Sophos Cloud Optix
Windows 8 hit the streets last Friday and lots of folks have been asking, “Should I upgrade? What’s new?”
While the primary difference is in the radical changes to the user interface, we here at Naked Security thought it best to stick with our core competency, security.
Folks who are interested in a detailed analysis of the changes in Windows 8 from a security perspective should download our new technical paper, “Windows 8: Redmond’s Safest Operating System Ever?”
The most obvious, and controversial, change in Windows 8 security is the new Secure Boot system. New PCs that ship with Windows 8 will be required to use a UEFI BIOS, which is the first component required for securely booting Windows.
The UEFI BIOS begins the loading of the operating system and ensures all of the components are signed with a digital certificate belonging to Microsoft. This should go a long way towards disrupting rootkits and boot kits that depend upon the ability to load before Windows and your anti-virus software.
Microsoft has made minor improvements to the ASLR and DEP technologies used to defend Windows and its applications against buffer overflow and other vulnerabilities.
SmartScreen filtering has been extended to the basic operating system after having proven itself useful in Internet Explorer 9. Another set of eyes looking for nasties is always a good thing, but I am not convinced it is as useful as Microsoft claims it is.
Microsoft Defender has been upgraded to be a proper anti-virus scanner using much of the technology previously branded as Microsoft Security Essentials.
It’s nice to see new Windows installations able to defend themselves from the get-go, but it appears to be the bare minimum. Most users expect more and will likely want to install a more fully featured security suite.
There are many other small changes including improvements to DirectAccess VPN, Windows To Go, Internet Explorer 10 and the new “Modern” tile applications.
Our paper “Windows 8: Redmond’s Safest Operating System Ever?”, with a lot more details on the security improvements in Windows 8 and other Windows 8 tips and information, is available on our Windows 8 area at http://sophos.com/windows8.
It is my opinion that Windows 8 is certainly an improvement in security over previous Windows versions, but Microsoft may be fighting an uphill battle.
In an informal poll at a few conferences I have attended in the last few weeks, only about 50% of organizations have Windows 7 rolled out to the majority of their desktop users.
Windows 8 is a radically different user experience and will likely require quite a lot of effort to both train end users and develop effective policies to manage all of the new functionality.
Planning a Windows 8 rollout at your organization? Leave us a comment below and share your thoughts with our community.
I don`t think so buddies because I have already heard of the Windows 8 bootkit successfully developed and tested by a security researcher named Peter Kleissner
who published his bootkit on November 25, 2011 at MalCon 2011.
Go ahead guyzz and read the paper and it is really awesome….:)
This was only successful with Safe Boot disabled.
Thanks very much for writing this blog post and in-depth PDF on Windows 8 security. The top eight tips on security for Windows 8 are also very helpful.
Thanks for bringing this often neglected and less published aspect of Windows 8 to a wider audience.
Not being a hardware techie, I have to ask, does UEFI BIOS prevent you from running anything other than Windows 8?
Hi DeadCaL,
No UEFI does not stop you from running anything but Windows 8. If Secure Boot is disabled in the UEFI BIOS, you can install Linux as normal.
There was initially a lot of controversy about UEFI and Secure Boot potentially stopping you from running Linux but this turned out to be false.
Indeed Fedora Linux has plans to feature Secure Boot technology:
http://www.pcworld.com/article/259801/fedora_linu…
As one commenter puts at the end of this article,
“UEFI and secure boot are NOT the same thing. Please do not use them interchangeably, as they are NOT interchangeable”
I hope this helps. Thanks.
Ah OK thanks. So it's a feature that can be turned off and on again?
Yes, and thank you @JimboC. I use UEFI to boot Arch Linux on 3 PCs of mine and even take advantage of the new kernel 3.6 boot stub.
If things work as promised you will be able to sign your own boot loaders and import your certificate into your UEFI BIOS. This way you maintain all the security without vendor lock in.
I also have to wonder, if I want to have a fully encrypted hard drive, would that mess up the UEFI BIOS protection?
Secure Boot looks at the digital signature of the boot components. This would not be affected by encryption. Ensuring your pre-boot encryption is signed in the appropriate way is the complexity. I would recommend using BitLocker encryption with a more capable management solution for the keys. This way you can take advantage of Safe Boot and still have a consolidated key management strategy.
