Content deleted Content added
Rescuing 14 sources and tagging 0 as dead.) #IABot (v2.0 |
GreenC bot (talk | contribs) Reformat 1 archive link. Wayback Medic 2.5 per WP:USURPURL and JUDI batch #20 |
||
| (14 intermediate revisions by 10 users not shown) | |||
Line 1:
{{Short description|Security feature of Microsoft Windows}}
[[Image:Kernel Layout.svg|thumb|200px|The [[Kernel (
'''Kernel Patch Protection''' ('''KPP'''), informally known as '''PatchGuard''', is a feature of 64-bit ([[x86-64|x64]]) editions of [[Microsoft Windows]] that prevents patching the [[Kernel (
|url=http://www.microsoft.com/whdc/driver/kernel/64bitpatch_FAQ.mspx
|title=Kernel Patch Protection: Frequently Asked Questions
|publisher=[[Microsoft]]
|date=22 January 2007
|
}}</ref>
"Patching the kernel" refers to unsupported modification of the central component or
Since patching the kernel is possible in 32-bit (x86) editions of Windows, several [[antivirus software]] developers use kernel patching to implement antivirus and other security services. These techniques will not work on computers running x64 editions of Windows. Because of this, Kernel Patch Protection resulted in antivirus makers having to redesign their software without using kernel patching techniques.
However, because of the design of the Windows kernel, Kernel Patch Protection cannot completely prevent kernel patching.<ref name="skape"/><ref>{{Citation |last=dushane |title=PatchGuardBypass |date=2023-04-03 |url=https://github.com/AdamOron/PatchGuardBypass |access-date=2023-04-03}}</ref> This has led to criticism that since KPP is an imperfect defense, the problems caused to antivirus vendors outweigh the benefits because authors of [[malware|malicious software]] will simply find ways around its defenses.<ref name="Samenuk"/><ref name="Gewirtz"/> Nevertheless, Kernel Patch Protection can still prevent problems of system stability, reliability, and performance caused by legitimate software patching the kernel in unsupported ways.
==Technical overview==
Line 23 ⟶ 24:
|publisher=Uninformed
|date=September 2007
|
|archive-url=https://web.archive.org/web/20160303171005/http://uninformed.org/index.cgi?v=8&a=5&p=2
|archive-date=3 March 2016
|url-status=dead
}}</ref> Device drivers are expected to not modify or ''patch'' core system structures within the kernel.<ref name="KPP FAQ"/> However, in [[x86]] editions of Windows, Windows does not enforce this expectation. As a result, some x86 software, notably certain security and [[antivirus software|antivirus]] programs, were designed to perform needed tasks through loading drivers that modify core kernel structures.<ref name="Introduction"/><ref name="Fathi">{{cite web
|url=https://www.theguardian.com/technology/2006/sep/28/viruses.security
|title=Antivirus vendors raise threats over Vista in Europe
|last=Schofield
|first=Jack
|
|date=28 September 2006
|
}} "This has never been supported and has never been endorsed by us. It introduces insecurity, instability, and performance issues, and every time we change something in the kernel, their product breaks." —Ben Fathi, corporate vice president of Microsoft's security technology unit</ref>
In [[x86-64|x64]] editions of Windows, Microsoft began to enforce restrictions on what structures drivers can and cannot modify. Kernel Patch Protection is the technology that enforces these restrictions. It works by periodically checking to make sure that protected system structures in the kernel have not been modified. If a modification is detected, then Windows will initiate a [[Fatal system error|bug check]] and shut down the system,<ref name="Introduction"/><ref name="Patching Policy">{{cite web
|url=http://www.microsoft.com/whdc/driver/kernel/64bitpatching.mspx
