What is the joke about security, because Im not really able to get it .
Dan
----- Original Message -----
From: “Programmers Society Prokash Sinha”
To: “Windows File Systems Devs Interest List”
Sent: Wednesday, April 14, 2004 9:07 PM
Subject: RE: [ntfsd] Filter drivers vs hooking
> Yes someplaces dont care of “godLike attitude”, they just want to get the
security done, at any and every cost. Hey, for doing that they will pay a
very high price, but giving them some standard architectural bullshit is to
annoy a bunch of credible people who definitely knows what is this damn,
security, and how to circumvent… Really a joke, when some of us talk about
security …
>
> -pro
>
> —
> Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@rdsor.ro
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
Joke is that lot of out of bounce idea being implemented by security, that does not follow architectual procedure(s). And architecture did not support those features. Am I still unclear? If so, then sorry.
-pro
Anyway the PTE tables are at known location, one can reset the protection
flags off the kernel pages and go on hooking.
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com
----- Original Message -----
From: “Don Burn”
Newsgroups: ntfsd
To: “Windows File Systems Devs Interest List”
Sent: Wednesday, April 14, 2004 12:54 AM
Subject: Re:[ntfsd] Re:Filter drivers vs hooking
> Well you cannot be sure you will display the message since the hook could
> stop it. So I guess you advocate, letting something hook the system suck
> the confidential data dry, trash the world so you can never get at your data
> again, and then crash unexpectedly! As I said I’m from an fault tolerant
> background and their you never want to crash, but bottom line is this is one
> of these cases that it is the only safe thing to do.
>
>
> –
> Don Burn (MVP, Windows DDK)
> Windows 2k/XP/2k3 Filesystem and Driver Consulting
>
>
>
> “Brian Hutchison” wrote in message news:xxxxx@ntfsd…
> >> So either you accept the fact that things are hosed
> > > (since no one is supposed to do this) and crash, or you say to heck with
> > > security and data reliability and let the hooker run free
>
> > So is the question “whether it’s better to crash now or maybe crash
> later”? If so, I’ll go with
> > “maybe crash later” every time. There was a great “Peter Pontificates”
> article in an issue of
> > NT Insider that talked about just this topic.
>
> > If it can be detected, why not display a message box saying “Windows has
> detected that
> > non-Microsoft software has performed an illegal operation. Please
> uninstall whatever you
> > have recently installed until this message box goes away.” Microsoft can
> also refuse to
> > provide support when they detect this has been done.
>
>
>
> —
> Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
> You’re missing the point: There’s an architected and supported way to do
certain things
Certain things but not all things. For instance, it is impossible to block EXE
start by pathname without hooking, and there are people who agree to pay for
this.
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com
Max,
Feel free to send them to me, I’ve done it for several customers
without hooking.
–
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
“Maxim S. Shatskih” wrote in message
news:xxxxx@ntfsd…
> > You’re missing the point: There’s an architected and supported way to do
> > certain things
>
> Certain things but not all things. For instance, it is impossible to block
EXE
> start by pathname without hooking, and there are people who agree to pay
for
> this.
>
> Maxim Shatskih, Windows DDK MVP
> StorageCraft Corporation
> xxxxx@storagecraft.com
> http://www.storagecraft.com
>
>
Maxim S. Shatskih wrote:
> Anyway the PTE tables are at known location, one can reset the
> protection flags off the kernel pages and go on hooking.
This will allow hooking under XP. Do you believe it will do the job for
future releases?
Tobias
My natural reaction, and I said it earlier, some are just curious to know hooking, a way of showing or knowing the internals. BTW, internals is internals as long as it is within internal community. Once it is out, it is no longer internals. So knowing the secrets, secrets of the working(s) of NT, is an extreeemly valueable assest(s). A 10K,20K or more price hike to the paycheck… And there are people they want desparate way to get into some new space. Security happens to be one, the earlier you get to it, grab a market share, then move on to fix the architecture. History of PC has numerous example(s). It would be insulting to try jotting down thsoe. And I found that they go first for the architecural approach, soon to be faded away to hack approach, since it was not supported by the architecture. Was it a fault of Microsoft. Damm well, NO. BUT OTHER PEOPLE NEED TO MOVE ON, THEY PUTDOWN THEIR HARD-EARNED MONEY TO MAKE A PROFIT OUT OF IT, THEY DONT WAIT FOR SOMEELSE TO DO THE
GROUND WORK FOR THEM, IT WOULD BE TOO LATE… Then there are customized work, these are excellent, the excellent security people, and for them architecture is pure and simple bullshit, they want something done, and they want by any means. I can almost surely bet that lot of upcoming countries already hacking windows to its bone, so that they can get the gold pots and sell them there. Anything wrong?, I dont see it. I dont think it is. When a commodity becomes as or near popular to free air, every one wants independence. And some of them like to even make a profit of that preserved gold.
