RSSMicrosoft Manager Says It Considered Banning Vista Virtualization
By Scott M. Fulton, III | Published February 23, 2007, 5:34 PM
In a story for the Associated Press carried on many online news services this afternoon, one of the directors of Microsoft's Windows Client Product Planning team appears to make a curious and perhaps astounding statement. Scott Woodgate is quoted as saying that a Black Hat security conference demonstration last August, where virtualization functions were exploited to plant an active rootkit onto a beta of the Windows Vista kernel, scared Microsoft to the point where the company seriously considered removing virtualization capability from Vista entirely.
Ostensibly, the AP article was about Microsoft's decision to ban Home Basic and Home Premium editions of Vista from serving as guest operating systems in virtualization engines. This was a recent discovery for Macintosh users, though it was public knowledge for Vista users since last July, when Woodgate himself made the announcement.
"We also announced the first of our licensing changes to internalize virtualization into Windows Vista," read an announcement on his personal blog. "Specifically customers who buy first software assurance and then deploy either Vista Enterprise or Ultimate can install 4 copies of the OS in a VM in addition to the copy on the physical machine for the cost of one license...Download VPC, create up to 4 VMs for various previously incompatible applications and get going."
By implication, only the business editions of Vista were engineered to include virtualization, and among Vista testers, this was generally understood. However, it became a new discovery to Mac OS X users who attempted to load home editions of Vista into Boot Camp and other virtual environments. The story was run by many services with the subheading, "The puzzling story of why Microsoft prevents some users from upgrading to Vista."
Virtualizing an OS as a guest, as many software architects will tell you, is not an upgrade of the host system; and many Macintosh users will certainly agree that the ability to virtualize or host Vista does not constitute an upgrade to OS X.
That fact aside, the curious puzzle remains as to whether Microsoft actively considered cancelling Vista virtualization so close to the operating system's release, and with the Virtual PC 2007 project - an upgrade to Virtual PC 2004 specifically to enable hosting Vista - already well underway. BetaNews has approached Microsoft for further comment, and we're told it may be forthcoming.
Last June, security researcher Joanna Rutkowska announced she was working on a personal project to create undetectable malware that exploited only publicly known computer functions rather than stealth. She called this project "Blue Pill."
"The idea behind Blue Pill is simple" Rutkowska wrote for her blog last June. "Your operating system swallows the Blue Pill and it awakes inside the Matrix controlled by the ultra thin Blue Pill hypervisor. This all happens on-the-fly (i.e. without restarting the system) and there is no performance penalty and all the devices, like graphics card, are fully accessible to the operating system, which is now executing inside virtual machine."
Reports from the conference the following August state that Microsoft's then-general manager for security Ben Fathi was present for Rutkowska's presentation, which he watched intently. Fathi later told eWeek that her demonstration was successful merely because she was using a beta kernel, and that the exploit vector she chose had already been fixed in a later build. Indeed, as testers will recall, Vista virtualization was addressed in several builds between the public Vista Beta 2 and the final release candidate.
Fathi discussed Vista beta kernel patching for security holes in an interview with InfoWorld last September. "Creating guest operating systems that sit on top of hypervisors allow us to create better isolation mechanisms," Fathi stated then, "so that even if malware comes in, it only affects one subset of the machine and not everything else."
Last October, Fathi was moved to a leadership position within Microsoft's Core Operating Systems division, but by that time, the finalization of Vista's business editions was already, and release to manufacturing was but a few weeks away.
If management teams and executives at Microsoft had actually considered removing virtualization from Vista altogether, sometime within the 12-week period between having witnessed Rutkowska's demonstration in August and releasing Vista's business editions to manufacturing, it's difficult at present to pinpoint when that consideration was made, or for how long.
7:45 pm ET February 23, 2007 - Late Friday, a Microsoft spokesperson provided to BetaNews an extensive defense of why virtualization functionality was omitted from home editions of Vista, although the company would not address the question of whether Microsoft - as Scott Woodgate told the AP - considered tossing out all virtualization from Vista after having seen a rootkit demonstration in August. Here is Microsoft's statement in full:
For production machines and everyday usage, virtualization is a fairly new technology, and one that we think is not yet mature enough from a security perspective for broad consumer adoption. Today, customers using virtualization technology with Windows are primarily business customers addressing application compatibility needs or technology enthusiasts.
