Oliver Day is a former corporate hacker turned student. While at eEye Digital Security he wrote audits for the Retina Vulnerability Scanner and was a Principal Security Consultant for @stake. He has written an unpublished book on SAN security and found a variety of exploits in web-based applications. He is contributing to BadVista.org a series of posts about the presence and implications of the “content protection scheme” in Microsoft Windows Vista. This post is the first in that series.

In a controversial technical analysis Peter Gutmann goes into fantastic detail about the recently released Vista operating system and its content protection scheme. One thing became clear to me after reading this analysis. Vista is being marketed to content producers, not consumers. If Windows XP was Microsoft’s attempt to embed a browser into the operating system then Vista is the attempt to embed DRM. Digital Rights Management technology has been applied to literally every ring of the OS architecture.

Vista's target market is content producers and the underlying philosophy of the user experience will be far different then what many consumers expect it will be. Microsoft has attempted to plug the infamous “analog hole” as much as is possible by forcing all data through encryption algorithms. For those unaware of the “costs” of encryption it is sufficiently high. Pushing HD audio and video content through encryption/decryption routines is a tremendous strain on any system currently available and in the near future. Even with the application of Moore's Law a conservative estimate could place affordable and usable systems within this new content system 5 years away. It will be interesting to see how these restrictions will be spun by the large marketing and PR teams since none of these innovations will benefit consumers in any way. The job that has been handed to these PR and marketing teams is to dress up a product designed with every restriction a producer has asked for and make a consumer want to buy it. One of the most quotable lines from the Gutmann analysis sums this up perfectly as, “breaking the legs of Olympic athletes and then rating them based on how fast they can hobble on crutches.”

In the past when I have delivered lectures to web application developers I would caution them to never trust user input. Perhaps developers took this philosophy a little too far. The entire operating system now seems to have turned against the user. Zero tolerance drivers and regulation code will lock the system down if any type of deviance is detected. So called “tilt bits” will signal an attack on the system if anything is found out of the ordinary. These changes won’t enhance user security unfortunately as they were designed to protect only “premium content”. Medical data, credit card numbers, and other private things that do deserve this level of protection are completly ignored. Untrusting of any environmental changes the system will shut down or degrade performance in response to a perceived attack.

This is a marked turn from the past versions of the Microsoft operating system. In the past one could take a hard drive from a Windows OS and drop it into an entirely different system. The new hardware would be detected and drivers applied on the spot. At most a single reboot would bring the user back into a usable system. This type of resilience was what impressed me during the early days of the new Windows architecture. In those days Microsoft was fairly dominant but still pursuing new customers. The new Vista scheme signals to me that they have exhausted new customer acquisition and are now focused on milking their existing market.

In the next post I will look at who benefits (Intel, Hollywood, code obfuscation providers) and who doesn’t (consumers) and some security issues (driver revocations for DDOS)