You put some restriction(s), that is great. I presonally hate hacked away approach, but been to situation(s), where there was no alternative. Sorry to all champs, but that is the fact. AND YOU PUT MORE ARCHITECTURAL SUPPORT, I BET THERE WOULD BE SOME NEW REQUIREMENTS THAT WOULD NEED HACK AGAIN. Will it end, I dont think I will see in my life time. It is one-third engineering, one-third hack, and one-third magic. That is where we stand as of now, when we talk about beautiful landscape of programming. And this I’ve been seeing over and over again, since the days of IBM370, PC (Andrew schewlman series, Ray dunken … and others>…
-pro
On w2k3 too.
Once I wrote a runtime patch for SCSIPORT to support some lame device which
violated the SCSI spec.
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com
----- Original Message -----
From: “Tobias Sasse”
To: “Windows File Systems Devs Interest List”
Sent: Thursday, April 15, 2004 8:19 PM
Subject: Re: Re:[ntfsd] Re:Filter drivers vs hooking
> Maxim S. Shatskih wrote:
>
> > Anyway the PTE tables are at known location, one can reset the
> > protection flags off the kernel pages and go on hooking.
>
> This will allow hooking under XP. Do you believe it will do the job for
> future releases?
>
> Tobias
>
>
> —
> Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
> > You’re missing the point: There’s an architected and supported way
> to do certain things
However, does “architected and supported” always mean the best way?
Take, for instance, PsSetCreateProcessNotifyRoutine. The documentation
states
“The system can register up to eight process-creation callbacks. Any
driver that successfully registers a callback must remain loaded until
the system itself is shut down”.
How this could be considered the “architected” way?
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Don Burn
Sent: Thursday, April 15, 2004 12:09 PM
To: Windows File Systems Devs Interest List
Subject: Re:[ntfsd] Re:Filter drivers vs hooking
Max,
Feel free to send them to me, I’ve done it for several customers
without hooking.
–
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
“Maxim S. Shatskih” wrote in message
news:xxxxx@ntfsd…
> > You’re missing the point: There’s an architected and supported way
> > to do certain things
>
> Certain things but not all things. For instance, it is impossible to
> block
EXE
> start by pathname without hooking, and there are people who agree to
> pay
for
> this.
>
> Maxim Shatskih, Windows DDK MVP
> StorageCraft Corporation
> xxxxx@storagecraft.com
> http://www.storagecraft.com
>
>
—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: xxxxx@relicore.com
To unsubscribe send a blank email to xxxxx@lists.osr.com
Well we have already had the discussion that once you hook you can never
unhook. I concur that the 8 driver limit is stupid. From comments I have
heard this and the unhook may be being addresses for the PsSetXXX routines.
–
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
“Vitaly Vatnikov” wrote in message
news:xxxxx@ntfsd…
> > > You’re missing the point: There’s an architected and supported way
> > > to do certain things
>
> However, does “architected and supported” always mean the best way?
> Take, for instance, PsSetCreateProcessNotifyRoutine. The documentation
> states
> “The system can register up to eight process-creation callbacks. Any
> driver that successfully registers a callback must remain loaded until
> the system itself is shut down”.
>
> How this could be considered the “architected” way?
>
> - Vitaly
>
Anyway the hooking software will persist, since there is a real-world
market demand for some functionalities, they can be implemented by hooking
only, and so there are sales/marketing people and investors ready to pay for
such development.
I don’t think this can be solved by MS.
Surely this does not mean that it is OK to use hooking if there are
documented means, like, for instance, for firewalls. And I will not recommend
hooking for things which can be developed using the “official” ways.