Unfortunately, for me personally?, I Hate the ‘Metro’ deal regardless of how much better the security. I want an OS designed for my PC, NOT a tablet or smartphone?.
I was holding off to buy my OS for the PC im building because of Windows 8, I’m going with 7.
Give it a rest mate.
Just grow up and use Windows 8.
Telling people to "grow up" just because you disagree with them is incredibly childish and rude.
@BillBlagger
TY 🙂
Couldent of said it better myself! LOL!.
That is a ludicrous response. Growing up would be letting other people have their opinions. I’m not a fan of the Metro interface either, but I see some merits to the OS so will likely upgrade. I won’t hold it against somebody else who doesn’t want to deal with an interface designed for a machine he isn’t even using.
“lots of folks have been asking, “Should I upgrade?”” Definitely worth running the Upgrade Assistant first. My PCs aren’t so old but won’t run Safe Boot and I don’t plan to buy new PCs or mobos just to do that.
@Ted: Not sure what growing up has to do with it, the screenshots I’ve seen suggest Windows 8 is aimed at pre-school kids, hideously multi-coloured desktop with big boxes to play with. If that’s growing up I’ll stay sixteen (if only).
"My PCs aren't so old but won't run Safe Boot and I don't plan to buy new PCs or mobos just to do that." – possible source of confusion: Windows 8 can be installed on a PC with an ordinary BIOS. The restriction appears to be being imposed on manufactures who have agreements with Microsoft to sell new hardware with Windows 8 pre-installed.
"New PCs that ship with Windows 8 will be required to use a UEFI BIOS, which is the first component required for securely booting Windows."
Hi BillBlagger,
My PC from July 2011 is in the same situation as yours. It has UEFI firmware but the Upgrade Advisor tells me that it does not support Secure Boot (it must support UEFI v2.3.1 Errata B and have the Microsoft Windows Certification Authority in the UEFI signature database).
Any BIOS updates for this PC do not add the Secure Boot feature since this PC was never designed for these features of Windows 8.
My motherboard, an Asus P8P67 Pro Rev 3.0 is not on the list of Asus motherboards certified for Windows 8, so I am out of luck in being able to use Secure Boot:
http://event.asus.com/mb/windows_8/#intel
From what I can tell, ELAM (Early Load Anti-Malware) is also part of Secure Boot so I won't be able to use this either.
Here are the links I referred to:
http://msdn.microsoft.com/en-us/library/windows/d…
http://www.thewindowsclub.com/earlylaunch-antimal…
However there are numerous other security improvements that I can take advantage of and these are my primary reason for upgrading. These are the same features that Chester discusses in his Windows 8 Security whitepaper mentioned in this blog post.
Please find below some further information on these:
http://blogs.msdn.com/b/b8/archive/2011/09/15/pro…
http://illmatics.com/Windows%208%20Heap%20Interna…
In summary I am talking about improvements to ASLR, the Windows kernel and the Windows heap. When I read about these improvements some months ago, I made up my mind that I am going to upgrade to Windows 8.
I hope this information is of assistance to anyone considering an upgrade for security reasons.
Thank you.
If Windows 8 it truly more secure, why then is the Registry Editor available by default via the Run Menu? I was able to render the Windows 8 Release Preveiw useless in 5 minutes using the Registry Editor. The UAC is useless, as it’s just “Cancel” or “Allow”. How I went about it was delete a couple of vital keys and reboot. As to which keys I deleted I won’t mention it here. After I did so, I rebooted. Windows 8 attempted to repair itself and locked up as a result. This also applies to ALL cleint versions of Windows, from Windows 95 onwards. I accomplished the same thing under Windows 7, and it too wasn’t able to repair itself. I wouldn’t call Windows 8 secure as a result. As long as the Registry Editor is available by default, Windows 8 is not fully secure against what I described.
Hi Jon Fukumoto,
I really don’t see the problem here. If access to the registry editor was blocked by default to an administrative account of Windows there would be many complaints about this. If you are concerned about this, please simply use Group Policy and block access to the registry editor (you don’t need to be in a corporate environment to do this, you can block it on your home PC too). I can explain how to do this, if you wish.
Please bear in mind that 3rd party registry editors may not be blocked by this approach.
I tried editing the registry in the Administrator account and it was successful, as expected. Trying the same with a Standard account (i.e. limited user), I was unable to edit the registry, but I could launch regedit.
