Making it Clear Just Why Protected Processes are a Bad Idea

What Protected Processes (PP for short) do is simple: noone, not even the user running them or the admin, has permissions to do certain things to them. Such as read their memory, inject threads, and debug them. That's right, legitimate AV programs are supposed to skip PPs. Because PPs have to be signed by Microsoft, so they're, like, infallible. No way a program signed by Microsoft could have an arbitrary-code-execution vulnerability in it.

Here's what one Microsoft technical document on PPs says (evil .doc file downloadable here - can be opened by free readers):

Best Practices
Historically, a privileged service (running as administrator or local system) has been able to obtain all access to a process or thread, regardless of its DACL, by using SeDebugPrivilege.
Starting with Windows Vista, the privileges that are marked with "No" in the tables earlier in this paper cannot be obtained for a protected process or thread. This can be a problem if memory scanning is critical to the operation of the application.

Do not attempt to circumvent this restriction by installing a kernel-mode component to access the memory of a protected process because the system and third-party applications may rely on the fact that protected processes are signed code that is run in a contained environment.

That's right, it can be something of a problem if your application likes to read the memory of other processes. Like an antivirus. Or a debugger or another development tool. Or some other legitimate and established applications I can think of. But do not attempt to circumvent this restriction! Everyone's relying on you not to!

Excuse me if this sounds a little like sarcastic ranting. I don't make a habit of reading technical documents so forthrightly stupid.

A little exercise for the reader: why PPs? Why wouldn't the ordinary Windows permissions system work? Add a builtin user for running apps that receive Most-favoured-DRM status. Only let programs signed by Microsoft run as this user. Enforce this by the same means PPs are enforced. You get the same result, but without having to invent new classes of processes and permissions even the local admin cannot have with respect to them.

Of course, then Microsoft would have to admit that the user called 'Local Administrator' is not, in fact, local admin, or root or what have you. Not if there were ordinary permissions he didn't have. Maybe that's why they feel a need to build these orthogonal interfaces for DRM and disfigure the rest of the system in the process.

How depressing that many people are still forced to pay for this.