For that reason, Windows Vista Home Basic and Windows Vista Home Premium cannot be installed in any virtual machine technology, but Windows Vista Business and Windows Vista Ultimate can. This is regardless of the virtualization stack, applying equally to use with Microsoft's virtualization technology, Virtual PC, and third-party virtualization technology.
Each virtual installation of Windows requires a new license just as it did for Windows XP except for Windows Vista Enterprise Edition which includes four installations in a virtual machine as part of a single license. Microsoft is committed to working with the hardware and software industry to improve the security of virtualization technologies moving forward with new hardware and software innovations.
Microsoft made statements indicating it would refrain from adopting virtualization functionality with the next version of its operating system as early as Spring 2005.
I don't see anything wrong with Microsoft making people purchase a better version of their software, if they indeed want to run that one program, I mean you already have Windows XP Professional so you should/can purchase the upgrade that is cheaper right?
Of course if you perhaps do not own a legal license for that virtual instance you are running then perhaps you don't have the legal right to complain that Microsoft did this.
In other words, perhaps its not the best idea, but if people are willing to pay to be able to do it, then the market has choosen that it is indeed a "good" idea. This is at least what anyone into Economics would tell you.
Allowing the market to decide what works and what doesn't is the ultimate test. If people don't pay for the right, then Microsoft will either lose that money from the customers or they will adapt over the years. In other words if the market says its a bad idea, then Microsoft will change.
Remember Microsoft doesn't do anything without those customers that are willing to pay to exactly this.
It might be interesting to note that, I was able to install the developing country version of Vista onto Virtual PC 2007 a few days ago. Of course I didn't use a key, and I used a Vista Business DVD to do it, so that might make the difference.
It might be interesting to see if I am able to install Vista Home Premium and just not activated it. I suppose I should stop my current statement at this point, to prevent people from taking advantage of a feature of Virtual PC 2007.
Score: 0
|Allowing the market to decide what works and what doesn't is the ultimate test. If people don't pay for the right, then Microsoft will either lose that money from the customers or they will adapt over the years. In other words if the market says its a bad idea, then Microsoft will change.
Remember Microsoft doesn't do anything without those customers that are willing to pay to exactly this.
Bingo.
Score: 0
|After reading this post I came across a site called http://badvista.fsf.org, there's an article link on the site called "A Cost Analysis of Windows Vista Content Protection" (http://www.cs.auckland.a...01/pubs/vista_cost.html) which goes thru Vista content protection for so-called “premium content.” It’s not along the lines of Virtual PC 2007 but it just shows how Vista was build to limit the average user.
Whatever happened to giving the end user chooses? ”For production machines and everyday usage, virtualization is a fairly new technology, and one that we think is not yet mature enough from a security perspective for broad consumer adoption.” Ok I’m not sure about everyone out there but anyone see a problem with that statement “not yet mature” nothing ever matures until the public incorporates it into the norm. How are we the general user able to mature if we aren’t allowed to use the program and mature?
Score: 0
|lame.
So-called "Vista content protection" is based on the requirements for *any* OS or device to play premium HD content (HD-DVD/Blue_RAY ala HDCP) and is the creation of the Entertainment Industry (aka Big Media), *not* Microsoft.
Score: 0
|Microsoft rolled over and played ball with the entertainment industry, so that does NOT absolve them of guilt in this case. You make it out like they had no choice: they always had a choice.
Lame indeed.
Score: 0
|Sure.
They could *not* support the latest hardware and DVD tech.
I bet you'd all *love* that. You woudn't whine and moan on all day about that at all, would you?
Sure they had a choice, support it or release an OS utterly incapable of playing HD-DVD/Blu Ray.
Gee, I bet that was a tough one.
Score: 0
|Tell that to Apple. Support DRM or shut down iTunes Music Store. You think they would agree with you that they HAVE a choice?
Score: 0
|Anyone care to join in a class action lawsuit?