Unfortunately removing the ability of an Administrator account to edit the registry by default is going to be a draw back. It isn’t Microsoft’s fault that most people don’t follow the principle of least privilege and simply use an Administrator for working on their computer on a daily basis.
Microsoft provide such advice of using a Standard account on their website, but it is up to the users of Windows to follow it:
http://www.microsoft.com/security/pc-security/ant…
I use a Standard User account for almost everything on my PC. I only use the Admin account when I am going to install/uninstall some programs in bulk (i.e. 2 to 3 programs at a time). When I am done, I go back to my Standard account. If I simply need to install/update one program I will use the Standard account and provide my admin password via UAC if prompted.
UAC is not a security feature of Windows; its function is to allow even an Admin account to run as a standard user until a UAC prompt elevates a program to admin privileges when necessary. It is a common misconception that UAC is a security feature of Windows (the goal it achieves however benefits security).
If you don’t believe me, read Mark Russinovich’s articles on UAC:
http://technet.microsoft.com/en-us/magazine/2007….
http://technet.microsoft.com/en-us/magazine/2009….
http://blogs.technet.com/b/markrussinovich/archiv…
For you to say that UAC is useless is incorrect. If you are going to intentionally damage a PC, UAC won’t stop you, that is not its function. Most people don’t read the UAC prompts before blindly clicking Accept or Yes. That is not a problem with Windows.
Why do I think that having access by default to the registry editor from an Admin account is not a problem, simple, as one other commenter (Snert) of this blog post puts it:
———
The least secure part of any OS is the using nut; never forget that.
———
To me this conveys that the user is weakest link in the chain of security and in the vast majority of cases, this is correct and kudos to Snert for pointing this out.
If the user of the PC is careless enough to modify the Windows registry without knowing what they are doing, that’s not Microsoft’s fault for leaving that capability enabled in Windows 8.
Unfortunately, the methods of resolving this involve some learning and common sense on the part of the users and it can take a lot of patience and persuasion to convince a person that technology can be mastered and that they shouldn’t be afraid of it. They should be encouraged that if they don’t know how to do something or know how something works, they should learn from someone or other source of information and fill that gap in their knowledge. I have found this approach of encouragement to work really well.
In a corporate environment, security awareness training can show what risks users should be aware of and what parts of the operating system to leave alone unless they know what they are doing and have permission to do so.
As for accessing the registry keys that caused Windows to no longer load, I don’t see why you want to hide them. Anybody with a reasonable knowledge of Windows knows what these keys are or could look them up, e.g.:
The shell key that loads explorer.exe (HKEY_LOCAL_MACHINESoftwareMicrosoftWindows NTCurrentVersionWinLogonShell )
Data Type = REG_SZ, Data=Shell
The key used to load userinit.exe (HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogon )
Data Type = REG_SZ, Data=Userinit
The key used to load csrss.exe (HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSession ManagerSubSystems )
Data Type = REG_EXPAND_SZ, Data=Windows
Changing any of the above 3 keys will causes issues, especially the registry keys used to launch userinit.exe and csrss.exe . If a person really wants to do this, not publishing these keys is not going to hamper their progress significantly in doing so.
There are other keys that when modified could cause issues but these examples convey my point.
If you still feel that the registry editor needs to be blocked by default from an Admin account of Windows 8, I suggest you contact Microsoft and get in touch with the appropriate teams to make that change happen.
I hope this info is of assistance to you. Thank you.
As an engineer, within 1/2 an hour of working my mouse looks like it has been tarred and feathered.
I don't have the luxury of being able to use a touch screen because of the situation of my industry.
I cannot see any advantage of upgrading to windows 8, it appears to be another gimmick
based on the ability to use touch screen.
Probably more to do with selling new PC's with the new operating system than to us plebs still using older hardware.
Having looked at windows 8 it seems to have less functionality than windows 7.
Unless you can afford the luxury of buying new equipment I wouldn't bother.
Knowing Microsoft and it's pricing it will probably be cheaper to by an iphone/ ipad anyway. in the long run.
Well you are engineer and certainly you have more knowledge about the stuff you do on computer but I didn’t understand hows windows 8 tearing down your mouse? I m just a sales person who sales windows 8 in shop front and even i know outside desktop mode you only go when you have to access some application… otherwise while you working inside the desktop mode you are similar environment of windows 7… 🙂 So what i understand with your comment is you just badly want touch screen and you using windows 8 as an excuse so company buy one you.. 🙂
Glad they're making improvements in security but as you've implied they've still got a way to go. As with previous versions I'll wait until most of the bugs have been sorted out.
