Crystal Security 3.5

[Secondmineboy]

Well as i already requested:

Better Windows 10 integration like support for the Info-Center popups and better touch-friendly UI

Many people have tablets these days.

 

[OokamiCreed]

I hope youre not going to turn to someone like Dani Santos, just sayin........

I was thinking about this to but @Kardo Kristal is far too active and listens to everything we say - within reason (even if it drives him crazy). It's one of the reasons why I actually trust Crystal Security to do what it does on my system. And while this product is free now, I'd imagine a plan to have a paid and free version, it would be worth putting out money for unlike some other products... in my honest opinion. Not trying to be offensive here. The security field isn't a nice place to play around with, without commitment, dedication, and communication with others.

 

[frogboy]

I was thinking about this to but @Kardo Kristal is far too active and listens to everything we say - within reason (even if it drives him crazy). It's one of the reasons why I actually trust Crystal Security to do what it does on my system. And while this product is free now, I'd imagine a plan to have a paid and free version, it would be worth putting out money for unlike some other products... in my honest opinion. Not trying to be offensive here. The security field isn't a nice place to play around with, without commitment, dedication, and communication with others.

Very well said.

 

[Kardo Kristal]

Better Windows 10 integration like support for the Info-Center popups and better touch-friendly UI

@Secondmineboy Both suggestions added into to-do list. It may take some time to implement both features (because of the multilingual support). Many users requested different languages like: Russian, German, Polish and so on.. It means that Multilingual support is in progress.

I was thinking about this to but @Kardo Kristal is far too active and listens to everything we say - within reason (even if it drives him crazy). It's one of the reasons why I actually trust Crystal Security to do what it does on my system. And while this product is free now, I'd imagine a plan to have a paid and free version, it would be worth putting out money for unlike some other products... in my honest opinion. Not trying to be offensive here. The security field isn't a nice place to play around with, without commitment, dedication, and communication with others.

@OokamiCreed Thank you for the kind words bro!

Thanks to users feedback Crystal Security is better and better with each new version.

Very well said.

@frogboy I totally agree with you!

Regards,
Kardo

 

[RmG152]

I found a fun bug on my Test environment xDD

1. Install Crystal security on Clean system.
2. Enable silent mode. (doesn't need)
3. Enable Shell integration.
4. Scan Crystal Security Folder.

Crystal security kill himself.

@RmG152 Thanks for the interest.

1. Multilingual support (in the next version)
2. Icon for context menu scan
3. Option to configure uploads limit (e.g. 40 MB/per day)
4. Multiple drive support for Active protection and Checkup (optional setting)
5. Overall improvement (detection and performance)
6. .... and some other features

In my opinion:

1. English isn't my main language, but I think this is not a priority.
2. I think this is easy to fix
3. Maybe not only "total", include max file size option.
4. +1
5. +1
6. Allow process signed by Trusted Vendors
7. your point nº 6.

 

[Kardo Kristal]

In my opinion:

@RmG152 Thank you for your opinion.

I found a fun bug on my Test environment xDD

Thanks for the report. Bug confirmed and will be fixed.

Regards,
Kardo

 

[Deleted member 21043]

Hello @Kardo Kristal,

You've been working really hard and so I thought of a way I could help you, therefore for the past few days I've used some of my spare time to start developing a feature I'd like to donate to you for Crystal Security, I'm sure you'll like it... Process protection!

Currently, I've only made it as far as protecting against process termination from specific functions which are commonly used. The process protection works by protecting the Crystal Security process from user-mode level, which of course means you won't have to worry about kernel-mode drivers. The way it is applied is via injecting the DLL into processes - upon injection, hooks will attempt to be set on specific functions via placing a JMP instruction to the address of the callback function at the address of the function in the IAT (Import Address Table). This means when the function is called, my code will be executed if the hook is present and I can use my callback to check the parameters and if it's trying to request the API call to attack the Crystal Security process, I deny access.

The disadvantage of it working from user-mode is because it can be bypassed more easily. But, you shouldn't worry about this, it's still effective.

I have decided to use Task Manager as an example, however of course it will be just as effective with malware. It's compatible for both x86 and x64 processes.

An example of what would happen if you attempt to terminate the Crystal Security process via Task Manager:

Spoiler: Image preview

Please bear in mind this is just the first stage of the process protection I have been developing for you... Starting from tomorrow, I'll be away until the 28th of July on holiday... Whilst I am away (no internet connection) I'll improve the process protection I am currently developing for you, such as adding new features like protection against process suspension, termination of the process threads... I'll focus on process protection now for the self defence, maybe in the future when I have more time in the summer, I'll add protection for the Crystal Security registry keys, files, etc.