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com
----- Original Message -----
From: “Vitaly Vatnikov”
To: “Windows File Systems Devs Interest List”
Sent: Thursday, April 15, 2004 9:46 PM
Subject: RE: [ntfsd] Re:Filter drivers vs hooking
> > > You’re missing the point: There’s an architected and supported way
> > > to do certain things
>
> However, does “architected and supported” always mean the best way?
> Take, for instance, PsSetCreateProcessNotifyRoutine. The documentation
> states
> “The system can register up to eight process-creation callbacks. Any
> driver that successfully registers a callback must remain loaded until
> the system itself is shut down”.
>
> How this could be considered the “architected” way?
>
> - Vitaly
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Don Burn
> Sent: Thursday, April 15, 2004 12:09 PM
> To: Windows File Systems Devs Interest List
> Subject: Re:[ntfsd] Re:Filter drivers vs hooking
>
>
> Max,
>
> Feel free to send them to me, I’ve done it for several customers
> without hooking.
>
>
> –
> Don Burn (MVP, Windows DDK)
> Windows 2k/XP/2k3 Filesystem and Driver Consulting
>
> “Maxim S. Shatskih” wrote in message
> news:xxxxx@ntfsd…
> > > You’re missing the point: There’s an architected and supported way
> > > to do certain things
> >
> > Certain things but not all things. For instance, it is impossible to
> > block
> EXE
> > start by pathname without hooking, and there are people who agree to
> > pay
> for
> > this.
> >
> > Maxim Shatskih, Windows DDK MVP
> > StorageCraft Corporation
> > xxxxx@storagecraft.com
> > http://www.storagecraft.com
> >
> >
>
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@relicore.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
> —
> Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
Maxim S. Shatskih wrote:
> only, and so there are sales/marketing people and investors ready to
> pay for such development.
>
> I don’t think this can be solved by MS.
I think MS should provide a common technique for hooking system
services. Something similar to device stacks, with an API to allow
secure and stable hooking. Why has MS developed specific solutions for
Registry filterin, FS filtering and so on, while providing a common hook
interface would serve all of the requirements. Perhaps just bad design
that has become an art.
If MS wants to disallow all hooking by bug-checking the system under
specific conditions (mentioned some time ago), why not asking the
customer about this feature during installation of the OS? Perhaps they
favor our product and consciously disable hooking protection for us?
Tobias
Why is it impossible without hooking?
Certain things but not all things. For instance, it is impossible to block EXE
start by pathname without hooking, and there are people who agree to pay for this.
–
Kind regards, Dejan M. MVP for DDK
http://www.alfasp.com E-mail: xxxxx@alfasp.com
Alfa Transparent File Encryptor - Transparent file encryption services.
Alfa File Protector - File protection and hiding library for Win32 developers.
Alfa File Monitor - File monitoring library for Win32 developers.
> why not asking the customer about this feature during installation of
the OS?
Perhaps they favor our product and consciously disable hooking
protection for us?
Because the average customer probably has no idea what the heck hooking
system services means. The only way I see this as being feasible is to
have a list of software that requires hooking and ask the user, "Do you
use any of this software?". Of course, if some new piece of software
came out after the OS release, you'd need to handle that also. It's
messy.
Adam Landefeld
"This posting is provided "AS IS" with no warranties, and confers no
rights."
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Tobias Sasse
Sent: Thursday, April 15, 2004 11:54 AM
To: Windows File Systems Devs Interest List
Subject: Re: [ntfsd] Re:Filter drivers vs hooking
Maxim S. Shatskih wrote:
> only, and so there are sales/marketing people and investors ready to
> pay for such development.
>
> I don't think this can be solved by MS.
I think MS should provide a common technique for hooking system
services. Something similar to device stacks, with an API to allow
secure and stable hooking. Why has MS developed specific solutions for
Registry filterin, FS filtering and so on, while providing a common hook
interface would serve all of the requirements. Perhaps just bad design
that has become an art.
If MS wants to disallow all hooking by bug-checking the system under
specific conditions (mentioned some time ago), why not asking the
customer about this feature during installation of the OS? Perhaps they
favor our product and consciously disable hooking protection for us?
