Setup Idea For all those people who post their Security Configurations

[Victor M]

For all those people posting their security configs. If you are interested in testing to see how secure it really is, use an old machine to set it up and put it in your modem's DMZ. What that does is allow full internet access TO your machine, all protocols, all ports. Leave it for a week and then bring it offline and see if there are any problems. We all practice good security hygiene and never download malware, so this test things when things really go awry to see if your security is truly competent.

To see if there are any problems, you can setup Custom Views in Event Viewer. The list of event IDs are listed here: Appendix L - Events to Monitor .

There are several flavors when it comes to hackers. One type slips in and slips out without leaving any traces and don't bother you. They are very difficult to detect, but if you notice a gap in time in your logs then someone has probably erased some logs. The 2nd type notifies you that you've got security problems leaving a note or wallpaper. I got a hacker that sent me local mail on my Linux machine. The 3rd type wrecks your machine or wrecks some functionality so you'd definitely notice.

What you do next is up to you. You can shrug and say you can't stop hackers. Or you can say there is some way that they've got in, so there's a way to stop them. I take the second stance.

I make a drive image when I am done configuring before it ever goes online. (so find that offline AV installer, and pre-download the 2 "cumulative windows 11 x64" patches of the month from Microsoft Update Catalog so you can patch offline, and pre-download the latest MS Defender Intelligence mpam-fe.exe ). Two things are accomplished: a) you can be sure that the machine is absolutely clean and patched before it steps online b) you can re-use that drive image to make improvements without having to start from scratch. And that is a huge time saver because it takes 5 hrs for me to fully harden my machine.

I find it is better to see for myself how secure a setup really is, instead of waiting for @Shadowra to do her video tests. And then, the video tests only 1 or maybe 2 components of your security. These are real life scenarios that no video test can ever capture. The video tests gives you an idea of what to buy, but doing real life testing is where it really counts. Paying $60-$350 for a solution may give you a false sense of security. Sure you got all those knobs and switches to play with, but are they doing anything that really matters?

If at any point you want to leave this game, all you have to do is power off your modem for an hour or two. Then it would fetch a different ip address and no one is going bother you no more. To be extra safe, I have a hardware firewall with IPS Netgate 1100 pfSense+ Security Gateway between my modem and my internal LAN.

 

[Victor M]

Do come back and post your war stories !

 

[Zero Knowledge]

It's obvious your going to get pwned with your setup idea. You may catch the low hanging fruit but the advanced stuff which we all worry about and try to protect ourselves against will no doubt delete or manipulate event viewer files/log files to hide their persistence. These days you just have to assume you are PWNED and you are COMPROMISED by someone/somewhere.

One caveat is if your into crypto then you should be very worried, you will be attacked. If your not into crypto your much better off since you don't have a target on your back.

And I'm sure most people do most of their sensitive communications/business on Android/iOS which have much better security controls and update cycles and protection than Windows.

 

[bazang]

It's obvious your going to get pwned with your setup idea.

Very much doubtful, even if it is possible technically.

One caveat is if your into crypto then you should be very worried, you will be attacked. If your not into crypto your much better off since you don't have a target on your back.

The reason cryptobros and cryptogirlz and crypto-we-don't-know-what-you-are are pwned is because they are prolific downloaders and/or they conduct their crypto activities as real, easily identifiable people and easily tracked and/or they are easily manipulated by email campaigns.

You may catch the low hanging fruit but the advanced stuff which we all worry about and try to protect ourselves against will no doubt delete or manipulate event viewer files/log files to hide their persistence. These days you just have to assume you are PWNED and you are COMPROMISED by someone/somewhere.

Unless some home user is an enemy of the state, they should spend their time & effort on seeing a therapist instead of 5 or more hours hardening their systems. A few simple steps will protect them against everything except Windows network stack exploits that lead to malicious code running in the Windows kernel - which is true pwn.

The only group of people I know who are actively targeted for their digital activities are Uyghurs who receive international calls. Just that call sends them and their families to prison and hard labor camps. Others are journalists (based in many countries) that are just plain stupid because they know what is going to happen to them and their families, and yet they do it anyways.

 

[Zero Knowledge]

Your assumptions are wrong. You don't know what data or information hackers have in their possession or how they would target people of interest or what makes you a target in the first place.

EternalBlue would still work today if the Shadow Brokers had not gone full disclosure. You have to believe that there are many other similar exploits collected and used by state governments.

