October 4th, 2006

For Vista, WGA gets tougher

Posted by Ed Bott @ 7:49 am

Categories: WGA, Windows Vista

Tags:

For Windows Vista, Microsoft is rolling out a new version of its Windows Genuine Advantage anti-piracy program, complete with a new name: the Windows Software Protection Platform. This time, they mean business.

Technically, it's not a kill switch, but it's arguably a near-death experience for your PC.Let's call it WGA Plus, shall we? The Plus means this software, which is baked into Windows Vista, is even more aggressive about detecting and blocking what it considers software that is running with unauthorized license keys or has been tampered with. And woe be unto you if you get snagged in the WGA - sorry, SPP dragnet while running Vista. If that happens on a premium version of Windows Vista, you'll first lose access to key features, including the Aero interface, ReadyBoost performance enhancements, and Windows Defender antispyware detection. Eventually, if you don't deal with the problem, the measures get more severe and you're kicked into "reduced functionality mode":

Reduced functionality mode in Windows Vista will allow the user to use the browser after the reduced functionality mode has begun. Reduced functionality mode can occur as a result of failed product activation or of that copy being identified as counterfeit or non-genuine. In most cases customers will be able to correct this situation quickly with the options provided. With the tools in place for OEMs, and small to large customers, we expect that most customers should never be affected by having a non-genuine installation.

Microsoft denies that this is a "kill switch" for Windows Vista, even giving it a separate question and answer in its mock interview announcing the program. Technically, they're right, I suppose. Switching a PC into a degraded functionality where all you can do is browse the Internet doesn't kill it; but it's arguably a near-death experience. The accompanying white paper describes the experience in more detail:

By choosing "Access your computer with reduced functionality," the default Web browser will be started and the user will be presented with an option to purchase a new product key. There is no start menu, no desktop icons, and the desktop background is changed to black. The Web browser will fully function and Internet connectivity will not be blocked. After one hour, the system will log the user out without warning. It will not shut down the machine, and the user can log back in. Note: This is different from the Windows XP RFM experience, which limits screen resolution, colors, sounds and other features. [emphasis added]

My head practically exploded when I read this sentence describing the new, improved punishment regimen: "Windows Vista will have a reduced functionality mode but one that is enhanced." Enhanced reduced functionality? Orwell would be proud.

At first glance, this program looks like WGA, repackaged and renamed. So I asked Thomas Lindeman, Microsoft's Senior Product Manager for the Software Protection Platform, to explain what's new. "The Software Protection Platform is a set of technologies we've been working on for several years," he told me. It includes "anti-tampering, anti-reverse engineering, and activation components consisting of . activation servers and a client service running on the PC." With SPP, according to Lindeman, other tools can call the same APIs, making activation and validation technologies available to any Microsoft program, even games like Flight Simulator.

With SPP, life's going to get more difficult for corporate customers using volume license keys (VLKs). Stolen VLKs have been the bane of Microsoft's existence in the XP era, because pirates use them to install copies of Windows and Office that don't have to be activated. Corporations using Vista with VLKs will have to activate them, using either a Multiple Activation Key that allows a limited number of activations, or a Key Management Service running on a Windows domain (which will require periodic reactivation). The new program is called Volume Activation 2.0, and you can read more details in this white paper).

What's most distressing about the SPP announcement is Microsoft's continued insistence that its anti-piracy tools are nearly perfect and that innocent victims never suffer from errors in their code. The press release includes this snippet, for example:

Customers will be able to easily determine the status of their Windows Vista installations. In the System Properties panel of the Windows Vista Control Panel, Windows Vista will display the genuine status of the installed copy of Windows Vista. From there, and from any screen notifying users of a failed validation, a user will be able to obtain more information on why the copy of Windows is not genuine, as well as resources for getting a genuine copy.

See that? Not whether but why the copy of Windows is not genuine. And not resources for getting assistance, but for "getting a genuine copy." In other words, paying Microsoft.

The most chilling part of SPP is its new code to detect tampering. As Lindeman explained to me, "If the Software Protection Platform determines that the core binaries of your system have been hacked with, you will get a notification that operating system has been tampered with. Reinstallation is the remedy." And the clock starts ticking immediately. When an anti-tampering warning first appears, you have three days to reinstall or otherwise fix your copy of Windows Vista or shift into reduced functionality mode.

Microsoft insists that "most customers should never be affected by having a non-genuine installation." That reassurance would be a lot more comforting if there wasn't already a solid base of failures in its current WGA program.

And in the sort of irony that invariably goes hand in hand with hubris, a wave of new problem reports have begun appearing on the official Microsoft WGA Validation Problems forum from corporate customers reporting that legitimate VLKs for Windows XP are suddenly being blocked. Read more details in this follow-up post.