ebpf-for-windows

There is eBPF for Windows: https://github.com/microsoft/ebpf-for-windows I'd hope security products in the future leverage this more than custom kernel-mode sensors.

Perhaps it's not sufficiently complete yet for CrowdStrike to use it, but Microsoft has been developing eBPF support for Windows since 2019: https://github.com/microsoft/ebpf-for-windows/

Apple did, Microsoft is working on eBPF for Windows[1] but I doubt they'll sunset their kernel modules support. At the very least, it means there are safer ways to load third-party code in the kernel without allowing them to crash your entire system by mistake. Even if kernel modules are still supported, a compliance framework may introduce a "No kernel module" requirement, just like they require a CrowdStrike-like software to be installed. However, doing so is no easy feat. The first version of eBPF was released over 10 years ago. [1] https://github.com/microsoft/ebpf-for-windows

The alternative is that everyone in the Microsoft security ecosystem gets off kernel-mode drivers. Once ebpf-for-windows lands, it should be possible for Microsoft, CrowdStrike, and everyone else to run their filters in user-land. That puts everyone on a level playing field, and makes the ecosystem more secure overall. https://github.com/microsoft/ebpf-for-windows

> I personally tend to get cautious when there is a proposal that x will solve the problem that occurred on y date, especially 3 days after the failure. Microsoft has been working on eBPF for a few years at least. https://opensource.microsoft.com/blog/2021/05/10/making-ebpf... https://lwn.net/Articles/857215/ If you're really concerned, they have discussions and communication channels where you're invited to air your concerns. They're listed on their github: https://github.com/microsoft/ebpf-for-windows Who knows, maybe they already have answers to your concerns. If not, they can address them there.

I suppose that's what CrowdStrike's system on Mac uses as well, then. Apparently on Linux they use EBPF and Microsoft is researching that for Windows as well: https://github.com/microsoft/ebpf-for-windows . So maybe that's actually the solution they'll go with? It would certainly help solving this particular problem, even if not the kernel-integration in general.

Doesn't microsoft support eBPF on Windows? https://github.com/microsoft/ebpf-for-windows

Because an essential enterprise security application was /able/ to bring down an entire OS like this. The issue is that Microsoft doesn't provide an interface for an application to operate in user-space to have the functionality it requires. Linux has eBPF which can provide most of the capability that Crowdstrike needs, by using an "in-kernel verifier which performs static code analysis and rejects programs which crash, hang or otherwise interfere with the kernel negatively". If MS had this functionality, it is likely this incident would not have happened. That said, from personal experience on Linux it's been an extremely long time since a bad kernel module has rendered a system entirely FUBAR'd. (To Microsoft credit, they have begun copying the eBPF methodoloy to Windows, but it is still in it's infancy https://github.com/Microsoft/eb

There already is an eBPF for Windows, it's even Microsoft's own project https://github.com/microsoft/ebpf-for-windows

This link is about a proposed new eBPF verifier for the Linux kernel that doesn't use signing. As a research project it is not integrated to the kernel, but their plan does not involve trusting user space (instead they suggest doing the heavy lifting of the verification in user space and provide a proof of safety that the kernel checks, which seems sensible to me). I believe you meant to link https://github.com/microsoft/ebpf-for-windows/ instead (discussed on HN recently) which is an implementation by Microsoft using the above research project that indeed does not follow the suggestion from the authors of the research project to use validation and does require trusting user space.

There's some very good points in there, but (4) is unfair. It's true that there's no boundary between a sudoer and root in Linux, but there's also no boundary between an Administrator and SYSTEM in Windows. UAC, even in the "secure" AlwaysNotify mode which uses the secure desktop, has countless unpatched bypasses[1]. Also, (3) should raise some eyebrows for readers paying attention. Cool, Microsoft removed font parsing from the kernel, how wise of them. Wait a second, why was font parsing in the kernel to begin with? With win32k.sys, it shouldn't be surprising that Microsoft has to do more legwork to bring the attack surface back down to the level of other OSes. They're also exploring the use of eBPF in the Windows kernel too[2]. [1]: https://github.com/hfiref0x/UACME [2]: https://github.com/Microsoft/ebpf-for-windows

>Microsoft are becoming its own major contributor to its own Windows implementation. Wait, what now !? After checking : he wasn't joking[0]. Good job MS. [0]:https://github.com/microsoft/ebpf-for-windows