CrowdStrike’s Falcon software uses a special driver that allows it to run at a lower level than most apps so it can detect threats across a Windows system. Microsoft tried to restrict third parties from accessing the kernel in Windows Vista in 2006 but was met with pushback from cybersecurity vendors and EU regulators. However, Apple was able to lock down its macOS operating system in 2020 so that developers could no longer get access to the kernel.

Now, it looks like Microsoft wants to reopen the conversations around restricting kernel-level access inside Windows.

  • CalcProgrammer1@lemmy.ml
    link
    fedilink
    arrow-up
    143
    arrow-down
    1
    ·
    5 months ago

    Please, get this garbage out of the kernel. If it isn’t there to talk to hardware, third party code has no place in the kernel. The same shit that Crowdstrike did could easily happen with any of these useless anticheats.

    • teawrecks@sopuli.xyz
      link
      fedilink
      arrow-up
      41
      ·
      5 months ago

      In b4 msft creates a level between kernel and user level for this stuff to sit at. It will have read-only access to all of kernel memory, and will otherwise function the same, but when it crashes it won’t take the OS down, just certain programs that rely on it.

      What will they call it? “Observer” level? “Big Brother” level? “Overseer” level? Probably just something to do with “Verifying Trust/Integrity”. Google will also want to quietly stick something for “Web Integrity” there.

      • Tokugero@lemmy.world
        link
        fedilink
        arrow-up
        8
        ·
        5 months ago

        https://github.com/microsoft/ebpf-for-windows

        Right now it’s network level, but Linux’s implementation has since moved out from just packet filtering to full syscall filter and interaction; it’s generally accepted that Windows will be following suit with this implementation. Thought you’d like a name to the thing you described

      • JakenVeina@lemm.ee
        link
        fedilink
        English
        arrow-up
        7
        ·
        edit-2
        5 months ago

        Is it just me, or does this seem like a reasonable solution? Assuming it’s technically feasible.

        • teawrecks@sopuli.xyz
          link
          fedilink
          arrow-up
          6
          arrow-down
          1
          ·
          5 months ago

          It’s still giving third party software kernel level control over your device, so you’re still giving up any possibility of privacy and probably leaving yourself wide open to a backdoor attack, but that has been normalized. So to the degree that what people accept as reasonable these days is unreasonable, yeah, that’s why I think MSFT will try it.

    • xinayder@infosec.pub
      link
      fedilink
      arrow-up
      10
      arrow-down
      2
      ·
      5 months ago

      As much as I despise MS and think they are equally incompetent, I don’t think it’s a good idea to lock down Windows. They will stop providing kernel access to 3rd parties at first, then a few months later you will only be able to download software from the Microsoft Store.

      Yes, it’s a security issue but them being allowed to close down their OS sets a dangerous precedent that will make Windows even more shittier and enshittified than it already is.

      • ji17br@lemmy.ml
        link
        fedilink
        arrow-up
        12
        arrow-down
        2
        ·
        5 months ago

        There is zero chance of that happening. This is exactly what people said when Apple created a Mac App Store. Surprise surprise you can still run any software you want on a Mac.

      • EpeeGnome@lemm.ee
        link
        fedilink
        English
        arrow-up
        4
        ·
        5 months ago

        They’d be seriously shooting themselves in the foot if they did that. Most corporations have 3rd party software that they would not be able or willing to give up, software development for Windows would be unable to test and debug, and I know from personal experience that many consumers find the already existing S Mode to be frustrating and confusing.

        • xinayder@infosec.pub
          link
          fedilink
          arrow-up
          2
          ·
          5 months ago

          They kinda already do this. Any .exe you download outside the Microsoft Store requires double confirmation before you can execute it, unless it’s from Microsoft.

      • Phoenixz@lemmy.ca
        link
        fedilink
        arrow-up
        2
        arrow-down
        2
        ·
        5 months ago

        Good. Let them. Fuck Microsoft and literally ALL the crap they’ve produced. After having to deal with their shit for over 30 years I can’t wait for them to finally sink their own boat

  • umbrella@lemmy.ml
    link
    fedilink
    arrow-up
    49
    ·
    edit-2
    5 months ago

    yes please. NO third party should have ring 0 access to your computer.

    bonus: no kernel level anticheat to fuck with linux users

  • Wahots@pawb.social
    link
    fedilink
    arrow-up
    46
    ·
    edit-2
    5 months ago

    Imo, third party companies just shouldn’t have access to the kernel level. Someone is always getting hacked, and having this level of access to potentially hundreds of millions of computers is a huge risk. Especially if it’s for something trivial, like anticheat in Helldivers 2.

