Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 968961" data-attributes="member: 32260">It does not really matter for home users. When SRP is not running in Ring 0, then the malware running with Admin privileges must bypass fewer obstacles to dismantle the SRP protection, compared to the security running in Ring 0.But this also assumes that:<ol>
<li data-xf-list-type="ol">Malware knows that the home user applied SRP (hardly possible).</li>
<li data-xf-list-type="ol">Malware has to infect/exploit the system (hardly possible with SRP on Windows 10).</li>
<li data-xf-list-type="ol">Malware has to elevate (hardly possible with SRP on Windows 10, especially with Defender).</li>
</ol>All of this can matter only with highly targeted attacks that can happen in Enterprises via lateral movement. Diplomats and dissidents can also consider this danger.It is worth knowing that running a security program in Ring 0 does not mean that it can protect against kernel-based malware (like for example WannaCry worm). Also, running the security program in Ring 0 can be rather easily bypassed in highly targeted attacks. Furthermore, most security programs do not run fully in Ring 0, so they can be exploited/bypassed by processes from the userland.[URL unfurl=&quot;true&quot;]https://malwaretips.com/threads/endpoint-detection-and-response-how-hackers-have-evolved-part-1.106619/[/URL][URL unfurl=&quot;true&quot;]https://malwaretips.com/threads/dell-windows-drivers-still-vulnerable-to-kernel-attacks.111526/[/URL]The true security boundary has to be run in Ring -1 (Virtualisation-based Security). Such security was already adopted by some AV vendors. The Windows built-in Microsoft Defender Application Guard (&quot;Modern SRP&quot;&nbsp; model) uses it too.</blockquote>

[QUOTE="Andy Ful, post: 968961, member: 32260"] It does not really matter for home users. When SRP is not running in Ring 0, then the malware running with Admin privileges must bypass fewer obstacles to dismantle the SRP protection, compared to the security running in Ring 0. But this also assumes that: [LIST=1] [*]Malware knows that the home user applied SRP (hardly possible). [*]Malware has to infect/exploit the system (hardly possible with SRP on Windows 10). [*]Malware has to elevate (hardly possible with SRP on Windows 10, especially with Defender). [/LIST] All of this can matter only with highly targeted attacks that can happen in Enterprises via lateral movement. Diplomats and dissidents can also consider this danger. It is worth knowing that running a security program in Ring 0 does not mean that it can protect against kernel-based malware (like for example WannaCry worm). Also, running the security program in Ring 0 can be rather easily bypassed in highly targeted attacks. Furthermore, most security programs do not run fully in Ring 0, so they can be exploited/bypassed by processes from the userland. [URL unfurl="true"]https://malwaretips.com/threads/endpoint-detection-and-response-how-hackers-have-evolved-part-1.106619/[/URL] [URL unfurl="true"]https://malwaretips.com/threads/dell-windows-drivers-still-vulnerable-to-kernel-attacks.111526/[/URL] The true security boundary has to be run in Ring -1 (Virtualisation-based Security). Such security was already adopted by some AV vendors. The Windows built-in Microsoft Defender Application Guard ("Modern SRP" model) uses it too. [/QUOTE]

Verification