(Photo by Michael Kappeler/picture alliance via Getty Images)
To prevent another CrowdStrike-like outage, will Windows become a more closed operating system like Apple's macOS?
A week after the disruption, which affected an estimated 8.5 million Windows devices, Microsoft is pushing for a clampdown on third-party access to the Windows kernel, a deep layer of the OS that manages a PC's hardware and software resources.
“This incident shows clearly that Windows must prioritize change and innovation in the area of end-to-end resilience,” Microsoft VP John Cable wrote in a Thursday blog post,
CrowdStrike’s Falcon security software has access to the Windows kernel, which allowed it to accidentally trigger a "Blue Screen of Death" on Windows PCs after running a buggy update.
Microsoft has been blaming some of the CrowdStrike outage on 2009 European Union antitrust agreement that requires Redmond to open kernel-level access to third-party software vendors. In contrast, Apple began phasing out kernel extensions in macOS in 2020 and pushed software vendors to use the "system extension framework," citing the reliability and security benefits.
Cable doesn't call for Microsoft to completely cut off access to the Windows kernel. Instead, he points to alternatives, such as “the recently announced VBS enclaves, which provide an isolated compute environment that does not require kernel mode drivers to be tamper resistant.”
“These examples use modern Zero Trust approaches and show what can be done to encourage development practices that do not rely on kernel access,” he adds. “We will continue to develop these capabilities, harden our platform, and do even more to improve the resiliency of the Windows ecosystem, working openly and collaboratively with the broad security community.”
Even so, Cable’s blog post is raising questions over whether Microsoft's efforts to secure the kernel access could hurt third-party software vendors. For example, antivirus software can use kernel-level access to monitor malicious changes to the Windows OS at the earliest stages.
“Without kernel mode privileges, [antivirus and endpoint detection and response] are extremely restricted in what they can do. However, we don't believe Microsoft will truly revoke kernel mode access to security vendors,” tweeted malware tracking service VX-Underground.