      • ReversalHatchery@beehaw.org
        link
        fedilink
        English
        arrow-up
        7
        ·
        edit-2
        5 months ago

        and let someone into the kernel,

        Problem is, that similarly to invasion of privacy, this is not visible, and so they don’t understand what’s happening. It’s just one more program, what could happen? It’s not like somebody coming and inspecting your house, in that it is not noticeable in practice.

        • @ReversalHatchery , I completely agree. My ring 0 is sacred and I can’t prove there isn’t anything in it already, but I wouldn’t knowingly shove third party stuff into my kernel. I like to keep my apps restricted from anything they don’t need on my system in userland. However, millions upon millions of people installed Tencent’s Vanguard to play League of Legends like it wasn’t any big deal (it is). If people want an inner ring security module, I suppose that’s a bit their choice. 🤷🏽‍♂️

    • jonne@infosec.pub
      link
      fedilink
      arrow-up
      4
      ·
      5 months ago

      Yeah, those security agents can become attack vectors themselves, so running them kernel level is nuts.

    • BurningRiver@beehaw.org
      link
      fedilink
      arrow-up
      1
      ·
      5 months ago

      Enterprise level AVs are going to sit in the kernel so they can watch for anomalies in the OS. There are better EDRs out there than Crowdstrike, and virus definitions are an outdated way of detecting anamalous behavior anyway.

  • kubica@fedia.io
    link
    fedilink
    arrow-up
    45
    ·
    5 months ago

    Sure, “restrict” the kernel access. And the first company to be granted the requisites for kernel access, CrowdStrike.

    • r00ty@kbin.life
      link
      fedilink
      arrow-up
      13
      arrow-down
      1
      ·
      5 months ago

      Exactly. Either they’re going to make Windows Defender have the monopoly on antivirus and endpoint protection (EU will shut them down faster than a crowdstrike bluescreen), or they will need to grant the access to those providers.

      If Microsoft think they will be able to curate every single device driver and other kernel module (like antivirus etc) and catch the kind of bug that caused this error? They’re deluded.

      I’ll wait and see what they actually propose before outright ruling it out. But, I can’t see how they do this in any realistic way.

      • WldFyre@lemm.ee
        link
        fedilink
        arrow-up
        1
        ·
        5 months ago

        Either they’re going to make Windows Defender have the monopoly on antivirus and endpoint protection (EU will shut them down faster than a crowdstrike bluescreen)

        How does Apple handle this?

        • r00ty@kbin.life
          link
          fedilink
          arrow-up
          1
          ·
          5 months ago

          How does Apple handle this?

          Really not sure if they have any kernel level antivirus products. Although the same question applies I guess to third party hardware drivers. How are they installed? What privilege level do they run in?

  • Todd Bonzalez@lemm.ee
    link
    fedilink
    arrow-up
    43
    ·
    5 months ago

    They’re going to implement something like eBPF for the Windows kernel. This will allow kernel-level modules to run with zero risk of crashing the kernel. If the module fails, it fails without taking down the kernel with it.

    Linux already has this. It works great. If Windows gets this, all antivirus and anti-cheat software is going to have to transition.

    Once that happens, it will be way easier to add anti-cheat software to Linux that operates the same as on Windows. It may be possible to load and unload it only when playing and actually having competition-grade gaming on Linux.

    Of course, this is a security disaster that I wouldn’t allow on any of my daily drivers, but I would enjoy playing Destiny on my Steamdeck if there’s a legit way for me to do it.

    • baseless_discourse@mander.xyz
      link
      fedilink
      arrow-up
      6
      ·
      edit-2
      5 months ago

      According to wikipedia, both Windows and linux have it, and both are open source.

      Believe it or not, a lot of companies, no matter how cool and secure their marketing sounds, are just seriously incompetent.

  • DrWeevilJammer@lemmy.ml
    link
    fedilink
    arrow-up
    32
    ·
    5 months ago

    My understanding is that EU regulators had an issue because Windows Defender rolled out kernel mode/kernel data protection, which gave Microsoft a de-facto monopoly in that market segment if no one else was allowed to use the same technology in their products.