Let me know what you think, and remember, if you want to use this feature in Crystal Security, it's a gift from me.

Cheers.

 

[Kardo Kristal]

@kram7750 Thanks for the support bro.

I made some research and found another method how to protect Crystal Security process. When something tries to kill process then result is Access Denied. It uses different method (without any driver or DLL injection). Thanks to this method only Admin can kill the process.

Here is a test of the method I found. This will be also implemented in the next version.

Regards,
Kardo

 

[MalwareT]

Change thread title in Crystal Security 3.5 I like the product so far, but where's quarantine ?

 

[Kardo Kristal]

@Malware Test

Change thread title in Crystal Security 3.5

I can't change it. Probably mod or admin can change it. @BoraMurdar @exterminator20 @Jack

I like the product so far, but where's quarantine ?

Blacklist is like Quarantine in Crystal Security. You can access Quarantine folder under Blacklist section.

I hope it helps.

Regards,
Kardo

 

[Deleted member 21043]

@kram7750 Thanks for the support bro.

I made some research and found another method how to protect Crystal Security process. When something tries to kill process then result is Access Denied. It uses different method (without any driver or DLL injection). Thanks to this method only Admin can kill the process.

Here is a test of the method I found. This will be also implemented in the next version.

Regards,
Kardo

Hello @Kardo Kristal,

No worries, if you've got it covered then I understand. Just make sure it protects the process against other processes (so malicious processes as an example) and not just Task Manager (or specific programs) if it doesn't already.

In case you were wondering, Access Denied occurs when a return the NTSTATUS value for STATUS_ACCESS_DENIED is returned, and the NTSTATUS value for this is 0xC0000022. It's used for blocking Native API functions, like ZwTerminateProcess, ZwOpenProcess. (Preventing ZwOpenProcess is good because if a program can't get a handle to your process, it cannot start to try to use ZwTerminateProcess or another function like ZwSuspendProcess since it'd need a HANDLE to put in as a parameter for it to work).

Good work.

Cheers.

 

[Kardo Kristal]

No worries, if you've got it covered then I understand. Just make sure it protects the process against other processes (so malicious processes as an example) and not just Task Manager (or specific programs) if it doesn't already.

@kram7750 Thanks for the reply.

Tried found method against Process Hacker and Process Explorer successfully (It should protect against malicious processes as well).

Regards,
Kardo

 

[jamescv7]

@Kardo Kristal : Out of curiosity, since I'm planning to conduct safety self protection for my educational AV thesis purpose. Is it something you replicate from renaming the process like svchost.exe which will considered as critical process and unterminated unless the effectiveness will be revert?

Because other complicated process deals on DLL.

 

[Kardo Kristal]

Is it something you replicate from renaming the process like svchost.exe which will considered as critical process

@jamescv7 No. If you wish I can share additional details about found method via PM.

Regards,
Kardo

 

[Kardo Kristal]

Hello,

Crystal Security 3.5.0.139 released

Changelog

• Improved Self-protection
• Improved "Blacklist" section
• Improved overall performance
  
• Fixed several minor bugs

Two different types of downloads

Download installer version of Crystal Security 3.5.0.139
Download portable version of Crystal Security 3.5.0.139

Looking forward to your feedback.

Regards,
Kardo

 

[Secondmineboy]

Update went fine Kardo

Keep it on.

 

[Secondmineboy]

How about a changed tray-icon when the Protection is disabled and also a popup to remind the user that its disabled, otherwise he will disable it and totally forget that.

 

[Kardo Kristal]

Update went fine Kardo

@Secondmineboy Thanks for the feedback.

How about a changed tray-icon when the Protection is disabled and also a popup to remind the user that its disabled, otherwise he will disable it and totally forget that.

Good point.

1. There is a plan to add notification about disabled protection.
2. No plan to change icon (currently it is static icon).

Regards,
Kardo

 

[Secondmineboy]

@Secondmineboy Thanks for the feedback.


Good point.

1. There is a plan to add notification about disabled protection.
2. No plan to change icon (currently it is static icon).

Regards,
Kardo

Well, a popup would already be enough to inform the user

 

[Kardo Kristal]

Well, a popup would already be enough to inform the user

@Secondmineboy I agree. Thanks for the good suggestion.

Regards,
Kardo