Untitled attachment

Notices where this attachment appears

1. Embed this notice
   VessOnSecurity (bontchev@infosec.exchange)'s status on Wednesday, 31-Dec-2025 06:24:17 JST VessOnSecurity

   @malwaretech Ah, not quite.

   The thing is, in order to do what it needs to do, AV *needs* to have kernel access. It's just that the way Windows is designed, there is no other way. (Maybe something can be done with eBPF technology but I'm not sufficiently familiar with it to tell for sure and it didn't exist back then anyway.)

   Microsoft had a point - it was better if third parties didn't have this kind of access, because they could mess up things for the OS very badly. So, they tried to kick us out - not to eliminate the competition but because it make the OS more stable.

   Of course, we didn't want to be driven out of business. But we knew from experience that reasoning with Microsoft was pointless, so we used lawyering.

   By chance, at that time Microsoft had their own AV. Which, of course, used all kinds of undocumented APIs to do what it needed to do - APIs that we didn't have access to. So, we used the argument that Microsoft is trying to be anti-competitive. They weren't but it didn't matter. They couldn't be reasoned with, there was no other way for us to do our job, they were already scared by the anti-trust lawsuit in the USA, so they gave up and let us do what we wanted.