Score: 0
|No. They're for people who really don't have anything better to do, and are busy using Linux to... what, exactly? I don't know. But they're using Linux. So they're good. Obviously. Dunno *what* they're good at, but damn, they're good...
Score: 0
|"Boot Camp" is *not* a virtual environment. It's 1) a patch to the EFI used in Intel Macs and 2) a set of hardware drivers so Macs can boot XP natively.
Score: 0
|IT all comes down to how much more copies of Enterprise / Ultimate editions they can sell.
Score: 0
|Thats exactly it! Now all Mac-Boys willing to play some better games were going to rush out and buy the cheapest Vista ... so now MS makes them pay just a bit more...
(besides: funny irony considering the stuid Apple-ads which indicate the PC is boring ... hmm well ;-) )
Score: 0
|Mac Users can install Home Basic.
Ever heard of Boot Camp?
Score: 0
|Even if you could run say Vista Home Premium using virtualization software does Parallels or VMware support full 3D graphics acceleration that lets you take advantage of DirectX 10 games? Is it even possible to use Aero Glass?
Score: 0
|Virtualization is necessary for power users, I don't need all the bells and whistles in my VMs at home. Vista home basic would do just fine.
Why should I have to purchase enterprise just to test a hobby software product on it that hasn't made enough to BUY vista enterprise?
I just won't support Vista I guess, and will eventually retire my hobby project.
Score: 0
|eh?
I'm a power user. I don't use any VMs at home. I have never even thought about it.
Of course, to save money, you could just buy Home Basic and install it.
Right? Is there some *need* for you to test it within a VM?
Score: 0
|I have no desire to install Vista on my PCs at the moment - but my mother and father will probably wind up with Home Basic on their new PCs (both buying in the next few months).
As any computer techie will know you're the first support call for parents with PC problems... So how do I tinker with Vista when I don't want to install it as a main OS? Virtualize. Now I won't be able to do that, at least not with the same version as my parents wind up with.
Score: 0
|So you have to pay the price to keep up with technology. Sorry, I'm just not sympathizing.
Any tech worth a damn has been messing around with Vista now for months. Not being able to run it in a VM is a poor excuse.
Score: 0
|I use Linux as my main OS, and XP in a VM. It's HANDY. Using Samba (or vmfs) I have a single my-documents hosted to multiple OSs (when I need to) and I have the best of all worlds right here all the time.
Why change the way I use my computer for Vista? I only need it for one thing, testing a hobby application. Why spend big bucks on that because of an inclination by a manager at some big company?
Native?
Naah, I'll pass.
Score: 0
|I'm sorry, I'm fully virtualized running multiple OSs on the same box with an infinite number of configuration possibilities.
Except Vista.
Hrmph, I had all the betas and RC 1, that's not the point here.
Score: 0
|That's his point. Perhaps it's not yours. That's fine.
I'm not defending MS because I think this is a good idea, I think it sucks. I'm defending them because it's their right to restrict how their products are used regardless of what anyone else wants. I don't think it is our place to tell anyone what they can and cannot do with their digital creations.
Heh... I guess we disagree on that.
(I specified digital because I *do* think we have the right to restrict companies from making products that are harmful to health and such and didn't want anyone responding to this with that scenario.)
Score: 0
|Your choice, man. Just as it's theirs to restrict theior products.
Sure, it may be a bad choice in your opinion, but it's their to make, just as it's yours to not use it it due to those restrictions.
The great thing about this is that if enough people choose not to use it and find a legal alternative, things will change.
Score: 0
|"Just as it's theirs to restrict theior products."
Agreed, doesn't make it suck any less.
I'm not gonna pony up $$$ for the extended "can virtualize me" edition though.
Enough of a backlash and they will change their tune.
Or not..
Score: 0
|No, we agree on that.
It just sucks.
;-)
Score: 0
|Heh...
Score: 0
|I bet not.
Score: 0
|really
Score: 0
|really?
Score: 0
|"For production machines and everyday usage, virtualization is a fairly new technology, and one that we think is not yet mature enough from a security perspective for broad consumer adoption."
