Hard_Configurator - Windows Hardening Configurator

[plat]

Lovely. I can delete the previous H_C Master from downloads folder now? I just use the Firewall Hardening Tool and was pleased to find it quickly and easily. Had it re-write the rules and everything, and it's set, I checked it.

The only issue and it's a minor one for me: I'm having a little problem dragging the interface around. It will drag but as soon as you release the mouse and then try to grab it again, it doesn't grab. It seems you only get one chance to drag it, two if you're lucky. My mouse is a very basic, cheap one, but I have no issues dragging other windows around. Anyone else?

Edit: There is actually a spot where you can drag the UI consistently but it's just within the frame in the upper left-hand side of the UI. lol! Here, I marked it. Hold the mouse pointer right on the orange border within the area of the two black arrows. Maybe it works this way for everyone?

Spoiler

Edit #2: HitmanPro has also cleared Hard_Configurator and Switch DefaultDeny .exes via its cloud. Is it possible, then, that Sophos would also have no problems with these?

 

[SeriousHoax]

computer restart is required to apply the new rules

Oh that's the reason I guess. I didn't restart the computer.

But, I noticed for the first time that some blocked connections are not logged, if they do not try to send packets.

Interesting. Is it something that can be fixed?

Thanks. The code was copied from H_C and adjusted to FirewallHardening. I did not notice it.

Haha, it's nice that I noticed and hopefully it's going to be fixed in the next beta

 

[Andy Ful]

...
Interesting. Is it something that can be fixed?
...

There are some events logged in the Security Log without the information about the file. They are pretty much useless to FireWall Hardening Log, which is focused on blocking applications. These events can happen if the application does not connect directly but uses other system resources. A similar thing happens when bitsadmin triggers file downloading. In fact, svchost is seen by the firewall and not bitsadmin.

 

[Andy Ful]

The added rules work for me (computer restart is required to apply the new rules). The rules are added first at the end of the list, but after restarting the computer and running FirewallHardening, the rules are visible in alphabetical order:
View attachment 234544
But, I noticed for the first time that some blocked connections are not logged, if they do not try to send packets.
For example, I added the rules for three email clients (Claws-mail, eM Client, and Postbox). The blocked events for two email clients were added to the Log. But, not for eM Client which was blocked too (I tried to download an attachment without success).

These blocked connections were not related to FirewallHardening. I repeated the test today and when eM Client tried to connect directly it was blocked by FireWallHardening rule.

 

[Gandalf_The_Grey]

@Andy Ful Many thanks for your hard work on beta version 5.0.0.1 and it's manual.
I have installed it with the recommended settings.
ConfigureDefender on High + Controlled Folder Access on.
FirewallHardening at Recomended H_C.
DocumentsAntiExploit MS Office at ON2.
Anything I missed or configured wrong?
Because Bandizip now has advertisements in the free version I switched to Explzh (also keeps MOTW).
Can you add that program to Harden Archivers?

 

[Andy Ful]

@Andy Ful Many thanks for your hard work on beta version 5.0.0.1 and it's manual.
I have installed it with the recommended settings.
ConfigureDefender on High + Controlled Folder Access on.
FirewallHardening at Recomended H_C.
DocumentsAntiExploit MS Office at ON2.
Anything I missed or configured wrong?
Because Bandizip now has advertisements in the free version I switched to Explzh (also keeps MOTW).
Can you add that program to Harden Archivers?

I will look at this app.

 

[Andy Ful]

...
I have installed it with the recommended settings.
ConfigureDefender on High + Controlled Folder Access on.
FirewallHardening at Recomended H_C.
DocumentsAntiExploit MS Office at ON2.
...

Seems good (if you do not use Adobe Acrobat Reader).

 

[Gandalf_The_Grey]

Seems good (if you do not use Adobe Acrobat Reader).

Great, thanks.
I'm using Foxit Reader.

 

[ForgottenSeer 85179]

Great, thanks.
I'm using Foxit Reader.

