Rollbacks ad (FYI)

[nexstar]

Originally Posted by Owl

*If* you gan get code to run at a high enough privilege then you can get access to the hardware directly without any driver involvement, which is why it is impossible to guard against absolutely everything. The way an AV suite protects against zero-day attacks is to screen the code for anything that might be subversive before it gets a chance to run, and the way the attackers get around that is to hide the code as data (possibly in the link stack) so the AV doesn't know about it in advance.

So is something like UAC the only real safeguard? Notwithstanding that UAC can be disabled by the user, of course.

Originally Posted by Owl

If it was possible to protect the system just by switching off accesses, don't you think it would have been done by now?

Well, call me old-fashioned but, an option which calls itself 'Disable direct disk io' gives the impression that's exactly what it does/did. But I should know better by now than to believe everything I read .

What about the BIOS options which are available on some PC's to protect the MBR? If something writes direct to hardware does it really do that or does it use bios routines to do it. If it writes direct then doesn't it need to know something about the hardware it is writing to?

I think I preferred it when I didn't know it was all hopeless .

Graham

[Owl]

Originally Posted by nexstar

What about the BIOS options which are available on some PC's to protect the MBR?

I'm on slightly shakier ground here, but as far as I understand it the recent versions of Windows don't bother with the BIOS once it has been used for the initial boot activities (getting the machine powered up and accessing the MBR).

The BIOS was a clever way of having an adaptable hardware architecture and it was vital in the early days of the PC, but now that PC hardware is more-or-less standardised Windows does away with that layer to improve performance.

However, again discussions about the BIOS are irrelevant because the BIOS is just another software layer and all it does is to provide a library of services you can call in your software (including the software called The Operating System) to save you the bother of writing your own direct access routines. What's more, you don't have to know anything about the file system to be able to find the MBR and read it or write to it!

As I see it the only possible way to lock the MBR is for the disc controller HARDWARE to implement some kind of passworded interlock on writes to the MBR. This concept could be extended to an entire disc partition, so that the whole OS was locked down, but Windows would have to be re-implemented to not be self-modifying (or at least the log files, registry, and so on would have to move to a different partition), and users would have to give up the flexibility that an adaptable OS gives you. Then you can call it a Mac.

As long as you run Windows with a user account there is already an sort-of interlock on the OS, and you know what it's like: "Java Update is available". Go away. "Java Update is available". Sod off. "Java Update is available" Dammit, anything for a quiet life. (All that sort of thing will be turned off when I eventually get around to commiting to my "final" build, but then I will have to remember and commit time to manually initiating updates.)

[nexstar]

Originally Posted by Owl

As long as you run Windows with a user account there is already an sort-of interlock on the OS, and you know what it's like: "Java Update is available". Go away. "Java Update is available". Sod off. "Java Update is available" Dammit, anything for a quiet life. (All that sort of thing will be turned off when I eventually get around to commiting to my "final" build, but then I will have to remember and commit time to manually initiating updates.)

Had just that scenario this morning . Thanks for the insight, Owl (good name!). It does feel sometimes like we've painted ourselves into a very large corner with the PC.

Graham

[nexstar]

Originally Posted by nexstar

There used to be an option to “Disable direct disk IO” which....

.......seems to have made a comeback in the latest build .

Graham