And cryptobro's and crptogirlz would be the least likely to download cracks and pirated software. You don't know what exchanges have been breached or what surveillance, recon and information attackers have.

In the end do what you want, but don't believe or snort the magical fairy dust that everything is 'A-OK' with bog standard Windows out of the box. Windows is the reason we have a security industry and forums like this one exist because Windows is inherently insecure without tweaking and security software. Your telling me that a home user can just leave a Windows machine on the open internet and expect nothing to happen if your a target? You do understand governments and criminals have incredibly intelligent people working in teams of 10 to 100's who's job it is full time to penetrate and compromise networks and you will just be fine? Please....

Yes too much paranoia is bad but there is no excuse in being naive and ignorant about the security landscape.

 

[Victor M]

A few simple steps will protect them against everything except Windows network stack exploits

Enlighten me please.

 

[bazang]

Enlighten me please.

It is called "Least Privilege" and "Least Functionality" and published in the US's NIST SP 800-53R4 and R5.

Windows is not shipped in a form that is intended by Microsoft for users to allow everything enabled. But Microsoft does not want to be bothered with home users so it ships a default Windows for Home configuration intended to allow "dumb and stupid users that want to use stuff" to do most anything that they want.

Microsoft's position - along with every other software publisher's position - is that all users, regardless of their knowledge, awareness, and abilities - are responsible for their actions using their software. Read their EULAs. In short, the user is always the problem. ALWAYS.

It should take no more than 60 minutes to fully lock down any Windows system - locking the user out from shooting themselves in the foot or their progeny or other family members or friends from doing the same. For those uneducated people living in rural villages, whom can neither read nor write, and should not be given digital devices - well, there is no helping them.

 

[bazang]

Your assumptions are wrong. You don't know what data or information hackers have in their possession or how they would target people of interest or what makes you a target in the first place.

EternalBlue would still work today if the Shadow Brokers had not gone full disclosure. You have to believe that there are many other similar exploits collected and used by state governments.

And cryptobro's and crptogirlz would be the least likely to download cracks and pirated software. You don't know what exchanges have been breached or what surveillance, recon and information attackers have.

In the end do what you want, but don't believe or snort the magical fairy dust that everything is 'A-OK' with bog standard Windows out of the box. Windows is the reason we have a security industry and forums like this one exist because Windows is inherently insecure without tweaking and security software. Your telling me that a home user can just leave a Windows machine on the open internet and expect nothing to happen if your a target? You do understand governments and criminals have incredibly intelligent people working in teams of 10 to 100's who's job it is full time to penetrate and compromise networks and you will just be fine? Please....

Yes too much paranoia is bad but there is no excuse in being naive and ignorant about the security landscape.

You can worry about lightning strikes, but it is not helpful to others. You are a paranoid.

I know all about what hackers use to target, and targeting individual home users is an obsolete worry. If you happen to be a cryptowhale and advertise yo sheet all over social media, and then find you are targeted, well then you are stupid. You got what you deserved.

Typical crypto participants lose because they are prolific downloaders and they respond to phishing emails. Crypto participants are notoriously not security conscious. They use unvetted, unchecked software and get themselves into trouble. The demographic of crypt bros and girls and "others" are those least likely to practice robust security.

You do realize all of this is publishes in goverment and academic studies, right? (Do your research. Don't ask for links.)

Please don't spread your paranoia. It only make the paranoid more mentally ill.

 

[Victor M]

@bazang. Yes I know what least privilege is.

In addition to using a standard user account, I remove rights for that account to run powershell, regedit, reg, and schtask plus a few more things.

But least privilege is not enough. Attackers have privilege escalation tricks and exploits.

For Least Functionality, I disable certain services, turn off remote <anything>, turn off network protocols, uninstall apps, firewall known MS telemetry ip's, turn off various Start>Settings>Privacy&Security, and so on.

I think the 5 hrs is mostly due to inefficiency, I was doing gpedits by hand instead of backing up and restoring. And chatgpt introduced a way to backup and restore Start>Settings partially. I estimate those 2 things should eliminate ~2 hrs. Creating cip files takes 45 mins; which can be backed up and restored instead. Installing various apps takes 1 hr which actually shouldn't be included in the total because it is not hardening. Pretty close to your 1 hr benchmark. And for the rest of the stuff mentioned above I already have scripts made. Still, if you don't mind sharing your insights, I would like to hear them, if it is not a trade secret.

