Windows 8

Apple iOS 7 makes some users literally SICK. As in puking, not upset

Excessive zoom and 3D-effect graphics in Apple's latest iOS is leaving some users reaching for the sick bucket

You know who else hates Windows 8? Hackers

Antivirus makers heap praise and scorn on new security features

Internet Security Threat Report 2014

Microsoft's emphasis on the mobile nature of Windows 8 and its bold touch-friendly user interface may lead some to fear the software giant has taken its foot off the pedal in terms of security.

However there are plenty of changes under the bonnet to merit an examination of the new operating system's defences. Judging by the buzz among security researchers and IT dept bods, the most interesting changes are: the built-in tool Windows Defender now tackles all kinds malware rather than just spyware; the use of digital certificates to ensure the machine doesn't boot up a compromised or tampered Windows installation; and the new Early Launch Anti Malware (ELAM) system that scans the operating system for malware and ensures antivirus software is the first thing to run on a freshly booted computer.

That's according to Aryeh Goretsky, a top brain at security software biz ESET, who wrote up his thoughts in a whitepaper [PDF] titled Windows 8: FUD for thought. He is broadly positive about Windows 8's security improvements.

Most Windows 8 machines will ship with Windows Defender, a rebadged version of Microsoft Security Essentials, included. Goretsky describes it as a good product that offers a "decent level of protection", especially when compared against other free anti-malware programs, if not paid-for products from the likes of, er, ESET. His verdict:

Windows Defender provides a good level of protection, but is mainly targeted at those who are unwilling - or unable - to purchase a commercial anti-malware solution. While any protection is better than none, and Microsoft is to be applauded for including a product of this caliber in Windows 8, Windows Defender should be thought of as the minimum bar for levels of protection and support that computer users should expect from their anti-malware software.

An advantage that Windows Defender has over other free anti-malware programs is that it does not attempt to up-sell the user to a paid-for product and toolbars or banner advertisements, nor does it modify existing search settings.

A big change in lower levels of Windows 8 is the requirement for computer makers to switch from using PC BIOS firmware in their machines and use UEFI firmware instead. UEFI, which powers up the computer and helps the operating system access some of the hardware, isn't particularly contentious, but it does have a feature called Secure Boot that Microsoft has wielded with gusto. Secure Boot prevents a computer from running an operating system unless its boot loader code is digitally signed with a key stored in the UEFI firmware.

Blocking unsigned startup code can effectively prevents malicious software, such as rootkits that spy on users, from hijacking the boot process to ensure it remains hidden from detection. But the technology also makes it difficult for free software enthusiasts to run GNU/Linux and other alternative operating systems on machines certified to run Windows 8.

Red Hat and Ubuntu-maker Canonical Ubuntu have come up with ways to support UEFI's Secure Boot. While Microsoft has said that although the ability turn off Secure Boot must be present in order to pass Windows 8 certification tests, the technology must be enabled by default. Goretsky argues that open-source loyalists critical of Secure Boot should lay off and recognise that the technology is the best available to combat an all-too-real threat. Goretsky, a Microsoft "Most Valuable Professional", wrote:

While it’s too soon to know the long-term effects on security of Microsoft’s Secure Boot requirement, in the short term it greatly reduces the attack surface currently exploited by bootkit forms of rootkit malware on systems using BIOS-based firmware.

It is disappointing that Microsoft’s efforts to repair the hole in the chain of trust of the PC boot process, which has been in existence for two decades, is being met with skepticism and outright hostility at a time when sophisticated attacks are on the increase. We hope that Microsoft and the critics of its stance on UEFI can work out their disagreements so that the security of all operating systems, not just Microsoft Windows, can be enhanced.

Microsoft's stance on Secure Boot has been much debated, but one security feature in Windows 8 that has so far drawn little comment is the Early Launch Anti Malware (ELAM) system. This sits in a software layer just above the secured boot process, and ensures a configured anti-malware product is the first third-party code to run while the operating system is still loading - heading off viruses and other nasties before they can compromise a system.

Goretsky describes it as a potential useful tool against sneaky forms of malware, such as bootkits, that try to hide on infected machines:

While the effectiveness of ELAM is as yet unproven, the concept behind it is fundamentally sound and it should prove to be a major deterrence to boot-time malware. The technology, however, may need to be periodically updated to overcome existing limitations and provide additional functionality. Advanced functionality for memory and disk manipulation would be useful for enhancing the detection and removal capabilities of anti-malware programs.

Remote control for virtualized desktops

More from The Register

next story
Microsoft to bake Skype into IE, without plugins
Redmond thinks the Object Real-Time Communications API for WebRTC is ready to roll
Mozilla: Spidermonkey ATE Apple's JavaScriptCore, THRASHED Google V8
Moz man claims the win on rivals' own benchmarks
Microsoft promises Windows 10 will mean two-factor auth for all
Sneak peek at security features Redmond's baking into new OS
FTDI yanks chip-bricking driver from Windows Update, vows to fight on
Next driver to battle fake chips with 'non-invasive' methods
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
Ubuntu 14.10 tries pulling a Steve Ballmer on cloudy offerings
Oi, Windows, centOS and openSUSE – behave, we're all friends here
Apple's OS X Yosemite slurps UNSAVED docs into iCloud
Docs, email contacts... shhhlooop, up it goes
Was ist das? Eine neue Suse Linux Enterprise? Ausgezeichnet!
Version 12 first major-number Suse release since 2009
prev story


Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.