CrowdStrike’s Falcon software uses a special driver that allows it to run at a lower level than most apps so it can detect threats across a Windows system. Microsoft tried to restrict third parties from accessing the kernel in Windows Vista in 2006 but was met with pushback from cybersecurity vendors and EU regulators. However, Apple was able to lock down its macOS operating system in 2020 so that developers could no longer get access to the kernel.
Now, it looks like Microsoft wants to reopen the conversations around restricting kernel-level access inside Windows.
Funny how you can create a microkernel only to then fuck up privileges so bad that software (e.g. graphics drivers, anything running with real-time prio) can easily crash your system without recovery.
The architecture of Windows is both, remarkably good and weirdly underutilized.
Double win for linux
I have no problem with this.
Norton AV causes SO many issues with the software our clients use for home automation… And not even issues which make sense. And so many AV apps cause nothing but problems
If they need low level access, they can request a userspace API from Microsoft and wait for it.
Probably a good move for them to make tbh. I like how CrowdStrike’s name already sounds like it should be the name of a big malware/virus/zeroday. So we should have seen it coming.
They’re going to implement something like eBPF for the Windows kernel. This will allow kernel-level modules to run with zero risk of crashing the kernel. If the module fails, it fails without taking down the kernel with it.
Linux already has this. It works great. If Windows gets this, all antivirus and anti-cheat software is going to have to transition.
Once that happens, it will be way easier to add anti-cheat software to Linux that operates the same as on Windows. It may be possible to load and unload it only when playing and actually having competition-grade gaming on Linux.
Of course, this is a security disaster that I wouldn’t allow on any of my daily drivers, but I would enjoy playing Destiny on my Steamdeck if there’s a legit way for me to do it.
