Microsoft weighs strong app IDs for Windows future

Microsoft's interest in application secure IDs is part of a larger effort to give administrators a finer degree of control over applications, said Mark Russinovich, a Windows security expert at Winternals Software, which makes system recovery and data protection software for Windows.

Free IT resource Virtualization Insights from Top Experts - Learn how virtualization gets real! Sponsored by Dell Free IT resource TechNet: More ways to know it, share it, and keep it running. Sponsored by Microsoft More from Tech Ed

Traditionally, Windows applications have been granted access to one of three broad "service" accounts that came with rights to a wide range of system resources, regardless of the purpose of the applications. Malicious code authors have made use of those broad privileges for years, using attacks like buffer overflows to take control of applications and their elevated privilege on Windows systems to run amok, he said.

"It's a way to specify for a particular service what it needs access to and refine the scope of the privileges," Russinovich said.

But engineers at Microsoft will have to navigate a minefield of potential problems to make the strong, application secure IDs a reality. Challenges range from managing cryptographic signatures across enterprise applications to suspicion among ISVs that the Redmond company will use the secure IDs and lock out Windows competitors, experts say.

"There's no doubt that auditing secure environments will be more complex," said Dennis Moreau, CTO at Configuresoft.

As with the UAC technology, application secure IDs will require adjustment from software vendors.

"All applications are built with the assumption that they have access by default. This will get in the way of that and change the underlying authentication model," he said.

But complaints from customers, which also marked Microsoft's introduction of UAC, is not necessarily a bad thing, said John Pescatore, a vice president at Gartner.

"With XP SP2 you got one level of squawking and another level of squawking with Vista -- customers saying 'All our boxes and applications don't work!' But you have to raise the bar more," he said.

Cryptographic application IDs built into Windows should improve security. However, there's no guarantee that malicious code authors will not warm to the new architecture as well, Moreau said.

"Suppose exploit vendors apply for blocks of root keys from Verisign. Now [certificate authorities] have to issue growing revocation lists to deal with them. And that's the exact problem with PKI in enterprise environments," he said.

Fathi acknowledged the challenges facing the new application secure ID plans, and said Microsoft is just beginning to get "its hands around" the problem.

However, the advantages in such an architecture are considerable, he said.

Microsoft is looking into ways to tie reputation-based services to strong application IDs to ease security concerns in managed environments, with one Windows user being able to automatically "trust" a particular application within formal or informal networks, he said.

Applications, verified with strong application IDs, could one day have reputations akin to the URL reputation services that companies such as Microsoft and AOL offer to their customers to prevent phishing and spyware, he said.

Application reputations could be a big benefit for enterprises, which would have more assurance that the application they deploy meets standards, such as Common Criteria certification, said Pescatore.

However, the new architecture could awaken old debates about anti-trust and Microsoft's control of the desktop, he acknowledged.

"Microsoft sells a lot of software products. Will [IBM] Lotus get certified by Microsoft? Is that the way the world wants to go?" he said.