While we reported that Microsoft will be introducing hardware-tied security called NGSCB in Longhorn, Microsoft has now announced that it will introduce hardware-linked security in Windows XP Service Pack 2 called execution protection (NX). This feature is currently supported in both AMD’s K8 32/64-bit and Intel Itanium 64-bit processor families. The purpose of the feature is to protect application data from execution code and allow only memory marked as execution code to be run.
As with the previous report on NGSCB, Microsoft claims that this has nothing to do with DRM and will be only used to prevent running code from being attacked or modified by worms and viruses. While DRM may not be in the picture here, it looks like Microsoft is making a gradual approach into tying DRM into the hardware. Microsoft has announced that some applications will be broken on XP-SP2 if they are run on an NX compatible CPU. Examples include applications that perform just-in-time (JIT) code generation such as legacy debuggers.
|
“Microsoft is preparing for and encouraging this trend by supporting execution protection in its Windows operating systems.” So is it DRM? Not exactly, not yet, but it’s another example of the closer linking of hardware and software that will result in the processors with NGSCB built-in that Bill Gates promised at the recent Professional Developers Conference, and a reread of his keynote after hearing about NX does tend to suggest that Bill might not see any clearly defined line between the two, and between hardware security and hardware ID. And linkage is helpful from the point of view of selling DRM to users; clearly, you can’t pitch hardware protection that screws up your ability to listen to music as you wish as an unalloyed benefit for the general public, but you can sell them it on the basis it stops Bad Things coming at them from The Net. Microsoft can also use compliance with this and future hardware features as the ‘entry ticket’ for hardware manufacturers wanting Windows development relationships and support. One might speculate that Windows XP support for AMD64 might not be entirely unconnected with NX support. As Microsoft says: “The 32-bit version of Windows currently leverages the NX processor feature, as defined by the AMD64 Architecture Programmer’s Manual.” So actually, it’s not being introduced to the mass market with SP2 – it’s here already for AMD64 platforms. NX “uses the CPU itself to enforce the separation of application code and data, preventing an application or Windows component from executing program code that an attacking worm or virus inserted into a portion of memory marked for data only.” Which is quite cute really, when you consider that one of the fundamental security problems of Windows is its failures in separating application code from data. Fix Windows? Go back to basics and write a proper operating system? Nope, we have a better idea… Whatever, although there may be applications for NX support in non-Windows operating systems, it doesn’t immediately look like a ‘must have’ for, say, Linux in the same way that it does for Windows. Read the full article |
While this does look like an interesting feature in preventing buffer-overload attacks such as what we have already seen with the blaster worm and so on, it looks like we could be seeing more hardware tied ’security’ features before the launch of Longhorn. It also looks like we may someday come to the stage where Microsoft ties real-time encryption and decryption into the CPU, so software and multimedia would be encrypted from the source all the way to decryption and execution simultaneously within the CPU. CSS protected DVD-Video despite target=_new>already been hacked and DVD-Audio are already encrypted from the disc to the processor and it is just a matter of time before Microsoft takes this approach with software and again calls it ‘A Security Feature’.
Discuss about hardware and processor topics on our General Hardware Forum.
Source: The Register
15 Comments
[edited by Crabbyappleton on 04.11.2003 03:24]
[edited by electrician2002 on 04.11.2003 03:39]
[edited by electrician2002 on 04.11.2003 03:42]
[edited by Rhelic on 04.11.2003 15:00]
However , I do hope MS will be smart enough to make a checkbox "allow this program to execute unprotected code" in prefferences to avoid problems with older software. 
[edited by sorti on 05.11.2003 00:04]
[edited by chsbiking on 05.11.2003 13:39]
Most popular headlines
Grandmother is falsely accused of file-sharing (11)
- Wed 3 Feb 03:00 by JaredNewman
- Piracy
A woman falsely accused of downloading copyrighted movies might've lost her Internet connection had she not taken her case to the media.
PS3 closing ground on Xbox 360 (1)
- Sat 6 Feb 14:00 by Randomus
- Game Consoles
After years of trailing the Nintendo Wii and Microsoft Xbox 360 on the sales charts, the Sony PlayStation 3 continues to close the gap on the Xbox 360.
Blame Blu-ray for lack of PS3 game downloads (13)
- Thu 4 Feb 09:00 by JaredNewman
- Game Consoles
Don't expect Sony to offer its full game catalog for download over the Playstation 3 any time soon.
Murdoch: Avatar DVD won't be 3D (17)
- Thu 4 Feb 00:00 by Randomus
- Blu-Ray writers & players, LCD TV
News Corp. CEO Robert Murdoch confirmed the DVD release of Avatar won't have 3D support, with no word on a possible 3D Blu-ray version.
