okay I didn't really get the first part but I' guessing you're reffering to the APIs MS put out for security products? or was it something else? omg....
sorry wrote in the wrong section...
here is like it should have been..
well acording to what i know there are api's which make it able to secure the kernel without such patching
it might be weaker protection but it is better than nothing...
to me kernel patching is bad thing (coming at this from the a security and stability standpoint) because your are messing with the core of windows itself and any bug in their kernel drivers can cause massive consequences (and as you with every bug there is a possibility of exploit)......
anywho problem is that patchgurd can be bypassed by any malware author,irony is that a legit company can't do that.not the biggest of deals unless you're only dependant on HIPS alone.
yes that is true (there is a well laid out article on the code project that i really like..
)
but this is the first step (it seems) of locking the kernel down and preventing access from anyone unauthorized to do so...
patchguard feels to me more like a bandaid (blocking the good guys from patching, while the bad guys can still get in)
my prediction is that we will end up with some sort of hypervisor protection scheme (which will no doubt have its bugs too) which is that we need, something above the kernel enforcing protection upon it (that cant be too easily accessed)...
and of course using no security thorough obscurity (but i doubt that will happen...
I'm not taking any stand on kernel patching but almost every(if not all) anti malware products used it,specially HIPS applications,well HIPS kinda need it since they stop threats at runtime
yes and i have heard accounts from a number of people having bsod's and amoung other things because of this (eventually their code matures and is more stable but you still see bsod's by AV's kernel drivers happening in xp...)
i mean Microsoft isnt perfect either but at least they know this way when they need to patch the kernel they know that none of the av vendors are in there hooking the kernel and if they patch something it will not break or BSOD because something is not patching the kernel (unless of course malware is there but then again you should have a hips or a heuristics to counter such things)...
and i do remember the times when KPP was not around (as i used to a very secure hips/firewall called core force which i used before comodo's early betas...
) they also use KP and with that style of protection and with enough knowledge (which is what you really need with such a advance product as this one) nothing and i mean nothing should should get into your computer and execute without your approval (it was also incredibly flexible, i kinda actually wished UAC would have a more simpler version of this (im pretty sure it would have been seen better if was more flexible...
))
so just imagine if something hooks the kernel the security product can't do shii bout it cuz its locked out of the kernel.so there is a bit of an issue there.
yes and like i said this is just a step (as i think of it) to a more robust solution like hypervisor protection
lol yeah read that before.haven't used symantec in 6 or moar years
i really do like their corporate products but recently (with a Endpoint protection feature not compatible with vista, forgot which one though) i changed to using more "the user in control" approach (as of now, using noscript and carefully checking whether to allow scripting or not, and adblock plus and nothing else apart from UAC and the Winfirewall, i have not been exploited by malware[expecpt that firefox heap bug, which i initiated downloading from millw0rm and executing the script, but then again no payload was there...
] out there in the web)
Please elaborate =)...