    Microsoft complaining that the Crowdstrike incident was the EU’s fault is an argument in favor of a Microsoft monopoly, which the EU has been pretty consistently against, and EU opposition to this should not have been a surprise to Microsoft.

    • Hexbear2 [any]@hexbear.net
      link
      fedilink
      English
      arrow-up
      14
      arrow-down
      2
      ·
      5 months ago

      I think that the way we’re splitting up software monopolies is pretty damn ridiculous in this field. I’m Linux gang all the way, but let Microsoft own the OS how they see fit, and especially the kernel, and instead go after the third party hardware vendors being locked into MS contracts. Just make it not legal for third party hardware vendors to sell computers with pre-installed operating systems, and it solves a lot of the monopoly issues. So no more Dell, HP, etc, with forced windows, make the consumer buy the OS separately.

      Could also go after bundling, like OS can’t be sold with office suite software.

      • kboy101222@sh.itjust.works
        link
        fedilink
        English
        arrow-up
        3
        arrow-down
        3
        ·
        5 months ago

        Just make it not legal for third party hardware vendors to sell computers with pre-installed operating systems

        As the “local IT guy”, please no. Please. I have better things to do than to babysit a windows installation every single time someone buys a new computer.

        Plus, having to buy a windows licence on top of already expensive laptops will just drive us faster into the tablet driven hellscape I fear is coming.

    • bountygiver [any]@lemmy.ml
      link
      fedilink
      English
      arrow-up
      3
      ·
      edit-2
      5 months ago

      microsoft could get away with this monopoly accusations by opening up official read-only APIs for that, so you can have antiviruses use it and have a proper procedure for user to give consent for the antivirus to have access to said API.

  • d-RLY?@lemmy.ml
    link
    fedilink
    arrow-up
    22
    ·
    5 months ago

    Probably a good move for them to make tbh. I like how CrowdStrike’s name already sounds like it should be the name of a big malware/virus/zeroday. So we should have seen it coming.

    • Nighed@feddit.uk
      link
      fedilink
      English
      arrow-up
      12
      arrow-down
      1
      ·
      5 months ago

      In that case, the entire windows ecosystem collapses when Microsoft messes up windows defender… at least if its spread out it hurts less people

  • squid@feddit.uk
    link
    fedilink
    arrow-up
    13
    ·
    5 months ago

    A legal precedent should be established to hold companies as large as CrowdStrike liable for their actions. This liability should be significant enough to ensure that future companies will think twice before releasing faulty code. We should not be asking for or supporting Microsoft’s efforts to further lock down their product.

  • Auzy@beehaw.org
    link
    fedilink
    arrow-up
    12
    ·
    5 months ago

    I have no problem with this.

    Norton AV causes SO many issues with the software our clients use for home automation… And not even issues which make sense. And so many AV apps cause nothing but problems

    If they need low level access, they can request a userspace API from Microsoft and wait for it.

    • mudle@lemmy.mlOPM
      link
      fedilink
      arrow-up
      4
      ·
      5 months ago

      You have a point, but if Microsoft completely locks down the kernel, preventing any third party software/driver from running at the kernel-level, Anti-Cheat developers will have to find a new way to implement Anti-Cheat. This may open up the possibility of some newer form of Anti-Cheat being user-space; or at the very least NOT ring 0, which in-turn may open up the possibility of this new form of Anti-Cheat working underneath Linux.

      Or maybe we’re all still screwed because this new form of Anti-Cheat will perform on a basis that trusts that there is no third party access to the Windows kernel because of how restricted it is, therefore nullifying the need to be ring 0, but it still might not work under Linux due to the freedom/access users have to the kernel.

      But then again, in order to implement any third party driver into the Windows kernel, it has to be signed and/or approved by Microsoft first (IIRC). But cheaters get around this through various means. So maybe nothing changes; but if Microsoft DOES restrict kerne-level access, this leads me to think that Anti-Cheat will have to change in some form or another, which may lead to it working on Linux.

      TBH, The only way(s) I see Anti-Cheat moving forward at all, is:

      • Hardware level Anti-Cheat (similar to a DMA card. Maybe it requires a certain type firmware that is universally used across all/most major video game companies)

      • Some form of emulated environment. Maybe like a specific kernel that is used for each game.
        • mudle@lemmy.mlOPM
          link
          fedilink
          arrow-up
          4
          ·
          5 months ago

          I completely forgot about AI Anti-Cheat, lol. But yes, this is another form of Ant-Cheat that seems to be very effective. (Although I don’t much like the idea)