|title=Patching Policy for x64-Based Systems
|publisher=[[Microsoft]]
|date=22 January 2007
|
}}</ref> with a [[Blue
Prohibited modifications include:<ref name="Patching Policy"/>
* Modifying [[System call|system service]] descriptor tables
* Modifying the [[interrupt descriptor table]]
* Modifying the [[Global Descriptor Table|global descriptor table]]
* Using kernel [[Stack (abstract data
* Modifying or patching code contained within the kernel itself,<ref name="Patching Policy"/> or the [[Hardware abstraction layer|HAL]] or [[Network Driver Interface Specification|NDIS]] kernel libraries<ref>{{cite web
|url=http://uninformed.org/index.cgi?v=3&a=3&p=7
Line 57 ⟶ 58:
|publisher=Uninformed
|date=December 2005
|
|archive-url=https://web.archive.org/web/20160817074740/http://uninformed.org/index.cgi?v=3&a=3&p=7
|archive-date=17 August 2016
Line 70 ⟶ 71:
|publisher=Uninformed
|date=January 2007
|
|archive-url=https://web.archive.org/web/20160304025651/http://uninformed.org/index.cgi?v=6&a=1&p=25
|archive-date=4 March 2016
Line 84 ⟶ 85:
|publisher=Uninformed
|date=December 2005
|
|archive-url=https://web.archive.org/web/20160817134554/http://uninformed.org/index.cgi?v=3&a=3&p=3
|archive-date=17 August 2016
|url-status=dead
}}</ref> KPP does however present a significant obstacle to successful kernel patching. With highly [[obfuscation (software)|obfuscated code]] and misleading symbol names, KPP employs [[security through obscurity]] to hinder attempts to bypass it.<ref name="Introduction"/><ref>{{cite web
|url=http://uninformed.org/index.cgi?v=6&a=1&p=10
|title=Misleading Symbol Names
Line 95 ⟶ 96:
|publisher=Uninformed
|date=December 2006
|
|archive-url=https://web.archive.org/web/20160303171036/http://uninformed.org/index.cgi?v=6&a=1&p=10
|archive-date=3 March 2016
Line 106 ⟶ 107:
|publisher=Microsoft
|date=June 2006
|
}}</ref><ref name="Microsoft Security Advisory (932596)">{{cite web
|url=http://www.microsoft.com/technet/security/advisory/932596.mspx
Line 114 ⟶ 115:
|publisher=Microsoft
|date=August 2007
|
}}</ref>
Line 122 ⟶ 123:
|url=http://blogs.msdn.com/windowsvistasecurity/archive/2006/08/11/695993.aspx
|title=An Introduction to Kernel Patch Protection
|
|last=Field
|first=Scott
Line 132 ⟶ 133:
|url=http://www.microsoft.com/security/windowsvista/allchin.mspx
|title=Microsoft executive clarifies recent market confusion about Windows Vista Security
|
|last=Allchin
|first=Jim
|
|date=20 October 2006
|publisher=[[Microsoft]]
Line 143 ⟶ 144:
Microsoft's Kernel Patch Protection FAQ further explains:
{{
==Criticisms==
===Third-party applications===
Some computer security software, such as [[McAfee]]'s [[McAfee VirusScan]] and [[
|url=http://uninformed.org/index.cgi?v=4&a=4&p=10
|author=Skywing
Line 155 ⟶ 156:
|publisher=Uninformed
|date=June 2006
|
}}</ref> This kind of antivirus software will not work on computers running x64 editions of Windows because of Kernel Patch Protection.<ref>{{cite news
|first=Elizabeth
Line 163 ⟶ 164:
|publisher=[[PC World (magazine)|PC World]]
|date=6 October 2006
|
|archive-url=https://web.archive.org/web/20070405234445/http://www.pcworld.in/news/index.jsp/artId=4587538
|archive-date=5 April 2007
Line 174 ⟶ 175:
|publisher=[[McAfee]]
|date=28 September 2006
|
}}</ref>
Line 180 ⟶ 181:
|url=http://www.symantec.com/enterprise/products/sysreq.jsp?pcid=1008&pvid=805_1
|title=Symantec AntiVirus Corporate Edition: System Requirements
|
|year=2006
|publisher=[[NortonLifeLock|Symantec]]
Line 189 ⟶ 190:
|url=http://us.norton.com/internet-security
|title=Symantec Internet Security product page
|
|year=2011
|publisher=[[NortonLifeLock|Symantec]]
}}</ref> worked on x64 editions of Windows despite KPP's restrictions, although with less ability to provide protection against zero-day malware.
