OEM BIOS emulators spoof Vista, make pirated copies look legit

Computerworld - Microsoft's anti-piracy team has acknowledged that hacks against Windows Vista's OEM BIOS activation scheme are circulating, but seemed to say it has no plans to immediately counter the threat.

Two days ago, Alex Kochis, senior product manager of WGA (Windows Genuine Advantage), spelled out the hacks, which try to spoof how major computer makers pre-activate Windows Vista before shipping systems to customers. To make OEMs' (original equipment manufacturers) jobs easier, Kochis said, Microsoft has long let them add a marker in the motherboard's BIOS to identify PCs licensed to boot Windows.

OEM BIOS hacks aren't new, he said. But ironically it's Vista's new anti-counterfeit defenses that may make them more popular. "Because there were easier ways to pirate Windows XP, I don't think much attention was ever paid to [OEM hacking]," said Kochis. "However, because Windows Vista can't be pirated as easily as Windows XP, it's possible that the increased pressure will result in more interest in efforts to hack OEM Activation 2.0."

At least two OEM BIOS hack strategies are in use, Kochis continued, including one that uses software to trick a pirated copy of Vista into thinking it's running on a legitimate OEM-activated system. Computerworld was easily able to locate multiple OEM BIOS emulators available for download, including one on a Polish site and another hosted on a Russian server.

Kochis, however, was ambiguous about whether the WGA group is planning immediate action against these hacks. "It's worth noting we prioritize our responses, because not every attempt deserves the same level of response," said Kochis. "Our goal isn't to stop every 'mad scientist' that's on a mission to hack Windows.

"Our first goal is to disrupt the business model of organized counterfeiters and protect users from becoming unknowing victims. This means focusing on responding to hacks that are scalable and can easily be commercialized."

If true, the stance would be at odds with past behavior by Microsoft and its WGA team. Last month, when a Web site posted a tool that its maker claimed could crack Windows Vista's activation process, WGA reacted the next day, saying it was investigating the hack.

Microsoft did not immediately respond to a request to clarify whether WGA is now on the OEM BIOS hack case.