Tobias
---
Questions? First check the IFS FAQ at
The NT Insider:Windows NT Virtual Memory (Part I)
You are currently subscribed to ntfsd as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com
> ----------
From: xxxxx@lists.osr.com[SMTP:xxxxx@lists.osr.com] on behalf of Adam Landefeld[SMTP:xxxxx@windows.microsoft.com]
Reply To: Windows File Systems Devs Interest List
Sent: Thursday, April 15, 2004 9:23 PM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] Re:Filter drivers vs hooking
> why not asking the customer about this feature during installation of
the OS?
> Perhaps they favor our product and consciously disable hooking
protection for us?
Because the average customer probably has no idea what the heck hooking
system services means. The only way I see this as being feasible is to
have a list of software that requires hooking and ask the user, “Do you
use any of this software?”. Of course, if some new piece of software
came out after the OS release, you’d need to handle that also. It’s
messy.
Another possibility is something as current driver signing options: Allow / Warn / Block and maybe a user-defined list of exceptions from rule. No problem if hooking is blocked by default but there should be a way how to change it. It is user’s desicision what kind of software wants to use. Don’t underestimate users (in both good and bad direction :).
Best regards,
Michal Vodicka
UPEK, Inc.
[xxxxx@upek.com, http:://www.upek.com]
Michal,
I agree that it should be up to the user what software he/she runs, but
it's important to avoid unnecessary confusion :).
Something along the lines of driver signing, as you mentioned, seems
like a reasonable solution; especially since the average user would not
run into this very often. Only have to deal with it when you install
the software instead of exposing the choice to every user who installs
the OS.
Adam Landefeld
"This posting is provided "AS IS" with no warranties, and confers no
rights."
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Michal Vodicka
Sent: Thursday, April 15, 2004 12:41 PM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] Re:Filter drivers vs hooking
Another possibility is something as current driver signing options:
Allow / Warn / Block and maybe a user-defined list of exceptions from
rule. No problem if hooking is blocked by default but there should be a
way how to change it. It is user's desicision what kind of software
wants to use. Don't underestimate users (in both good and bad direction
:).
Best regards,
Michal Vodicka
UPEK, Inc.
[xxxxx@upek.com, http:://www.upek.com]
It would help if Microsoft finally decided that security was something
useful and necessary, instead of just press release fodder. The ability
to inhibit the execution of programs, ActiveX, Java Scripts, and Java
applets is mandatory. Maybe a ask first and then permit while allowing
the knowledgeable to view macro source would be better. Macros that can
cause other programs such as Office to run activities for them are also
important. There should be one setting in the OS that says: “Do not run
anything without my explicit approval”. Other options for signed
applications, scripts, etc. are a good thing to improve the user’s
experience with the OS.
A file system filter can detect the opening of an executable, though it
does require reading parts of the file to detect its format. The filter
can also detect new processes being created and look for the file opens
to also check all DLLs, also. Hooking is easier and an executable hook
that allows unloading is a better way to protect the system, but it
currently doesn’t exist. Having written security software from the
MS-DOS 2.x time frame, it was much easier back then.
I use Norton’s Internet Security and don’t use the default settings. I
use the “ask before doing” option for most things. I am fairly sure
that I would not like all the design decisions required to implement the
product, but you can’t run a Windows system without a good software
firewall. I also use a cable/DSL router with NAT and firewall, but
while it stops most accesses, it is not the complete solution. One
trick I like from Norton is the ability to modify the rules for Outlook
Express and prevent access to the HTTP ports by that program. It stops
all the porno pictures from popping up and keeps web bugs from reporting
that my email address is active.
A major problem is user education. Far too many users just want to use
the computer to do another job, and in some ways this is becoming close
to having the untrained make nitroglycerine. It is our job to secure
the system while keeping it easy to use. We need to think about the
implications of every ‘feature’ we provide them. Enabling minimal
features as the default is probably a good idea.
“Adam Landefeld” wrote in message
news:xxxxx@ntfsd…
Michal,
I agree that it should be up to the user what software he/she runs, but
it’s important to avoid unnecessary confusion :).
Something along the lines of driver signing, as you mentioned, seems
like a reasonable solution; especially since the average user would not
run into this very often. Only have to deal with it when you install
the software instead of exposing the choice to every user who installs
the OS.
