Fergie's Tech Blog

Agnitum: Microsoft Kernel Patch Protection Endangers Security Vendors

Alex Eckelberry writes on the Sunbelt Software blog:

Interesting post by the ubercoders at Agnitum on Kernel Patch Protection (a new security feature introduced by Microsoft for 64–bit systems):

New security measures introduced by Microsoft under the name "Kernel Patch Protection" are being presented to the world as bringing a new level of security to users. This security will be provided by a combination of Microsoft security software and Windows operating system kernel design.

Agnitum security experts have analyzed these new measures, and it is their informed opinion that these measures will actually cause more harm than good, for two primary reasons:

• It will be more complicated for third-party security software companies to install and maintain their software on Windows PCs. In some circumstances, kernel patch protection may even block the installation of third-party security software.
• It will be easier for hackers to share and use this new technology than for legitimate software developers.

posted by Fergie @ 7/27/2006 10:20:00 AM