If you're just need a reader: you can use the new Chromium-Edge too for that which also have better isolation

 

[Andy Ful]

There are some good PDF Readers in Microsoft Store:
PDF viewers (all use Appcontainer):
Adobe Reader Touch
Foxit MobilePDF
PDF Viewer Plus, from GSnathan
PDF Reader from Kdan Mobile
Perfect PDF Reader, from soft Xpansion
Xodo PDF Reader & Editor (very fast with big documents)

PDF Reader plugins in web browsers are far more vulnerable to attacks and can help to exploit the web browser.

 

[SeriousHoax]

There are some good PDF Readers in Microsoft Store:
PDF viewers (all use Appcontainer):
Adobe Reader Touch
Foxit MobilePDF
PDF Viewer Plus, from GSnathan
PDF Reader from Kdan Mobile
Perfect PDF Reader, from soft Xpansion
Xodo PDF Reader & Editor (very fast with big documents)

PDF Reader plugins in web browsers are far more vulnerable to attacks and can help to exploit the web browser.

Which one do you personally use?

 

[Sampei Nihira]

If your priority is security, also check the history of security vulnerabilities before choosing:

Krzysztof Kowalczyk Sumatrapdf security vulnerabilities, CVEs, versions and CVE reports

Krzysztof Kowalczyk Sumatrapdf security vulnerabilities, CVEs, exploits, metasploit modules, vulnerability statistics and list of versions

www.cvedetails.com

Foxitsoftware Foxit Reader security vulnerabilities, CVEs, versions and CVE reports

Foxitsoftware Foxit Reader security vulnerabilities, CVEs, exploits, metasploit modules, vulnerability statistics and list of versions

www.cvedetails.com

 

[Andy Ful]

Which one do you personally use?

I used them all and finally chose the simplest one, which is Adobe Reader Touch. It is not actively developed. It is fast, but not fast as Xodo PDF Reader. I also block the Internet connection to PDF Readers via FirewallHardening tool (desktop applications) or Windows Firewall (UWP apps).

Edit.
Blocking the Internet Access to PRD Reader does not prevent it to open the web browser. This can be prevented by using Exploit Protection to block child processes.

 

[Gandalf_The_Grey]

An interesting discussion about the safety of PDF readers
I would like an option to see a pdf in outlook.
That's done by Foxit Reader by FoxitPreviewhost.
Any safe alternative that can do that?
It's a: Q&A - Security vs. Comfort debate

 

[DDE_Server]

I used them all and finally chose the simplest one, which is Adobe Reader Touch. It is not actively developed. It is fast, but not fast as Xodo PDF Reader. I also block the Internet connection to PDF Readers via FirewallHardening tool.

also their updater services ??

 

[Gandalf_The_Grey]

also their updater services ??

There are no more updates for Adobe Reader Touch, but if there were updates they would go through the Microsoft Store.

 

[DDE_Server]

Hi @Andy Ful
i want to know if there are away to export the rules you writes as white listed for firewall hardening to some readable format Text or html format
i am carious about these rules

 

[DDE_Server]

There are no more updates for Adobe Reader Touch, but if there were updates they would go through the Microsoft Store.

i mean is he update manual each version? i prefer built in feature update in each software if it exist (faster to update instead of downloading the updater manually)

 

[ForgottenSeer 85179]

PDF Reader plugins in web browsers are far more vulnerable to attacks and can help to exploit the web browser.

I mean the internal PDF feature, not external plugins. In Firefox that was isolated, so i guess it's in Chromium-Edge too and even better?

 

[Gandalf_The_Grey]

i mean is he update manual each version? i prefer built in feature update in each software if it exist (faster to update instead of downloading the updater manually)

No, for apps from the Microsoft Store the updates go (automatically) through the Microsoft Store:

https://support.microsoft.com/en-gb/help/4026259/microsoft-store-get-updates-for-apps-and-games