Adam Landefeld
--------------
“This posting is provided “AS IS” with no warranties, and confers no
rights.”
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Michal Vodicka
Sent: Thursday, April 15, 2004 12:41 PM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] Re:Filter drivers vs hooking
Another possibility is something as current driver signing options:
Allow / Warn / Block and maybe a user-defined list of exceptions from
rule. No problem if hooking is blocked by default but there should be a
way how to change it. It is user’s desicision what kind of software
wants to use. Don’t underestimate users (in both good and bad direction
:).
Best regards,
Michal Vodicka
UPEK, Inc.
[xxxxx@upek.com, http:://www.upek.com]
David J. Craig wrote:
> I use Norton’s Internet Security and don’t use the default settings.
> I
> use the “ask before doing” option for most things. I am fairly sure
> that I would not like all the design decisions required to implement
> the product, but you can’t run a Windows system without a good
> software
> firewall.
You can, if you are willing to install all the latest patches. Personal
firewalls will not protect you from bugs introduced by trustful
applications. Once such a bug gets exploited by malware, your PC is
compromised and no longer secure in any way. There are a lot of viruses
exploiting such bugs and afterwards attacking the personal firewalls.
I’m no professional on this topic, but I’ve seen lists of programs
exposing that kind of problems of personal firewalls. Wether the viruses
try to crash the GUI, programmatically handle the dialogs, or directly
utilize the network adapter. On the other hand personal firewalls have a
disposition to introduce new security issues. There are a couple of
examples documented on the web, just google for them.
I use a personal firewall myself. It’s spam protection and monitoring
network trafic. But it has nothing to do with security.
To get back to the topic: Maybe it’s no good idea to implement security
on the base of alike just-in-time dialogs.
Tobias
The registry hooking API documentation will be apart of the next DDK and
IFSKit.
Neal Christiansen
Microsoft File System Filter Group Lead
This posting is provided “AS IS” with no warranties, and confers no
rights.
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Tobias Sasse
Sent: Wednesday, April 14, 2004 10:24 AM
To: Windows File Systems Devs Interest List
Subject: Re: [ntfsd] Filter drivers vs hooking
I’d like to apologize for posting to this list using my badly configured
mail client. Please allow to post my questions again, since they’re of
great interest for me. So here it goes…
Neal Christiansen wrote:
> Note that we are in the process of making the Registry “hooking” APIs
> publicly available.
Hello Neal, I’m curious about the registry hooking APIs and would
appreciate if you could answer some questions.
When will they actually be available? Or better, what do I have to do to
receive a preliminary version asap?
Will there be documented ways to filter other functions besides the
registry related?
Thanks
Tobias
—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com
> David J. Craig wrote:
>
> > I use Norton’s Internet Security and don’t use the default settings.
> > I
> > use the “ask before doing” option for most things. I am fairly sure
> > that I would not like all the design decisions required to implement
> > the product, but you can’t run a Windows system without a good
> > software
> > firewall.
>
> You can, if you are willing to install all the latest patches. Personal
> firewalls will not protect you from bugs introduced by trustful
> applications. Once such a bug gets exploited by malware, your PC is
> compromised and no longer secure in any way. There are a lot of viruses
> exploiting such bugs and afterwards attacking the personal firewalls.
If you go on like this w.r.t Security, you will finally throw your computer
to
dustpan and go away, since there will be always some security holes due to
many
good and bad reasons :-).
- Hardware should be in secure place
- Software which is embedded inside hardware should be secure
- OS Should be secure
- Each Application which we Run in that OS should be secure
- The one who uses PC should know about security
etc…
Due to many good and bad reasons, Many products which we see in market is
the result of Many
Inexperienced peoples output. If somebody wants to develop something better,
needs to know and
think in wider angle difficult one).
We have more products in Market which is developed by Less-Knowledgeable
peoples then More
knowledgeable peoples. Many reasons like : Company wants to sustain in
market, It is difficult
to get good knowledgeable peoples in Market, and many more good and bad
reasons.
As we release more versions in the market, One way we can say that product
is improving and
other way it leads to more security problems and will be disorganized. We
expect patches so fast
for some security problems, the developer i don’t know how far he is going
to think in all the angle(Future/Past).
I guess, This is never ending story. 
Regards,
Satish K.S