Reply to thread

Message

<blockquote data-quote="wat0114" data-source="post: 995938" data-attributes="member: 91306">I know the sample CS used was probably different and even modified, but I just wanted to use something that was at least somewhat relevant.CS&#039; approach of using something like CF or SBie to contain is rather powerful; it uses blanket treatment of everything, no matter how harmful or even harmless it might be, and no matter what steps it uses, or how it may be modified by the attacker, including LOLBins utilized in its attack. It simply contains it, stopping the malware dead in its tracks from committing malicious modification to the target system.The SRP approach can be powerful too, but only if a true default-deny setup is used, which of course has the drawback of requiring the end user to manage rules on a mostly ongoing basis, carefully crafting allow rules where necessary, without compromising security in the process. Micro-management of this approach can be painstaking and undesirable for many. I do like how you utilize it in H_C though <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite109" alt=":)" title="Smile&nbsp; &nbsp; :)" loading="lazy" data-shortname=":)" />Finally as you said,&nbsp; if the user is simply going to disable protection, no matter what is used, then it&#039;s all a moot point anyway.</blockquote>

[QUOTE="wat0114, post: 995938, member: 91306"] I know the sample CS used was probably different and even modified, but I just wanted to use something that was at least somewhat relevant. CS' approach of using something like CF or SBie to contain is rather powerful; it uses blanket treatment of everything, no matter how harmful or even harmless it might be, and no matter what steps it uses, or how it may be modified by the attacker, including LOLBins utilized in its attack. It simply contains it, stopping the malware dead in its tracks from committing malicious modification to the target system. The SRP approach can be powerful too, but only if a true default-deny setup is used, which of course has the drawback of requiring the end user to manage rules on a mostly ongoing basis, carefully crafting allow rules where necessary, without compromising security in the process. Micro-management of this approach can be painstaking and undesirable for many. I do like how you utilize it in H_C though :) Finally as you said, if the user is simply going to disable protection, no matter what is used, then it's all a moot point anyway. [/QUOTE]

Verification