New Patch Guard is dangerous for W8 security

[SpeedyPC]

G’day Comodo

Is Comodo Dev & Staff is aware the New Patch Guard so now HIPS-based software (firewall, antikeylogger) cannot work effectively.

See link: http://social.msdn.microsoft.com/Forums/en-US/windowscompatibility/thread/27f483ca-8449-4abd-aedd-3d73e956649c

Edit: I’m aware it June 27, 2012 as I wasn’t to sure about this topic if this was true.

[thug4real]

Doesn’t sound good, will be nice to see a official statement for Comodo dev. I also want to know the answer, I know I’m a W7 user, but in future I’m planning to upgrade to W8, but after I read this, I’m not so sure anymore.

Thank you for sharing this SpeedyPC
Regards RealNature,

[Citizen_K]

Patchguard has been around for 8 years now according to [url=http://en.wikipedia.org/wiki/Kernel_Patch_ProtectionWikipedia[/url]:

Kernel Patch Protection (KPP), informally known as PatchGuard, is a feature of 64-bit (x64) editions of Microsoft Windows that prevents patching the kernel. It was first introduced in 2005 with the x64 editions of Windows XP and Windows Server 2003 Service Pack 1.

Patchguard is a fact and security firms have had enough time to get their act together. Comodo 64 bits and other have successfully adapted to it as can be seen in the Proactive Security Challenge 64 at Matousec.

I found a couple of comments from egemen about Patchguard:

@egemen post:1

Whats new in 3.5.61373.458 BETA?

NEW! Native Vista HIPS: New Vista HIPS compatible with Vista PatchGuard. Now Defense+ introduces kernel level protection in Vista SP1 X64 or later

Regards,
Egemen

@egemen post:134

CIS already does these in kernel mode. There is no such thing as full kernel mode hooking in x64. Whatever there is for Vista is already used by CIS. This is the same for all the other vendors.

[SpeedyPC]

Thank you for the head up EricJH and I really appreciate this feedback, I was getting a bit worried when MS say Patch Guard is dangerous for W8 security I wonder why they say this to confused people…Bloody MS for scary the ■■■■ out of me.

[Citizen_K]

@SpeedyPC post:4

Thank you for the head up EricJH and I really appreciate this feedback, I was getting a bit worried when MS say Patch Guard is dangerous for W8 security I wonder why they say this to confused people…Bloody MS for scary the ■■■■ out of me.

Better blame the silly sod who is building a security program and is not very well informed…

[Ultra-Bot]

@EricJH post:3

Patchguard has been around for 8 years now according to :
Patchguard is a fact and security firms have had enough time to get their act together. Comodo 64 bits and other have successfully adapted to it as can be seen in the [url=http://www.matousec.com/projects/proactive-security-challenge-64/results.php]Proactive Security Challenge 64 at Matousec.

I found a couple of comments from egemen about Patchguard:

If that’s true than why some security products cannot work with these Patchguard?
For example, DefenseWall does not have 64-bit version, and now even Sandboxie 4 has problems as wel, since it’s still in beta.

[Citizen_K]

@Ultra-Bot post:6

If that’s true than why some security products cannot work with these Patchguard?
For example, DefenseWall does not have 64-bit version, and now even Sandboxie 4 has problems as wel, since it’s still in beta.

It’s up to the developers to come up with alternative strategies. Which is possible but takes a mind switch.

[Mrarnold]

Microsoft made the bed and now security companies must try and sleep in it.
Interesting enigma really.

Microsoft seems to have shot themselves in the foot.
Their intentions are good but long term effects have sadly been overlooked.

[Citizen_K]

@Mrarnold. post:8

Microsoft made the bed and now security companies must try and sleep in it.
Interesting enigma really.

Microsoft seems to have shot themselves in the foot.
Their intentions are good but long term effects have sadly been overlooked.

I see 5 firewalls getting the Get it now recommendation in the Matousec 64 bits Challege.

The 64 bits challenge is tougher for the top ranking players:

and the very good and excellent products will have it much harder to achieve the perfect score

Src: Proactive Security Challenge 64

Surely it is a challenge to bring security while no longer relying on kernel hooking but it is possible. 64 bits systems have been around for quite a while so security vendors have had enough time to rethink certain given strategies.