The least secure part of any OS is the using nut; never forget that.
Will I be able to install W8 on my 6 year old PC that does not have EUFI bios? I know that will be less 'secure' but I don't see why M$ are allowed to force us to buy new hardware just because they say so.
Hi LindaB,
It is very likely that you will be able to run Windows 8 on your 6 year old PC. If it can run Windows 7, it can most likely run Windows 8.
Please download and run the Windows 8 Upgrade Assistant (also called the Upgrade Advisor). This will tell definitely if you can upgrade or not.
You can download the Windows 8 Upgrade Assistant from:
http://windows.microsoft.com/en-us/windows-8/upgr…
The system requirements for Windows 8 are also listed on that page.
My PC has a UEFI BIOS but I cannot use Secure Boot or the ELAM (Early Load Anti-Malware), the Upgrade Advisor told me this, but I can upgrade to Windows 8.
While it is an advantage to have the above features, they aren’t the only reason to upgrade to Windows 8.
I hope this helps. If I can be of any further assistance, please feel free to ask.
Thank you.
I recall Vista and Windows 7 each being the most secure OS's ever to come from Redmond, yet I don't recall a vulnerability that was thwarted by these operating systems. All Microsoft updates are almost always for all versions. The problem seems to be that the vulnerability existed in the code written a long time ago and each OS is lipstick on a bulldog. The improvement is in the UI and getting true security requires it to rebuilt from the ground up.
Hi SomeGuyinChicago ,
I am afraid that you are very wrong in your conclusion about security features simply being “lipstick on a bulldog”
In the Microsoft Security Intelligence Report Volume 12 (January 2012 to June 2012) Microsoft clearly show that more modern versions of Windows suffer from far less malware infections than previous versions. Pages 63 to 65 clearly show this.
Here is the download link for this report:
http://download.microsoft.com/download/C/9/A/C9A5…
In addition, your point about more modern versions of Windows not being vulnerable to specific security vulnerabilities is also false. I have provided some examples below where Windows Vista and Windows 7 are not vulnerable to the same vulnerability that affects earlier versions of Windows.
These are just some examples that I have found. If I took the time to gather more examples, I would find even more:
Windows Vista not vulnerable:
http://technet.microsoft.com/en-us/security/bulle… http://technet.microsoft.com/en-us/security/bulle… http://technet.microsoft.com/en-us/security/bulle… http://technet.microsoft.com/en-us/security/bulle…
Windows 7 not vulnerable:
http://technet.microsoft.com/en-us/security/bulle… http://technet.microsoft.com/en-us/security/bulle… http://technet.microsoft.com/en-us/security/bulle… http://technet.microsoft.com/en-us/security/bulle… http://technet.microsoft.com/en-us/security/bulle… http://technet.microsoft.com/en-us/security/bulle…
Why are more modern versions less susceptible to security vulnerabilities? Windows Vista, Windows 7 and Windows 8 (in addition Office 2007 to Office 2013) used stricter iterations of the Secure Development Lifecycle as time progressed and each subsequent version of Windows became available.
In addition in 2011, Microsoft Windows for the first time was taken out of the top 10 vulnerabilities being exploited as reported by Kaspersky. This is due in no small part to their efforts contained in the Secure Development Lifecycle.
http://www.microsoft.com/security/sdl/discover/de…
Since you say “and getting true security requires it to be rebuilt from the ground up” you really don’t know how the SDL works. The code they write is audited as it is written and security flaws are found and removed during development. Once developed the software is extensively tested by other means to remove even more flaws.
The entire process is discussed at a high level in the following report:
http://www.microsoft.com/en-us/download/details.a…
A more up to date version of the SDL is available from:
http://blogs.msdn.com/b/sdl/archive/2012/05/23/no…
In August 2011 a hacker even praised Microsoft for their dramatic turnaround in terms of security that they began with Windows Vista:
http://venturebeat.com/2011/08/05/wtf-microsoft-g…
Here are the links to the sources of the information that I mentioned above:
http://www.securelist.com/en/analysis/204792176/I…
http://www.gmanetwork.com/news/story/229600/scite…
http://www.engadget.com/2011/05/19/adobe-dominate…
http://www.engadget.com/2011/05/19/adobe-dominate…
http://www.zdnet.com/blog/btl/adobe-tops-kaspersk…
Finally I would like to point out that I do not work for Microsoft but I do have an in-depth knowledge of security mitigations and securing Windows PCs.
