Wrong. Microsoft has added features into the kernel that prevent device drivers (rootkits) from modifying the kernel in such a way that effects such as this can be caused. This is good.

Certain drivers, among others Daemontools and Alcohol (!!), absolutely require this technique. Without it, hiding an emulated DVD-drive with a game backup from a game that employs blacklisting to prevent you from using a backup image of the game disc - or playing a pirated copy of the game - is no longer possible, Alcohol and Daemontools cease to work.

For these reasons, Microsoft can and WILL allow certain, certified drivers to do the same things that the Sony BMG rootkit does now to hide itself and Alcohol and Daemontools use to sneak past game copy protections. But what's more likely to be certified by Microsoft? A program (Daemontools) written by a single developer or small company, that has become illegal in some countries (e.g. Germany) and is invalueable to anyone who can't play his or her game from the original medium for whatever reason; or a program that is going to be distributed by a huge corporation such as Sony BMG that infringes on the user's right to know what's happening with his or her computer?

Call me pessimistic, but I expect to see an x64 version of the Sony BMG rootkit, completely certified by Microsoft, to hit the market a lot sooner then Alcohol or Daemontools for Windows XP 64.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/newsbriefs/34/74#74