Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 971421" data-attributes="member: 32260">My knowledge about CF may be outdated. I know that it has got a great firewall, strong sandbox, and strong protection against classic attack vectors via PE files. I am not sure about its protection against modern attacks via the fileless methods and .Net framework DLLs. These methods can be neutralized by adding scripting Interpreters and some LOLBins to the Unrecognized group (run in the sandbox).If I correctly recall, CF has to be configured for maximum security to trust only essential vendors to avoid DLL hijacking via vulnerable legal programs.There are some MT members that can know more about these factors.You can tweak CF ([USER=7463]@cruelsister[/USER] settings)+ SWH to reproduce most of the H_C protection for the home computer. This could be recommendable in your case.If you use CF without [USER=7463]@cruelsister[/USER] settings, then you can use it with the H_C (instead of&nbsp; SWH).If you do not need a strong firewall, then you can also replace CF + SWH with H_C.When choosing the H_C, you have to respect SmartScreen alerts when installing applications. The H_C uses Forced SmartScreen to bypass default-deny for EXE and MSI installers.<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite130" alt="(y)" title="Thumbs up&nbsp; &nbsp; (y)" loading="lazy" data-shortname="(y)" /></blockquote>

[QUOTE="Andy Ful, post: 971421, member: 32260"] My knowledge about CF may be outdated. I know that it has got a great firewall, strong sandbox, and strong protection against classic attack vectors via PE files. I am not sure about its protection against modern attacks via the fileless methods and .Net framework DLLs. These methods can be neutralized by adding scripting Interpreters and some LOLBins to the Unrecognized group (run in the sandbox). If I correctly recall, CF has to be configured for maximum security to trust only essential vendors to avoid DLL hijacking via vulnerable legal programs. There are some MT members that can know more about these factors. You can tweak CF ([USER=7463]@cruelsister[/USER] settings)+ SWH to reproduce most of the H_C protection for the home computer. This could be recommendable in your case. If you use CF without [USER=7463]@cruelsister[/USER] settings, then you can use it with the H_C (instead of SWH). If you do not need a strong firewall, then you can also replace CF + SWH with H_C. When choosing the H_C, you have to respect SmartScreen alerts when installing applications. The H_C uses Forced SmartScreen to bypass default-deny for EXE and MSI installers.(y) [/QUOTE]

Verification