Microsoft Manager Says It Considered Banning Vista Virtualization
In a story for the Associated Press carried on many online news services this afternoon, one of the directors of Microsoft's Windows Client Product Planning team appears to make a curious and perhaps astounding statement. Scott Woodgate is quoted as saying that a Black Hat security conference demonstration last August, where virtualization functions were exploited to plant an active rootkit onto a beta of the Windows Vista kernel, scared Microsoft to the point where the company seriously considered removing virtualization capability from Vista entirely.
Ostensibly, the AP article was about Microsoft's decision to ban Home Basic and Home Premium editions of Vista from serving as guest operating systems in virtualization engines. This was a recent discovery for Macintosh users, though it was public knowledge for Vista users since last July, when Woodgate himself made the announcement.
"We also announced the first of our licensing changes to internalize virtualization into Windows Vista," read an announcement on his personal blog. "Specifically customers who buy first software assurance and then deploy either Vista Enterprise or Ultimate can install 4 copies of the OS in a VM in addition to the copy on the physical machine for the cost of one license...Download VPC, create up to 4 VMs for various previously incompatible applications and get going."
By implication, only the business editions of Vista were engineered to include virtualization, and among Vista testers, this was generally understood. However, it became a new discovery to Mac OS X users who attempted to load home editions of Vista into Boot Camp and other virtual environments. The story was run by many services with the subheading, "The puzzling story of why Microsoft prevents some users from upgrading to Vista."
Virtualizing an OS as a guest, as many software architects will tell you, is not an upgrade of the host system; and many Macintosh users will certainly agree that the ability to virtualize or host Vista does not constitute an upgrade to OS X.
That fact aside, the curious puzzle remains as to whether Microsoft actively considered cancelling Vista virtualization so close to the operating system's release, and with the Virtual PC 2007 project - an upgrade to Virtual PC 2004 specifically to enable hosting Vista - already well underway. BetaNews has approached Microsoft for further comment, and we're told it may be forthcoming.
Last June, security researcher Joanna Rutkowska announced she was working on a personal project to create undetectable malware that exploited only publicly known computer functions rather than stealth. She called this project "Blue Pill."
"The idea behind Blue Pill is simple" Rutkowska wrote for her blog last June. "Your operating system swallows the Blue Pill and it awakes inside the Matrix controlled by the ultra thin Blue Pill hypervisor. This all happens on-the-fly (i.e. without restarting the system) and there is no performance penalty and all the devices, like graphics card, are fully accessible to the operating system, which is now executing inside virtual machine."
Reports from the conference the following August state that Microsoft's then-general manager for security Ben Fathi was present for Rutkowska's presentation, which he watched intently. Fathi later told eWeek that her demonstration was successful merely because she was using a beta kernel, and that the exploit vector she chose had already been fixed in a later build. Indeed, as testers will recall, Vista virtualization was addressed in several builds between the public Vista Beta 2 and the final release candidate.
Fathi discussed Vista beta kernel patching for security holes in an interview with InfoWorld last September. "Creating guest operating systems that sit on top of hypervisors allow us to create better isolation mechanisms," Fathi stated then, "so that even if malware comes in, it only affects one subset of the machine and not everything else."
Last October, Fathi was moved to a leadership position within Microsoft's Core Operating Systems division, but by that time, the finalization of Vista's business editions was already, and release to manufacturing was but a few weeks away.
If management teams and executives at Microsoft had actually considered removing virtualization from Vista altogether, sometime within the 12-week period between having witnessed Rutkowska's demonstration in August and releasing Vista's business editions to manufacturing, it's difficult at present to pinpoint when that consideration was made, or for how long.
7:45 pm ET February 23, 2007 - Late Friday, a Microsoft spokesperson provided to BetaNews an extensive defense of why virtualization functionality was omitted from home editions of Vista, although the company would not address the question of whether Microsoft - as Scott Woodgate told the AP - considered tossing out all virtualization from Vista after having seen a rootkit demonstration in August. Here is Microsoft's statement in full:
For production machines and everyday usage, virtualization is a fairly new technology, and one that we think is not yet mature enough from a security perspective for broad consumer adoption. Today, customers using virtualization technology with Windows are primarily business customers addressing application compatibility needs or technology enthusiasts.
For that reason, Windows Vista Home Basic and Windows Vista Home Premium cannot be installed in any virtual machine technology, but Windows Vista Business and Windows Vista Ultimate can. This is regardless of the virtualization stack, applying equally to use with Microsoft's virtualization technology, Virtual PC, and third-party virtualization technology.
Each virtual installation of Windows requires a new license just as it did for Windows XP except for Windows Vista Enterprise Edition which includes four installations in a virtual machine as part of a single license. Microsoft is committed to working with the hardware and software industry to improve the security of virtualization technologies moving forward with new hardware and software innovations.
Microsoft made statements indicating it would refrain from adopting virtualization functionality with the next version of its operating system as early as Spring 2005.