Comment on Microsoft is moving antivirus providers out of the Windows kernel. Hopefully anti-cheat will be next

LedgeDrop@lemmy.zip ⁨1⁩ ⁨day⁩ ago

• Godort@lemmy.ca ⁨1⁩ ⁨day⁩ ago

  I believe that’s just fear-mongering. This has been a thing that Microsoft has wanted to do for a while, largely because having 3rd party code with direct kernel access is a huge problem in terms of stability and security unless you can be sure you know what all that code is doing.

  They tried to do this in the past, arguing that anything that wanted kernel-level access had to Windows API calls instead, however Windows Defender which was bundled with the OS was exempt from this restriction. The EU argued that it gave Microsoft a competitive advantage in the AV space and mandated that if they wanted to do this, they had to follow their own rules which MS was not willing to do.

  Instead, Microsoft dictated that any code that was going to run in the kernel had to be submitted to Microsoft for review, who would then approve or deny the code for use. The problem with this method is that it’s slow, so any AV that wanted to update their engine had to go through a code review process every time. Crowdstrike (and likely every other AV provider) got around this by having a component of their software with kernel-access that could read in data dynamically. This is what caused that worldwide BSOD problem a couple years back. The Crowdstrike component with kernel access loaded in a bad update that was not properly reviewed and it broke every system with the AV installed.

  Overall, this change is a good thing and will force software vendors to actually operate securely rather than just asking for ring 0 access when they don’t need it. As always, if you’re worried about the changes MS is making, Linux is available and getting better day by day.

  source

  • LedgeDrop@lemmy.zip ⁨1⁩ ⁨day⁩ ago

    I hope that it’s fear-mongering.

    I tried to justify the technical reasons here, but the tl;dr is it possible for windows 11 to verify that the OS and hardware are “unmodified” (aka “attestation”).

    They tried to do this in the past, arguing that anything that wanted kernel-level access had to Windows API calls instead, however Windows Defender which was bundled with the OS was exempt from this restriction.

    True but attestation is a different beast. It’s just a hardware check that “everything is unmodified”. Any/all software vendors can use it. Windows Defender was a “duplication” of functionality (hence the EU smackdown).

    However, as Microsoft has already integrated attention into Windows 11 (restricted to verifying security patches, for the moment) - it’ll be easier for them to repackage attestation into a simple API that software vendors (games/apps/even websites) and use (if attestation.check(‘basic’) == true; then run; else exit).

    This “simple” check is what software companies have been wanting for years: a way to guarantee that users are running their software in the way that the software companies want you to be running it (meaning unmodified).

    The OPs original question was about removing anti-cheat - which I’m confident will happen and will be replaced with attention (as it already exists for android, John deere, iphones, etc).

    Your points about virus scanners is different: I think virus scanners, although technically not necessary (after attestation is mandatory) - they will still exist, simply because virus scanners is a 40+ Billion Dollar industry. Microsoft cannot/will not piss of those companies “just because they can” - it would be in the shareholders best interests for Microsoft to throw the virus scanner companies a bone, allow them an isolated space to do their thing, charge them for the privilege, and require that Microsoft verifies that the virus scanner is untampered.

    source
• dogs0n@sh.itjust.works ⁨1⁩ ⁨day⁩ ago

  I don’t think it would go that far, I don’t think they can go that far? Stopping people from editing text files basically is what you are saying?

  source
• x00z@lemmy.world ⁨1⁩ ⁨day⁩ ago

  You realize this’ll occur at the expense of Microsoft treating the user as an untrustworthy enemy.

  What do you mean? Take away your ability to create drivers? Because it’s already extremely limited and you need to get signed. I guess this “change” would just mean not signing any new antivirus drivers.

  This means modding (even for offline play) will not be allowed. Heck, even modify ini files might be viewed as “hacking”.

  That’s a completely wrong take. Whether or not an anticheat runs in the kernel or not does not mean people can just go and edit their files. Even with a kernel level anticheat people can already do that if the driver is not running. The correct way is to do purity checks during connection to an online server, and only allow serverside code to update the gamestate. Any texture file hacks and local purity bypasses for those would need to be caught by the userland anticheat, like it has been done for ages. Not the best solution, but far more privacy friendly.

  I agree removing the need for anti-cheat in principal sounds nice, but this means archiving games or porting them to “unsupported platforms” will be relics of the past.

  Another weird take. Are you talking about the anticheat not being installable anymore? Because even if a game comes with a kernel level anticheat it would need a valid certificate, so any dead game would eventually have this problem regardless of it being allowed to install the driver. Porting games would in almost all cases get rid of the anticheat or somehow null it, disable any custom servers from forcing a valid anticheat, stuff like that. And archiving would be much easier without any anticheat at all, again regardless of kernel anticheat or userland anticheat.

  MUCH better solutions against hacker are to use all this amazing machine learning stuff on the server side, put more power back into the hands of admins and their selfhosted servers, and handle reports about hackers better and faster.

  source

  • LedgeDrop@lemmy.zip ⁨1⁩ ⁨day⁩ ago

    Thanks for the well thought response, you made quite a few points, but let me try to clarify where I’m coming from:

    Windows 11 requires all computers to have TPM 2.0. It’s a crypto chip used for allowing vendors (re: Microsoft) to add secure keys at a hardware level, which will then allow software to verify that the software, operating system, and hardware are “unmodified”.

    In a nutshell this process for allowing software to ensure that the OS and hardware are not compromised nor modified is called “attestation”.

    And it’s something Google has (successfully) introduced into Android and they’re now “turning the screws” .

    This means that the Windows of the near future, will begin to “limit access” to the OS (ie: kick people out of the kernel), only allowed signed device drivers, etc.

    The next step will be restricting “sideloaded apps” and funnel people through the “officially supported apps store”. Once that happens, sideloading will either be removed or crippled.

    When it comes to gaming: there won’t be any need for anti-cheat measures, because Microsoft will know (and will disable itself or the app) if you’ve modified the OS or any app/game (this could include installing a game on a newer or older version of Windows)

    This is the future of computing. It’s already happening to cellphones. I’d read a great article (that I, sadly, cannot find) that talks about how technology like attestation have software vendors treat the user as an untrustworthy person. The upshot, for the user, is that if they get infected will malware or a virus the OS will know and will react accordingly. The downside, for the user, is that the freedom we have today - to install or configure our OS to our liking will be a thing of the past.

    These changes won’t happen overnight, but it has and will be a slow boil.

    source

    • x00z@lemmy.world ⁨1⁩ ⁨day⁩ ago

      I think that’s a very big stretch and I don’t think we’ll see that any time soon. Microsoft is already losing market share and they can’t do much more of this type of stuff because more and more people are getting annoyed. (Including ones with a following such as PewDiePie)

      Anyways, Linux is great.

      source