Hacker News Reader

Comment by jpalomaki | Hacker News Reader

From the article: "There is a problem where some anti-virus vendors are using techniques to bypass Kernel Patch Protection by injecting a hypervisor which they use to intercept syscalls and make assumptions about memory locations — memory locations which are now changing with the Meltdown fixes."

Difficult situation for Microsoft. If you install applications which mess with the operating system in unsupported ways you can't expect your system to function correctly with automatic updates. On the other hand, users are likely not aware of what they have done and bricking millions of computers is also not good. Might for example cause a backslash when people stop updating their systems.

This sounds like a quick and dirty fix they put in place while figuring out what to do.

View on HN

I'm not sure it's that difficult for Microsoft. Unless I misunderstand something, the requirement is on the antivirus systems already registered with Microsoft. They had half a year. MS could force vendors to patch their shit in a few weeks by giving them an ultimatum: in January, either you don't interfere with kernel patching, or we're showing your customers "you antivirus is stopping you from receiving latest security patches, consider finding an alternative vendor".

They have reasons for doing it the other way, but I definitely blame them for not standing up to crap AV vendors in this and many other situations.

They could, but this isn't just a technical issue it's also a legal and political issue where several AV vendors are currently suing MS in the EU for alleged anti-trust behavior. So the lawyers compromise everybody's security.

that seems like a fairly questionable blame-shift for MS. If they don't have the guts to provide even that level of protection, yet more reason to shift away from them except for trivial things like gaming.

So if you edit the Kernel on your version of Ubuntu, then Canonical should be held responsible?

That seems like a crazy thought process. You're running software that modifies Window's internal functionality. The vendor knows it's unsupported. How can you blame the company who just made the platform you compromised?

Might as well set your root password to "password" and open it to the public then complain that the security is bad.

In fact your kernel does become "tainted" if you install unsupported kernel drivers (the closest equivalent to what the problematic Windows AVs do). If your support comes from RH, SuSE or similar vendors it usually becomes limited, depending on the kind of taint.

That's definitely one of the reasons to do it the way they have. But it's their choice. They chose to have a technical/security problem rather than a political/legal one. Or specifically they choose the customers to have a problem rather than themselves.

>>> I'm not sure it's that difficult for Microsoft.

Yes it is.

AV use various hacks and exploits to hijack calls to the kernel. How did you think they notify you of an infected file before you open the infected file? The AV intercepts kernel API calls to list and open files.

I wouldn't be surprised if the patch for meltdown/spectre breaks these techniques. Generally speaking, these techniques will crash the system if they didn't work as intended. Microsoft doesn't want AV to BSOD millions of computers so they don't update when they detect an AV. It's perfectly reasonable to me.

Might for example cause a backslash when people stop updating their systems.

So, again, the "where do you want to go today?" company decides "never mind, this is where you are going: we're stopping updates because you might have thought about it."

Reply on news.ycombinator.com