Whatever you think of it, Windows 8 isn’t just a new interface slapped on top of Windows 7. Windows 8 has seen a lot of security improvements, including an integrated antivirus, an application reputation system, and protection from boot-time rootkits.
There are also quite a few low-level security improvements under the hood. Microsoft hasn’t spelled out all of them, but Windows 8 manages memory in a more secure way and includes features that make security vulnerabilities harder to exploit.
Integrated Antivirus
Windows 8 finally includes an integrated antivirus program. it’s named Windows Defender, but the interface will be immediately familiar to anyone that’s ever used Microsoft Security Essentials – this is Microsoft Security Essentials with a new name. You can easily install any other antivirus you prefer and Windows Defender will be automatically disabled if another antivirus is running, but the integrated antivirus is a capable product. Best of all, this ensures that all Windows users will finally have antivirus protection out-of-the-box.
Early Launch Anti-Malware
In Windows 8, antivirus products can start earlier in the boot-up process to scan the system’s drivers for malware. This helps protect against rootkits that start before the antivirus program and hide from it. Windows Defender starts earlier in the boot process out-of-the-box, and third-party antivirus vendors can also add the Early-Launch Anti-Malware (ELAM) feature to their products.
SmartScreen Filter
Previously used only in Internet Explorer, the SmartScreen filter is now implemented at the operating system-level. It will be used to scan EXE files you download from Internet Explorer, Mozilla Firefox, Google Chrome, and other programs. When you download and double-click an EXE file, Windows will scan the file and send its signature to Microsoft’s servers. If the application is known-good, such as the installer for iTunes, Photoshop, or another popular program, Windows will allow it to run. If it’s known-bad, perhaps if it contains malware, Windows will prevent it from running. If it’s new and Windows doesn’t know what it is, Windows will warn you and allow you to bypass the warning.
This feature should help less-experienced users from downloading and running malicious programs from the Internet. Even new pieces of malware will be detected by the SmartScreen filter as an unknown new program that should be approached with caution. Read more about the new SmartScreen filter here.
Secure Boot
On new Windows 8 computers that use the UEFI firmware instead of the old-style BIOS, Secure Boot guarantees that only specially signed and approved software can run at boot. On current computers, malware could install a malicious boot loader that loads before the Windows boot loader, starting a boot-level rootkit (or “bootkit”) before Windows even launches. The rootkit could then hide itself from Windows and antivirus software, pulling the strings in the background.
On Intel x86 PCs, you’ll be able to add your own security keys to the UEFI firmware, so you could even have your system boot only secure Linux boot loaders that you’ve signed. Read more about Secure Boot here.
Memory Management Improvements
Microsoft has made a lot of under-the-hood improvements to the way Windows 8 manages memory. When a security hole is found, these improvements can make the security hole harder or even impossible to exploit. Some types of exploits that function on earlier versions of Windows wouldn’t function at all on Windows 8.
Microsoft hasn’t spelled out all of these improvements, but they have mentioned a few:
ASLR (Address Space Layout Randomization) has been extended to more parts of Windows, randomly moving data and code around in memory to make it harder to exploit. Mitigations that were once applied to Windows applications are now also applied to the Windows kernel. The Windows heap, where Windows applications receive their memory from, includes additional checks to defend against exploit techniques. Internet Explorer 10 includes improvements that make 75% of the security vulnerabilities reported over the last two years more difficult to exploit.
New Apps Are Sandboxed
Apps for Windows 8’s new Modern interface (formerly known as Metro) are sandboxed and restricted in what they can do on your computer.
On the Windows desktop, applications had full access to your system. If you downloaded and ran a Windows game, it could install drivers on your system, read files from everywhere on your hard drive, and install malware on your computer. Even if programs run with limited credentials thanks to UAC, they typically install with Administrator privileges and can do anything they want during installation.
Windows 8 apps function more like web pages and mobile apps on other popular mobile platforms. When you install an app from the Windows Store, that app has limited access to your system. It can’t run in the background and monitor all your keystrokes, logging your credit card number and online banking passwords like applications on the traditional Windows desktop can. it doesn’t have access to every file on your system.
Apps for Windows 8’s new Modern interface are also available only available through the Windows Store, which is more controversial. However, users can’t install malicious Modern apps from outside the store. They’d have to go through the Windows Store, where Microsoft has the ability to pull them if they’re discovered to be malicious.
Windows 8 is definitely more secure than Windows 7. An integrated antivirus and application reputation system, along with a tamed app ecosystem that replaces the wild-west nature of previous versions of Windows, will probably make the most difference for inexperienced users that may not have ran an antivirus or knew which applications were safe to install on previous versions of Windows. Low-level improvements to the way Windows manages memory will help everyone, even power users.
