Question "Memory Integrity"

[punkncat]

Anyone wish to give me the from orbit lowdown on what this new thing we are being prompted for today is about?

 

[hotaru.hino]

From https://www.elevenforum.com/t/enable-or-disable-core-isolation-memory-integrity-in-windows-11.4942/

Core isolation is a security feature of Microsoft Windows that protects important core processes of Windows from malicious software by isolating them in memory. It does this by running those core processes in a virtualized environment.

Memory integrity, also known as Hypervisor-protected Code Integrity (HVCI) is a Windows security feature that makes it difficult for malicious programs to use low-level drivers to hijack your computer. It is designed to prevent attacks from inserting malicious code into high-security processes

From a security standpoint, drivers can run at a higher security privilege than users, so it makes it an attractive target for malicious actors to take over. Even though driver signage is supposed to mitigate this, a sophisticated supply chain attack (like the Solar Winds hack) can get around this.

 

[Colif]

I got told to set it last week, I assumed it was because I had set up a few VM.

 

[punkncat]

^ Both of my W11 PC prompted me for it yesterday. The W11 laptop hasn't yet.

Is this also something that is going to pop up for W10 machines?

 

[Colif]

Core Isolation is only enabled if you have SVM enabled in UEFI. Memory Integrity is disabled by default and must be enabled by the user, after SVM is enabled.
If SVM is disabled in UEFI, there's no reason for the Core Isolation feature to appear as it's not supported by the hardware configuration.

"Core Isolation" and "Memory Integrity" settings missing from Device Security in Windows 11

[ATTACH] Does this have to do with TPM being enabled? I could've sworn before I clean installed windows that I had those settings visible here, but...

forums.guru3d.com

SVM = Secure Virtual Machine.
it has to be enabled for Virtualbox to work.

Core Isolation: Its possible it might show in Win 10 if those machines have VM on them. Its only a new request it seems starting August as I never had it set before I flashed my bios.

 

[punkncat]

Hmm, very strange. Both of the PC did this and enabled with no issue. The laptop won't allow the change due to a driver incompatibility with a Brother printer driver. All three machines have the same driver and control panel for our network printer to work. Odd.

 

[Colif]

does laptop have newest BIOS?

What Brother Printer is it?

 

[punkncat]

Yes, I keep the Dell Support thing running on the laptop so it stays on current BIOS and such.

The printer is MFC-L2700DW

 

[Colif]

hmm, so you stuck between Dell & Brother.

So Brother drivers aren't new - https://support.brother.com/g/b/downloadlist.aspx?c=au&lang=en&prod=mfcl2700dw_us_eu_as&os=10013
They need new drivers, they from 2015 so if 1 BIOS complains, others may follow.
It doesn't surprise me printer drivers cause issues. They don't exactly update them very often... or at all for older printers.

but its odd only 1 BIOS complains. And its a Dell one. Is it a newer laptop?

Who makes Dell bios? AMI?

 

[punkncat]

It is an 8th gen system; we have owned it a couple of years. Inspiron 5570

BIOS version says Dell Inc. 3/2022 V3. I am uncertain on your last question.

This is the only machine I use in which I keep a third party AV solution on. Since it is actually used in a mobile enviro a few times a year I use Symantec on it. Don't know if that aspect is important as it wasn't listed as the driver in question.

It is calling out: BrUsbSib.sys

 

[punkncat]

Doing a bit of searching indicates that the above driver is the serial driver for the printer on USB. Probably the way I had to install it, and is dated from before the time that this memory integrity thing came about. On MS it said ~2018. A solution there was to delete this specific driver as it should list something like a USB storage device?
Even the poster with that solution said it isn't recommended to do so, but worked....

edit- that was no joy

The latest manufacturer driver for this unit is 2016, so it appears that function will not be used for the continued lifespan of this printer. I am not really sure it should be a source of concern for us given its use and lack of access (from) others.

 

[Colif]

it used to be these people making Dell BIOS - https://en.wikipedia.org/wiki/Phoenix_Technologies
but its unclear now.
I just wanted to know