I keep putting off reading 800-53 - too many bracketed role names, interferes with reading. I follow PCI-DSS.

 

[Vitali Ortzi]

It is called "Least Privilege" and "Least Functionality" and published in the US's NIST SP 800-53R4 and R5.

Windows is not shipped in a form that is intended by Microsoft for users to allow everything enabled. But Microsoft does not want to be bothered with home users so it ships a default Windows for Home configuration intended to allow "dumb and stupid users that want to use stuff" to do most anything that they want.

Microsoft's position - along with every other software publisher's position - is that all users, regardless of their knowledge, awareness, and abilities - are responsible for their actions using their software. Read their EULAs. In short, the user is always the problem. ALWAYS.

It should take no more than 60 minutes to fully lock down any Windows system - locking the user out from shooting themselves in the foot or their progeny or other family members or friends from doing the same. For those uneducated people living in rural villages, whom can neither read nor write, and should not be given digital devices - well, there is no helping them.

It's not that Microsoft isn't trying too it probably will virtualize more and restrict more stuff in windows 12 but the thing is it can't do much as either people can't use almost anything like in windows s mode or they have too many privileges and install malware and even if Microsoft locked everything attackers are already moving more to pishing and other methods as they are more efficient

 

[Zero Knowledge]

Typical crypto participants lose because they are prolific downloaders and they respond to phishing emails. Crypto participants are notoriously not security conscious. They use unvetted, unchecked software and get themselves into trouble. The demographic of crypt bros and girls and "others" are those least likely to practice robust security.

Maybe it's a generational thing since I'm getting older by the day but I've found crypto bros and girls from my era are very security conscious and practice very good computer security & hygiene. You can call them 'privacy freaks' or 'paranoid' but they are oldskool cyberpunks who know their software and know hacking trends, so I disagree with your point that all crypto people are terrible at security and download pirated material and click on every phishing email.

Note: Phishing is different my friend to Downloading cracks and warez.Everyone is effected by phishing.

 

[Victor M]

It's obvious your going to get pwned with your setup idea.

You don't know what data or information hackers have in their possession

You are a spoilsport, you yourself says nobody knows what the hackers know. I think you are overestimating their capabilities.

On the other hand I overestimate the effects of good secure-configuration.

 

[Zero Knowledge]

You are a spoilsport, you yourself says nobody knows what the hackers know. I think you are overestimating their capabilities.

On the other hand I overestimate the effects of good secure-configuration.

Your right I do overestimate what hackers know. But I've received a fair amount of breach emails from Have I Been Pwned: Check if your email has been compromised in a data breach and you can only assume it's a fraction of what's been compromised. Cyber crooks are one thing, their motive is pure financial but nation states is another matter entirely. You never know in the future you are in some foreign country even on a flight layover and information from your compromised accounts could come back to bite you.

 

[Victor M]

"I expect a good, clean fight. Protect yourselves at all times.Touch gloves, and let's get it on."

 

[bazang]

Maybe it's a generational thing since I'm getting older by the day but I've found crypto bros and girls from my era are very security conscious and practice very good computer security & hygiene. You can call them 'privacy freaks' or 'paranoid' but they are oldskool cyberpunks who know their software and know hacking trends, so I disagree with your point that all crypto people are terrible at security and download pirated material and click on every phishing email.

Note: Phishing is different my friend to Downloading cracks and warez.Everyone is effected by phishing.

You are probably dead-spot-on in referencing generational security behaviors.

Millennials and, particularly, Gen Z are IT security hostile. And that's not even accounting for ignorant, dumb and stupid. Just because someone is tech savvy and can code and plays with crypto never means that they are secure, security knowledgeable, or prioritize security.

You could bounce the absolute worst warez off a Gen Zer's forehead and they'd say "Why Thank You. Thank You very much, Zero Knowlege. Pleaze giv MOAR!!!"

 

[Zero Knowledge]

I think a lot of the problem is that Millennials and Gen Z is they have grown up on mobile devices with Android/iOS and E2EE apps specifically which are much more secure than Windows out of the box. While older generations grew up on insecure Windows, 95/98/2000/XP/7 and had to be security conscious and really had to learn and master 3rd party security apps.

 

[Victor M]

Latest news from the battle front.

Put together a test machine based primarily on VoodooShield WDAC LockDown. Plus pretty locked down gpedit settings. And the things mentioned in post #9. Signed into Standard acount, then plugged in Ethernet cable into modem/router DMZ.

