October 10th, 2006
Vista Mythbusters #7: How much DRM is too much?
Myth: Windows Vista is loaded with new forms of digital rights management (DRM) that will make the Vista experience more frustrating than ever.
Reality: A new code-checking subsystem that protects the Windows Vista kernel and signed drivers is arguably a new form of DRM. How well will it perform in the field? We won't know until new hardware to take advantage of these features hits the streets.
Much of the DRM code in Windows Vista is a a straightforward upgrade of the infrastructure introduced in Windows XP and Windows Media Player 10. There's some confusion over whether and how DRM-encrypted music tracks from the new Zune service will interoperate with tracks from older rights-protected services certified with the Plays For Sure logo, even the much-hyped MTV Urge service, created in partnership with Microsoft. But in general, that code is just an evolution of the original Windows Media DRM.
One key chunk of code is brand-new, however. The Software Protection Platform rolls up activation, validation, and tamper-proofing into an integrated subsystem. A key module is Code Integrity verification, which is defined in this first look by Microsoft's Chris Corio:
Code Integrity (CI) protects Windows Vista by verifying that system binaries haven’t been tampered with by malicious code and by ensuring that there are no unsigned drivers running in kernel mode on the system. CI starts as Windows starts up. The boot loader checks the integrity of the kernel, the Hardware Abstraction Layer (HAL), and the boot-start drivers. After these binaries have been verified, the system starts and the memory manager calls CI to verify any binaries that are loaded into the kernel’s memory space. The binaries are verified by looking up their signatures in the system catalogs. Aside from the kernel memory space, CI verifies binaries loaded into a protected process and system installed dynamic libraries that implement core cryptographic functions.
You'll also find some good explanations in this PowerPoint presentation from Microsoft Security Evangelist Stephen Lamb.
The stated goal of CI is to protect the operating system from tampering or corruption. But as Lamb's presentation makes clear, it also affects the integrity and digital signature of any kernel-mode drivers. That makes it more difficult for hackers to replace a driver with an "improved" version that enables outputs and removes copy restrictions built into systems that use those drivers.
This post from programmer Scott Dorman connects the dots:
The operating system loader and the kernel now perform code signature checks. On 64-bit x64 platforms, all kernel mode code must be signed and the identify of all kernel mode binaries is verified. The system also audits vents for integrity check failures.
On 32-bit platforms, the administrator is prompted to install unsigned code. Load-time checks are done on all kernel mode binaries, but if unsigned code is allowed to load you won't be able to play protected high-definition multimedia content. [emphasis added]
Symantec has already made up its mind that this feature is a new form of DRM. In a whitepaper entitled "Assessment of Windows Vista Kernel-Mode Security" (PDF), Symantec's Matthew Conover writes:
The CI.DLL is made by the Microsoft’s DRM team to ensure the whole machine is in a trusted state to play DRM-protected content. For that reason, CI.DLL also checks the integrity of user-mode processes that are handling DRM-protected content.
If true, then this really is a form of DRM that has never been a part of Windows before. It's well tested in platforms like cable TV set-top boxes and satellite program decoders, but those single-function devices don't get customized the way a Windows PC does.
Besides being the investigative arm of the Windows Genuine Software program, the Code Integrity check is also going to be crucial to new hardware devices certified by CableLabs and various satellite providers. It's also tied to a new set of hardware-based output restrictions, which I'll get to when that hardware is available for testing.
For the introduction to this series, see Vista Mythbusters #1. For all posts in this series, see this page.
Ed Bott is an award-winning technology writer with more than two decades' experience writing for mainstream media outlets and online publications. See his full profile and disclosure of his industry affiliations.
Subscribe to Ed Bott's Microsoft Report via Email alerts or RSS.
| 10/10/06
