Microsoft bets big on Vista security

Microsoft's Vista developers can't catch a break these days. After years of warnings from security researchers that old code in Windows was creating security risks, the software giant decided to rewrite key parts of the operating system.

The result? Last week, Symantec published a report suggesting that all of this new code will introduce new security problems.

"The network stack in Windows Vista was rewritten from the ground up. In deciding to rewrite the stack, Microsoft has removed a large body of tried and tested code and replaced it," Symantec wrote, noting that it found vulnerabilities in the Windows Vista networking software. Symantec's report can be found here: http://www.symantec.com/avcenter/reference/ATR-VistaAttackSurface.pdf.

"Despite the claims of Microsoft developers, the Windows Vista network stack as it exist today is less stable than the earlier Windows XP stack," said after examining a beta release of the software.

After years of being blamed for countless security problems, Microsoft may be in a no-win situation.

"You get beaten up if you modify the old code; you get beaten up if you write new code," said Russ Cooper, a senior information security analyst at Cybertrust. "The historic complaint against Microsoft has been that their code is bloated with all this legacy stuff. Rewrite it and now, 'this is too new; this is untested.'"

The fact that Symantec was able to discover flaws in a beta release should not raise eyebrows, Cooper said. "There's a reason products are put in to beta, and it isn't because people just want to see the default colors change," he said.

If customers do not ultimately see Vista as a more secure product than its predecessor, however, it will be a disaster for Microsoft -- on an epic scale. Over the past few years, the company has literally reinvented the way it produces software, instituting a new set of software development practices known as the Security Development Lifecycle. It has retrained developers, built a suite of automated security testing tools, and, most remarkably, invited scores of independent researchers to have unprecedented access to early versions of Vista.

"Vista is really the first release of the operating system to go through our Security Development Lifecycle from beginning to end," said Ben Fathi, corporate vice president of Microsoft's Security Technology Unit. "That's fundamentally a different way of looking at building security into the platform."

Microsoft has gone to great lengths to publicize its Security Development Lifecycle, which was used in the development of Windows XP Service Pack 2, and SQL Server 2005. Company executives say that the strict development guidelines used for XP Service Pack 2 played a big role in eliminating the widespread worm virus outbreaks that seemed so common just three years ago.

The emphasis on security is perhaps best illustrated by an event that Microsoft executives have declined to discuss in detail: the recent slip in Vista's ship date.

Last March, Microsoft grabbed headlines by announcing that Vista would not be available in time for the 2006 holiday shopping season, as expected. Microsoft never gave specific reasons for the miss, but it was a major setback for a product that had already been five years in the works. Microsoft immediately reorganized the Platforms & Services Division division responsible for the delay, putting a new executive, Steve Sinofsky, in charge of Windows development

Privately, several sources familiar with Vista's development say that security concerns over Vista's security caused the widely publicized slip in the product's ship date.

In fact, t-shirts reading "I caused Vista to slip," soon became a common site at Microsoft's Building 27, home to the Secure Windows Initiative group. The group is responsible for securing Microsoft's software. "The shirt became very popular on campus," to the chagrin of management, said one source who asked not to be identified.

Fathi isn't saying how much money it has spent on making Vista secure, but judging by the contract work available for penetration testers -- hacking professionals who specialize in poking and prodding systems to unearth vulnerabilities -- it hasn't come cheap.

Although Microsoft will be sponsoring a Vista track at this year's Black Hat USA hacker conference, many of the most prominent Windows security experts are now under nondisclosure agreements, according to Jeff Moss, the show's director. "They've hired pretty much all of the bright people," he said. "So the number of speakers who can actually go out and publicly talk about Windows Vista security has rapidly dwindled."

For Fathi, this is a good thing.

"We believe that we have the largest group of penetration testers ever assembled," Fathi said. "It's costing me a lot of money.... it's worth every penny of course."

Microsoft's design choices will have a big effect on Vista's security as well.

Developers have changed the way Vista runs applications, scaling back the types of things that users can do by default in order to limit the damage that malware can wreak on a system. And they have also changed the way Vista works with the computer's memory -- by fencing off parts of memory and shuffling around the location of Windows functions -- in order to make it harder for hackers to trick the PC into running malicious software.

"When you put all that stuff together, you end up making it a lot harder to write exploits," said Alex Stamos, a researcher who has worked with Microsoft in the past and is a founding partner of Information Security Partners.

This will make life harder for hackers, but it will also present challenges to users and legitimate software developers as well, who may suddenly have problems running their Windows XP code on Vista.

"They're basically breaking binary compatibility with a lot of things," Stamos said. "[This] really does mark a watershed change in thinking, from 'binary compatibility over all,' to security being the most important thing."

As for Symantec's paper, Microsoft downplayed it's importance last week. "The issues they discovered were all addressed in Beta 2," said Stephen Toulouse, a security program manager with Microsoft's security response center.

But it appears that other important parts of Windows are being rewritten. Microsoft plans to talk further about some of the changes to "legacy functionality," at the Black Hat conference, which kicks off next week in Las Vegas, Toulouse said.

He declined to say what, exactly, would be discussed, however. "I'm not going to spoil the content so close to presenting," he said.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Robert McMillan

IDG News Service
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Kurt Hegetschweiler

Brother PocketJet PJ-773 A4 Portable Thermal Printer

It’s perfect for mobile workers. Just take it out — it’s small enough to sit anywhere — turn it on, load a sheet of paper, and start printing.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?