Does that mean if you purchase Vista Home Ultimate your computer is more prone to security threats? Thats exactly what that passage reads! So in fact, if you spend the extra money on Vista Ultimate you are getting, from a security point of view, an inferior version of Windows?
Microsoft should come up with a better excuse for not including it across the board next time!
Score: 0
|No, it means that virtualization is insecure.
Read your own quote:
virtualization is a fairly new technology, and one that we think is not yet mature enough from a security perspective
You need to come up with a better excuse for posting.
Score: 0
|"For that reason, Windows Vista Home Basic and Windows Vista Home Premium cannot be installed in any virtual machine technology, but Windows Vista Business and Windows Vista Ultimate can. This is regardless of the virtualization stack, applying equally to use with Microsoft's virtualization technology, Virtual PC, and third-party virtualization technology."
This means it will not run on ANY VM at all (without some hacking or patching). Some of us users do not run any M$ OS as a primary, but for certain needed programs have to run up a system in VMware or the like. This is either forcing someone who elects to not run Vista as their primary OS into paying for more than what they need, or forcing me to use an older version of my needed software. Software companies need to keep up with the times. For trade specific software this makes supporting 2 or more platforms expensive and impractical. This leaves me at the choice of running an older and out of date version of my trade specific software, paying more for Vista just so I can have the "privelige" of running their bloatware, or finding a nice coder to illegally patch this restriction out of Vista. M$ is very well aware at the number of linux and mac moxes out there running a VM of XP to run that one program, and this is just one more way to get a bit more money out of us. Thank goodness for codeweavers getting most of my stuff running.
Score: 0
|this is just one more way to get a bit more money out of us.
So what?
You act like a company being able to price their own products as they see fit is a bad thing.
Score: 0
|I do not feel Vista is expensive, its as much money as Microsoft XP Professional is more/less due to money being worth more now.
I do agree Microsoft should support virtualization, needless to say, I hope Virtual PC 2007 is given updates in the near future.
Score: 0
|I feel it is expensive, but I thought XP was expensive too. OEM versions are a semi-reasonable price, but now they have a number of new restrictions on licensing. In addition, I can't future-proof by adopting the stable 32-bit Vista now, and moving to 64-bit Vista when it finally gets off the ground in terms of compatibility and drivers. OEMs don't have that choice. :P
Score: 0
|The bottom line all comes down to one thing. User!
See, Microsoft can use sophisticated words and technical jargon to try to explain why they took out virtualization in Vista Home Basic and Premium, but it's not about security. Don't let Microsoft fool you!
It's about controlling how many copies can be installed on the hardware. It's about Microsoft charging a high price for the licenses to install legit copies of it's operating systems. There's probably not going to be any home users getting Vista Home Basic and Home Premium and installing them as virtual machines, because there's no need for it. That is, unless the user happens to be a technology enthusiast, and in this case, he/she will more than likely be using Vista Ultimate. Microsoft knows this! They took out the virtualization possibility of the two cheapest versions of the operating systems to make sure the consumers who will be using Virtualization pay the higher price for Vista Ultimate or Vista Enterprise.
Security in virtualization is still dependent on the security of the host operating system. Just because it has access to the hardware peripherals and network doesn't mean it creates any extra holes, it just means if users are not familiar with virus protection, malware, and hacking, then the guest operating system is just as capable of being infected or hacked into as the host operating system. Duh!
Microsoft is not committed to working with the hardware and software industry to improve the security of virtualization technology, because if they were, they wouldn't have made the hardware requirements for Vista so strict, and they wouldn't be charging such a high price for the operating system. That's the bottom line. Don't let Microsoft's lies, deceptions, greed, and corruption fool you!
Besides that, Fedora is a lot more secure than Windows Vista, and Fedora is free to download and use. Even though technical support costs, it's just a matter of you as the end user knowing what your options are, and then taking the time to learn something new. Go figure! It's as easy as pie, if you take the time to learn!
Score: 0
|Good points. What kills me is that Microsoft continues to ignore customer wishes, most notably in Office 2007. Why bother building the OS if you're just going to lock it down and turn it into AOL land?
Score: 0
|It's about controlling how many copies can be installed on the hardware. It's about Microsoft charging a high price for the licenses to install legit copies of it's operating systems.