Antivirus software made by competitors [[ESET]],<ref>{{Cite web|url=http://www.eset.com/products/64bit.php|title=High-performance threat protection for the next-generation of 64-bit computers
|url=https://imperia.trendmicro-europe.com/us/products/enterprise/officescan-client-server-edition/system-requirements/index.html
|title=Minimum System Requirements
|publisher=[[Trend Micro]] USA
|
|archive-date=8 February 2012
|archive-url=https://web.archive.org/web/20120208124040/https://imperia.trendmicro-europe.com/us/products/enterprise/officescan-client-server-edition/system-requirements/index.html
|url-status=dead
}}</ref> [[Grisoft]] AVG,<ref>{{cite web
|url=http://www.grisoft.com/doc/324/us/crp/3
|title=AVG Anti-Virus and Internet Security - Supported Platforms
|publisher=[[Grisoft]]
|
|
|
|url-status=dead
}}</ref> [[Avast Software|avast!]], [[Avira|Avira Anti-Vir]] and [[Sophos]] do not patch the kernel in default configurations, but may patch the kernel when features such as "advanced process protection" or "prevent unauthorized termination of processes" are enabled.<ref>{{cite news
Line 213 ⟶ 217:
|publisher = vnunet.com
|date = 23 October 2006
|
|url-status = dead
|
|
}}</ref>
Line 225 ⟶ 229:
|title=Researcher: PatchGuard hotfix stitches up benefit to Microsoft
|date=19 January 2007
|
|author=McMillan, Robert
|publisher=[[InfoWorld]]
}}</ref> Instead, Microsoft worked with third-party companies to create new [[API|Application Programming
|url = http://technet2.microsoft.com/WindowsVista/en/library/005f921e-f706-401e-abb5-eec42ea0a03e1033.mspx?mfr=true
|title = Notable Changes in Windows Vista Service Pack 1
|publisher = [[Microsoft]]
|year = 2008
|
|url-status = dead
|
|
}}</ref>
Line 243 ⟶ 247:
|last=Gewirtz
|first=David
|
|title=The great Windows Vista antivirus war
|url=http://zatz.com/outlookpower/article/the-great-windows-vista-antivirus-war/
|publisher=OutlookPower
|year=2006
|
|archive-url=https://web.archive.org/web/20130201170559/http://zatz.com/outlookpower/article/the-great-windows-vista-antivirus-war/
|archive-date=1 February 2013
Line 261 ⟶ 265:
|publisher=Uninformed
|date=1 December 2005
|
|archive-url=https://web.archive.org/web/20170801092238/http://www.uninformed.org/?v=3&a=3
|archive-date=1 August 2017
Line 271 ⟶ 275:
|publisher=Uninformed
|date=December 2006
|
}}</ref> and a third report in September 2007 on KPP version 3.<ref>{{cite web
|url=http://uninformed.org/index.cgi?v=8&a=5
Line 278 ⟶ 282:
|publisher=Uninformed
|date=September 2007
|
}}</ref> Also, in October 2006 security company [[Authentium]] developed a working method to bypass KPP.<ref>{{cite news
|first=Matt
Line 286 ⟶ 290:
|publisher=[[eWEEK]]
|date=25 October 2006
|
}}</ref>
Line 296 ⟶ 300:
|publisher = OutlookPower
|year = 2006
|
|url-status = dead
|
|
}}</ref> In keeping with this statement, Microsoft has so far released two major updates to KPP, each designed to break known bypass techniques in previous versions.<ref name="Introduction"/><ref name="Microsoft Security Advisory (914784)"/><ref name="Microsoft Security Advisory (932596)"/>
Line 310 ⟶ 314:
|publisher=silicon.com
|date=25 October 2006
|
|archive-url=https://web.archive.org/web/20070202190644/http://software.silicon.com/os/0,39024651,39163525,00.htm
|archive-date=2 February 2007
Line 317 ⟶ 321:
|url=https://blogs.technet.com/security/archive/2006/08/12/446104.aspx
|title=Windows Vista x64 Security – Pt 2 – Patchguard
|
|last=Jones
|first=Jeff
Line 323 ⟶ 327:
|date=12 August 2006
|work=Jeff Jones Security Blog
|archive-date=9 December 2008
|archive-url=https://web.archive.org/web/20081209034856/http://blogs.technet.com/security/archive/2006/08/12/446104.aspx
|url-status=dead
}}</ref> Still, for other reasons a x64 edition of Windows Live OneCare was not available until November 15, 2007.<ref>{{cite web
|url = http://windowsvistablog.com/blogs/windowsvista/archive/2007/11/14/upgrade-to-next-version-of-windows-live-onecare-announced-for-all-subscribers.aspx
Line 331 ⟶ 338:
|publisher = [[Microsoft]]
|date = 14 November 2007
|
|url-status = dead
|
|
}}</ref>
Line 341 ⟶ 348:
==External links==
*{{usurped|1=[https://web.archive.org/web/20070217053224/http://www.windows-now.com/blogs/robert/archive/2006/08/12/PatchGuard-and-Symantecs-Complaints-About-Windows-Vista.aspx The Truth About PatchGuard: Why Symantec Keeps Complaining]}}
*[https://web.archive.org/web/20061124094344/http://blogs.msdn.com/windowsvistasecurity/archive/2006/08/11/695993.aspx An Introduction to Kernel Patch Protection]
*[https://web.archive.org/web/20070205155710/http://www.microsoft.com/security/windowsvista/allchin.mspx Microsoft executive clarifies recent market confusion about Windows Vista Security]
*[http://www.microsoft.com/whdc/driver/kernel/64bitpatch_FAQ.mspx Kernel Patch Protection: Frequently Asked Questions]
*[https://blogs.technet.com/security/archive/2006/08/12/446104.aspx Windows Vista x64 Security – Pt 2 – Patchguard] {{Webarchive|url=https://web.archive.org/web/20081209034856/http://blogs.technet.com/security/archive/2006/08/12/446104.aspx |date=2008-12-09 }}
'''Uninformed.org articles:'''
| |||