Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 730724" data-attributes="member: 32260">That is right. That is also a basis for forced SmartScreen. The user can choose &#039;Run As SmartScreen&#039; option from Explorer context menu to safely execute EXE or MSI application installers. The application installer is first checked by SmartScreen Application Reputation and if it passes the check then it is allowed to run with Administrative Rights. The installation is ignored by default-deny protection. Forced Smartscreen feature can throw to SmartScreen, files which normally are ignored by SmartScreen, like files from: compressed archives, FAT 32 pendrives, ISO images or files downloaded via file downloaders outside web browsers, etc.One can say that Hard_Configurator protection can be easily bypassed via any UAC bypass, but the problem will be to execute such bypass - it will be blocked first by default-deny protection. When the user will insist to &#039;Run As SmartScreen&#039;, the exploit/malware will be blocked by SmartScreen reputation filter.There is only one little hole in the above security, when something legal is exploited. Even then, it is not easy to harm the system, because an exploit usually runs as standard user and scripts are highly restricted (payload&#039;s download &amp; execution will be blocked).But, some more sophisticated exploits can in theory bypass all those protective layers.&nbsp; So, the user can close the hole by using vulnerable applications in App Container (Word Mobile, Excel Mobile, PowerPoint Mobile, Adobe Touch, etc.) or by applying advanced Hard_Configurator restrictions via &lt;Blocked Sponsors&gt; or blocking DLLs in the Userspace. The users on Windows 10 FCU can also apply Exploit Guard mitigations or use ConfigureDefender to apply ASR.</blockquote>

[QUOTE="Andy Ful, post: 730724, member: 32260"] That is right. That is also a basis for forced SmartScreen. The user can choose 'Run As SmartScreen' option from Explorer context menu to safely execute [B]EXE or MSI application installers[/B]. The application installer is first checked by SmartScreen Application Reputation and if it passes the check then it is allowed to run with Administrative Rights. The installation is ignored by default-deny protection. Forced Smartscreen feature can throw to SmartScreen, files which normally are ignored by SmartScreen, like files from: compressed archives, FAT 32 pendrives, ISO images or files downloaded via file downloaders outside web browsers, etc. One can say that Hard_Configurator protection can be easily bypassed via any UAC bypass, but the problem will be to execute such bypass - it will be blocked first by default-deny protection. When the user will insist to 'Run As SmartScreen', the exploit/malware will be blocked by SmartScreen reputation filter. There is only one little hole in the above security, when something legal is exploited. Even then, it is not easy to harm the system, because an exploit usually runs as standard user and scripts are highly restricted (payload's download & execution will be blocked). But, some more sophisticated exploits can in theory bypass all those protective layers. So, the user can close the hole by using vulnerable applications in App Container (Word Mobile, Excel Mobile, PowerPoint Mobile, Adobe Touch, etc.) or by applying advanced Hard_Configurator restrictions via <Blocked Sponsors> or blocking DLLs in the Userspace. The users on Windows 10 FCU can also apply Exploit Guard mitigations or use ConfigureDefender to apply ASR. [/QUOTE]

Verification