworld.com/article/07/01/19/HNpatchguardstitch_1.html|title=Researcher: PatchGuard hotfix stitches up benefit to Microsoft|date=19 January 2007|accessdate=21 September 2007|author=McMillan, Robert|publisher=InfoWorld}}
23. ^{{cite web |url = http://technet2.microsoft.com/WindowsVista/en/library/005f921e-f706-401e-abb5-eec42ea0a03e1033.mspx?mfr=true |title = Notable Changes in Windows Vista Service Pack 1 |publisher = Microsoft |year = 2008 |accessdate = 20 March 2008 |deadurl = yes |archiveurl = https://web.archive.org/web/20080503040732/http://technet2.microsoft.com/WindowsVista/en/library/005f921e-f706-401e-abb5-eec42ea0a03e1033.mspx?mfr=true |archivedate = 3 May 2008 |df = }}
24. ^{{cite news|last=Gewirtz|first=David|authorlink=David Gewirtz|title=The great Windows Vista antivirus war|url=http://zatz.com/outlookpower/article/the-great-windows-vista-antivirus-war/|publisher=OutlookPower|year=2006|accessdate=8 July 2013}} "The system's already vulnerable. People have already hacked into PatchGuard. System is already vulnerable no matter what. PatchGuard has a chilling effect on innovation. The bad guys are always going to innovate. Microsoft should not tie the hands of the security industry so they can't innovate. We're concerned about out-innovating the bad guys out there." —Cris Paden, Manager on the Corporate Communication Team at Symantec
25. ^{{cite web|url=http://www.uninformed.org/?v=3&a=3|title=Bypassing PatchGuard on Windows x64|author=skape|author2=Skywing |publisher=Uninformed|date=1 December 2005|accessdate=2 June 2008}}
26. ^{{cite web|url=http://uninformed.org/index.cgi?v=6&a=1|title=Subverting PatchGuard Version 2|author=Skywing|publisher=Uninformed|date=December 2006|accessdate=2 June 2008}}
27. ^{{cite web|url=http://uninformed.org/index.cgi?v=8&a=5|title=PatchGuard Reloaded: A Brief Analysis of PatchGuard Version 3|author=Skywing|publisher=Uninformed|date=September 2007|accessdate=2 June 2008}}
28. ^{{cite news|first=Matt|last=Hines|title=Microsoft Decries Vista PatchGuard Hack|url=http://www.eweek.com/c/a/Security/Microsoft-Decries-Vista-PatchGuard-Hack|publisher=eWEEK|date=25 October 2006|accessdate=2 April 2016}}
29. ^{{cite news |last = Gewirtz |first = David |title = The great Windows Vista antivirus war |url = http://www.outlookpower.com/issuesprint/issue200611/00001883.html |publisher = OutlookPower |year = 2006 |accessdate = 30 November 2006 |deadurl = yes |archiveurl = https://web.archive.org/web/20070904075535/http://www.outlookpower.com/issuesprint/issue200611/00001883.html |archivedate = 4 September 2007 |df = }}
30. ^{{cite news|first=Tom|last=Espiner|title=EC Vista antitrust concerns fleshed out|url=http://software.silicon.com/os/0,39024651,39163525,00.htm|publisher=silicon.com|date=25 October 2006|accessdate=30 November 2006}}
31. ^{{cite web|url=https://blogs.technet.com/security/archive/2006/08/12/446104.aspx|title=Windows Vista x64 Security – Pt 2 – Patchguard|accessdate=11 March 2007|last=Jones|first=Jeff|publisher=Microsoft|date=12 August 2006|work=Jeff Jones Security Blog}}
32. ^{{cite web |url = http://windowsvistablog.com/blogs/windowsvista/archive/2007/11/14/upgrade-to-next-version-of-windows-live-onecare-announced-for-all-subscribers.aspx |title = Upgrade to Next Version of Windows Live OneCare Announced for All Subscribers |last = White |first = Nick |work = Windows Vista Team Blog |publisher = Microsoft |date = 14 November 2007 |accessdate = 14 November 2007 |deadurl = yes |archiveurl = https://web.archive.org/web/20080201162836/http://windowsvistablog.com/blogs/windowsvista/archive/2007/11/14/upgrade-to-next-version-of-windows-live-onecare-announced-for-all-subscribers.aspx |archivedate = 1 February 2008 |df = }}

External links

  • [https://web.archive.org/web/20070217053224/http://www.windows-now.com/blogs/robert/archive/2006/08/12/PatchGuard-and-Symantecs-Complaints-About-Windows-Vista.aspx The Truth About PatchGuard: Why Symantec Keeps Complaining]
  • [https://web.archive.org/web/20061124094344/http://blogs.msdn.com/windowsvistasecurity/archive/2006/08/11/695993.aspx An Introduction to Kernel Patch Protection]
  • [https://web.archive.org/web/20070205155710/http://www.microsoft.com/security/windowsvista/allchin.mspx Microsoft executive clarifies recent market confusion about Windows Vista Security]
  • Kernel Patch Protection: Frequently Asked Questions
  • [https://blogs.technet.com/security/archive/2006/08/12/446104.aspx Windows Vista x64 Security – Pt 2 – Patchguard]
Uninformed.org articles:
  • Bypassing PatchGuard on Windows x64
  • Subverting PatchGuard Version 2
  • PatchGuard Reloaded: A Brief Analysis of PatchGuard Version 3
Working bypass approaches
  • KPP Destroyer (including source code) - 2015
  • A working driver to bypass PatchGuard 3 (including source code) - 2008
  • Bypassing PatchGuard with a hex editor - 2009
Microsoft security advisories:
  • June 13, 2006 update to Kernel Patch Protection
  • August 14, 2007 update to Kernel Patch Protection
{{Windows Components}}{{Microsoft Security Products}}

2 : Microsoft Windows security technology|Windows NT kernel

随便看

 

开放百科全书收录14589846条英语、德语、日语等多语种百科知识,基本涵盖了大多数领域的百科知识,是一部内容自由、开放的电子版国际百科全书。

 

Copyright © 2023 OENC.NET All Rights Reserved
京ICP备2021023879号 更新时间:2024/9/20 21:18:36