I hope this information is of assistance to you in changing your biased opinion.
Windows 8's strong point is low price upgrade. For Innovation?
Of Course not. Windows 8 is not innovative.
It is a just hybrid OS for MS tablet.
Modern UI(Windows RT) + Desktop mode(Windows 7b?)
There are two types of app. Metro style app and desktop app.
Of course they are different.
You have to flip back and forth two OS UI all the time.
and Microsoft prevents booting straight to Desktop mode in Windows 8
No choice. Why? They are forcing you to use MS Tablet UI
for their MS Surface device. They don't care about their loyal customers.
We know Windows 8 UX for tablet Not for desktop.
This UX is really joke for desktop PC user in business environment
It's not seamless. No consistency.
There is no big performance difference between Windows 7 and Windows 8
except startup time(8sec faster) and shutdown time (4sec faster).
Windows 7 supports multitouch technology
Windows 7 can search apps at Start menu
Windows 7 has DVD playback and windows media center (not sold separately like 8)
..etc
Software cannot change your current desktop/laptop PC to Tablet.
If you use desktop/laptop PC with Windows 7. just stay with Windows 7
and wait Windows 9 or something else.
If you really like Modern UI Just grab tablet at store. That is smart buy.
I disagree with this. I've been using windows 8 on the desktop for awhile now. If you don't want to, you rarely need to enter the Metro UI. Even if you do end up pulling up the UI to search for something, while the full screen transition is jarring at first, it doesn't require any extra clicks or typing than in the previous version of windows. Once i just accepted it as a full screen start menu, I've had no more difficulty using 8 than I did 7. I don't understand why people make such a big deal about Metro on desktops as it, at least for right now, is a minimal part of the experience.
I think so you nail it… This is my argument and explanation, when customer try to talk what they read on internet without understanding or looking the product at first.. It’s not that hard or indifferent but human are evolved from monkey… And they repeat and do same what other do… Well it’s common 🙂
I would also like to know if I have to have a BIOS that supports EFUI (or is EFUI). I have yet to see why I would purchase Windows 8. Only if I had hardware that uses touch screen technology. Of course I would not have purchased one with W8 in the horizon without some guarantee that it is supported by W8.
Why move to the latest and greatest when they are virtually the same OS and there seems no benefit to a move.
I'm purchasing a Mac Book Pro, just have to get my wife on board.
Is security the only real advantage?
Hi Jack,
Please refer to the comments above. You will see that a UEFI BIOS is not a requirement of Windows 8. Without a UEFI BIOS you can still use Windows 8 but you will be unable to take advantage of the Secure Boot or ELAM features (Chester describes what these 2 features are in his Windows 8 Security whitepaper).
There are many other reasons to upgrade to Windows 8, for example:
Under the hood performance improvements:
http://blogs.msdn.com/b/b8/archive/2012/07/23/har…
Easier file management:
http://blogs.msdn.com/b/b8/archive/2011/08/29/imp…
http://blogs.msdn.com/b/b8/archive/2011/08/23/imp…
Easier to repair when damaged:
http://blogs.msdn.com/b/b8/archive/2012/01/04/ref…
Reduced memory usage:
http://blogs.msdn.com/b/b8/archive/2011/10/07/red…
Faster media encoding:
http://blogs.msdn.com/b/b8/archive/2012/06/08/bui…
Faster boot times:
http://blogs.msdn.com/b/b8/archive/2011/09/08/del…
No further need to manually run CHKDSK:
http://blogs.msdn.com/b/b8/archive/2012/05/09/red…
While many of the features of Windows 8 are geared towards a touch screen UI, there are other improvements as described above.
I hope this information is of assistance to you. Thank you.
———————————-
Apologies for going off topic.
I remember the fuss around when window’s 7 hit the market… 🙂 What happen now suddenly window’s 7 is one of the best OS over xp…. Don’t mind people will get along with window’s 8 when they run out of choices… Always happen like this, We as human cannot except changes easily… 🙂