Through it’s Windows Genuine Advantage (WGA) blog, Microsoft today provided information about it’s take on the OEM BIOS activation hack. The post ends a bit abruptly, not fully delivering what they promised.

The writer leads off with “We’re aware of this type of hack and I wanted to take a minute to describe how these work and how we plan to respond”. This is followed by a well written easy to understand description of what OEM Activation is, why it exists, and how it works. It’s then explained that there are two different hacks currently being used. One actually edits the BIOS, while the other emulates an OEM BIOS through software. The first is labeled as more difficult, and less of a ‘threat’, and the second as easier for the end user, but also easier to detect.

So, we now have the ‘how these work’ part. The final paragraph says:

…we focus on hacks that pose threats to our customers, partners and products. It’s worth noting we also prioritize our responses, because not every attempt deserves the same level of response. Our goal isn’t to stop every “mad scientist” that’s on a mission to hack Windows. Our first goal is to disrupt the business model of organized counterfeiters and protect users from becoming unknowing victims. This means focusing on responding to hacks that are scalable and can easily be commercialized, thereby making victims out of well-intentioned customers.

After finishing the post, I was left feeling like someone hit the submit button a bit to early. Though there was a promise of discussing Microsoft’s response, that never came. Instead, some generic boilerplate on how Microsoft decides if they’ll respond, and then how they prioritize their responses was put in it’s place (unless the post really was submitted unfinished).

If I had to speculate, I’d say that Microsoft is trying to say their will be no response to those that would directly edit their BIOS. It’s too difficult to detect, and they suspect that too few will attempt it, making it less of an issue. Because the software variant is detectable, I would suspect that they will release an update to force those using the hack to use WGA, similar to how they responded to the “Frankenbuild” hack. Could that be one of the updates coming down the pipes just minutes from now? Stay tuned and find out!