Microsoft: No more Windows patches at all if your AV clashes with our Meltdown fix
Microsoft: No more Windows patches at all if your AV
clashes with our Meltdown fix
Your antivirus must be compatible with Microsoft's
Meltdown-Spectre fixes for you to get patches this month or in future.
By Liam Tung | January 10, 2018 -- 13:28 GMT (05:28 PST)
| Topic: Security
Microsoft won't let you install future security updates
until your antivirus vendor sets a specific registry key that certifies
compatibility with Windows.
As part of this week's security updates for the Meltdown
and Spectre CPU attacks, Microsoft required that all third-party antivirus
vendors confirm compatibility with its CPU fixes and then to set a registry key
in their products to certify compatibility. Without the key being set,
Microsoft's security update simply won't install.
Microsoft has now clarified that this new rule will apply
to all future security updates and means users running non-conforming
third-party antivirus won't be protected by Microsoft's future patches.
"Customers will not receive the January 2018
security updates (or any subsequent security updates) and will not be protected
from security vulnerabilities unless their antivirus software vendor sets the
following registry key", Microsoft's updated support page says.
A point to clarify though is that Microsoft won't enforce
this requirement indefinitely, but rather only until it sees enough machines
have applied the January 3 CPU fixes. As it notes in the FAQ on the issue:
Microsoft added this requirement to ensure customers can
successfully install the January 2018 security updates. Microsoft will continue
to enforce this requirement until there is high confidence that the majority of
customers will not encounter device crashes after installing the security
updates.
During testing of the patches for the two attacks,
Microsoft discovered some antivirus had been making "unsupported calls
into Windows kernel memory" that stop a machine from booting or cause blue
screen of death (BSOD) errors after the patch is applied. To avoid this issue,
it introduced the new rules.
Security researcher Kevin Beaumont has compiled a list of
antivirus products that are both compatible with Microsoft's CPU update and
have the required Windows registry key set correctly. As ZDNet reported earlier
this week, some vendors are doing both, while others have only confirmed
compatibility.
However, it seems conventional antivirus products meet
both requirements, while next-generation security products have only confirmed
compatibility.
Microsoft says the new rule means users running
non-conforming third-party antivirus won't be protected by its future patches.
Beaumont said Microsoft is using the new certification
process to prevent antivirus vendors bypassing Microsoft's Kernel Patch
Protection, which it introduced in 2007 to defend against rootkits.
As he notes, the bypass technique some vendors are using
is similar to the way rootkits work, which involves injecting their product
into a Windows hypervisor to intercept system calls to memory locations that
Microsoft changed in response to the Meltdown attack.
"Because some antivirus vendors are using very
questionable techniques they end up [causing] systems to blue screen of
death -- aka get into reboot loops. This shouldn't be possible in the latest
operating systems, but some antivirus vendors have managed it by taking themselves
into the hypervisor... Antivirus makers really shouldn't be messing with
systems like this."
He estimates there are five key vendors that use this
technique. Beaumont argues Microsoft should set a date for when it will no
longer require the compatibility registry key or risk a large number of
machines going without patches. On the flip side, the vast majority of consumer
PCs would not be using next-gen security products.
Currently, the list of fully compatible antivirus
currently includes Avast, AVG, Avira, Bitdefender, ESET, F-Secure, Kaspersky,
Malwarebytes, Sophos, and Symantec. McAfee, Trend Micro, and Webroot are among
the firms that will soon join this group.
However, next-gen security providers including
CrowdStrike, Cylance, FireEye, and Palo Alto Networks have only confirmed
compatibility but so far haven't been willing to set the specific registry key.
Next-gen providers claim they're not setting the registry
key because they don't want to risk causing a BSOD in the event a customer also
has other antivirus software installed.
A problem with next-gen providers not setting the
registry key is that their products used to be sold as an addition to legacy
antivirus, but are now being sold as the primary antivirus.
So customers who've made that switch must manually set
the registry key to install the updates, something that Microsoft says should
only be undertaken with extreme caution.
Update, January 11: CrowdStrike confirms that it has now
set the registry key.
Comments
Post a Comment