Yes. Exactly. It's about a company dictating how it's product should be used, and charging what they want to charge for it.
*gasp*
Welcome to the US. We have this great thing called capitalism. When you create a product, you can do the same thing...or do something totally different. Isn't that great? It's up to you, the creator, not the consumer (aka User)!
It's as easy as pie, if you take the time to learn!
lmao... I *love* the hypocrisy in that statement.
It's like telling everyone how easy brain surgery is, ya know, after going to medical school for 12 years...
Score: 0
|If they're still ignoring you, maybe it's time to look for an alternative? There are many better priced/free options. :)
Score: 0
|"They took out the virtualization possibility of the two cheapest versions of the operating systems to make sure the consumers who will be using Virtualization pay the higher price for Vista Ultimate or Vista Enterprise."
What about Vista Business? You missed what's likely to be the version of Vista that will be used the most by businesses.
And no operating system is as easy as pie. And how you tried to make pie? Not as easy as it seems. :)
Score: 0
|Article error: There is no Virtual PC 2005. Article writer probably meant Virtual PC 2004. Also 2007 isn't "specifically to enable hosting Vista". Vista CAN run in 2004... I've done it. It's just slow is all... I imagine the writer heard the virtualization was improved. All 2007 is really (as far as I'm concerned) is a bug fix release... it fixes compatibility problems with Vista as the HOST operating system, as well as problems loading DVD-sized ISOs over 2gb. There's a few more things too, check here for more details:
http://blogs.msdn.com/vi...lable-for-download.aspx
It seems MS is saying they should decide what the consumers want, like parents decide what is good for their baby kids.
....
So which is the cool big brother in this scenario? Linux or Mac?
Score: 0
|http://www.microsoft.com...tualserver/default.mspx
Ummm... at least google your own statements first. It'll save you some egg.
Score: 0
|MAZZTer, you're right about the year reference - fixed that. As for whether Vista could run in VPC 2004 (with the year corrected), not always. On three of my four test systems, it didn't; on one, it did briefly but took down Windows XP after a few minutes. Vista wasn't reliable on VPC 2004 on all systems.
Back in 2005, Microsoft was pushing virtualization along with its Trusted Computing initiative. Intel made a decision not to push TC for consumer systems because of the controversy there - consumers were wary about the prospects of hard-wiring DRM into their computers. With the two technologies being developed on the hardware side in tandem, my feeling is, Microsoft stepped back from developing Trusted software modules (which was never a good idea anyway without a hardware-based root of trust) and consumer-oriented virtualization at the same time. I think it's unlikely that the withdrawal of the consumer push for virtualization and Trusted Platform for consumers, from both Microsoft and Intel at right about the same time, to have been coincidence.
-SF3 (stuck in 2005)
Score: 0
|Thats Virtual Server 2005, not Virtual PC.
Learn to read. It'll save you even more egg.
Score: 0
|Ah, the article poster could have been thinking of Virtual Server. Still, it's a completely different product from Virtual PC... for one thing, IIS is a required prerequisite to run it, and this client/server architecture makes it ideal to monitor virtual machines remotely.
On the other hand, Virtual PC is for running machines locally without any needed client/server software. You can monitor machines remotely, but you must set up stuff on the machine itself (ie network plus remote desktop or vnc).
Score: 0
|SMFulton3: "As for whether Vista could run in VPC 2004 (with the year corrected), not always. On three of my four test systems, it didn't; on one, it did briefly but took down Windows XP after a few minutes. Vista wasn't reliable on VPC 2004 on all systems."
Sorry, I think you made a Typo. The last sentece should Read:
"Vista ISN'T reliable, on VPC 2004..."
VPC 2004 isn't reliable either, so is pretty good that you could host a VPC with two flawed products on 3/4 computers you tried, good mark!
The true is that Virtual PC was a good product until fall into Microsoft hands. Connectix was doing a good job, competitive to Vmware. Now Vmware is the only serious player on this game, shame for humanity, Microsoft ruined yet another product...
Score: 0
|While it might be a pain, its clearly a concern, and I would rather have a pain then my system security to suffer.
Score: 0
|