Round #1: Lost the battle. Standard account signout takes 3 mins when Ethernet is unplugged. It was instantaneous during setup while offline. Something foreign is running in the background. Hypothesize that foreign app is trying to report to C2, but can't, because it was suddenly Ethernet unplugged.

Re-imaged to offline image. Made changes to WDAC LockDown to turn off ISG. ( which is a reputation service of WDAC which allows 'good' programs. ) Backed up as offline image2.

Round #2: Lost the battle. Still something ran in the background after putting it online for 2 hrs. Standard account signout again takes 3 mins while offline.

Re-imaged to offline image2. Made changes to WDAC LockDown, building new base policy, based on standard Windows components, no ISG, (the left most choice) .( Dan told me that the outofbox base WDAC policy allows all MS certs, all MS Store apps, + Reputable apps. ) Backed up as offline image 3.

Round #3: Victory ! Left in DMZ for another 2 hrs. Watched movie. Standard account signout time now still instantaneous, same as during setup. Does not seem to be running anything extraneous in the background. Will review SIEM later to be double sure I'm OK. Yes I have a SIEM running in VirtualBox on the machine.

 

[danb]

Latest news from the battle front.

Put together a test machine based primarily on VoodooShield WDAC LockDown. Plus pretty locked down gpedit settings. And the things mentioned in post #9. Signed into Standard acount, then plugged in Ethernet cable into modem/router DMZ.

Round #1: Lost the battle. Standard account signout takes 3 mins when Ethernet is unplugged. It was instantaneous during setup while offline. Something foreign is running in the background. Hypothesize that foreign app is trying to report to C2, but can't, because it was suddenly Ethernet unplugged.

Re-imaged to offline image. Made changes to WDAC LockDown to turn off ISG. ( which is a reputation service of WDAC which allows 'good' programs. ) Backed up as offline image2.

Round #2: Lost the battle. Still something ran in the background after putting it online for 2 hrs. Standard account signout again takes 3 mins while offline.

Re-imaged to offline image2. Made changes to WDAC LockDown, building new base policy, based on standard Windows components, no ISG, (the left most choice) .( Dan told me that the outofbox base WDAC policy allows all MS certs, all MS Store apps, + Reputable apps. ) Backed up as offline image 3.

Round #3: Victory ! Left in DMZ for another 2 hrs. Watched movie. Standard account signout time now still instantaneous, same as during setup. Does not seem to be running anything extraneous in the background. Will review SIEM later to be double sure I'm OK. Yes I have a SIEM running in VirtualBox on the machine.

As we discussed through email, WDAC Lockdown default configuration assumes the device is behind a firewall. If you want to test in a DMZ, it would be best to use the config I sent you, which apparently is working great. We could make this the default config, but there would be way too many unwanted blocks, and is completely unnecessary if your device is behind a router.

WDAC Lockdown only applies the full Zero-Trust lock when the user is running a web app... it does not have an Always ON mode like CyberLock. The reason is we assume you will be running WDAC as well, and they make a great combo. Otherwise, WDAC Lockdown's Mode is essentially equivalent to CyberLock's AutoPilot mode.

But as you can see, ISG and WDAC Lockdown's AutoPilot mode will both auto allow benign items, which can be an issue if you are not behind a router, but it would be difficult for malware to bypass both of these running in tandem.

So the config I sent you would be a really great config for someone who wants more of a paranoid configuration. Once you have everything tweaked and optimized, can you please post the config, along with your changes, so that other people can use it if they are looking for a paranoid config? I might even try it... the only issue is that WDAC slows down Visual Studio considerably, and that is the main app I use.

 

[bazang]

I think a lot of the problem is that Millennials and Gen Z is they have grown up on mobile devices with Android/iOS and E2EE apps specifically which are much more secure than Windows out of the box. While older generations grew up on insecure Windows, 95/98/2000/XP/7 and had to be security conscious and really had to learn and master 3rd party security apps.

Tech savvy but security ignorant or resistant. That is stated not to be intended as a slight to the generations.

They have to find their own way.

 

[Victor M]

The battle goes on.

Victory is only temporary. The attacker was able to run things. Thus inserting his probably spyware module. Probably the firewall rules can use some improvement. He shouldn't be able to gain root, but that is if he didn't escalate privilege.

The SIEM hit a snag. Will have to fix it.