Advanced Plus Security oldschool's 2020 laptop setup

[SeriousHoax]

Have you find

I will try this challenge. I have WD+ Configure Defender. I'll uninstall SpyShelter Premium and join your club! I feel so brave!

Here's your certificate. Now you're officially brave

 

[Andy Ful]

oldschool,
The RunBySmartScreen tool can be used to open any new/untrusted file, so the user cannot be fooled by a spoofed file extension. If he/she thinks that the file is a photo, then it will not be opened (via RunBySmartScreen) when it is a script with a photo icon. But, I am not sure if it is a common way of using RunBySmartScreen. What do you think?

 

[oldschool]

oldschool,
The RunBySmartScreen tool can be used to open any new/untrusted file, so the user cannot be fooled by a spoofed file extension. If he/she thinks that the file is a photo, then it will not be opened (via RunBySmartScreen) when it is a script with a photo icon. But, I am not sure if it is a common way of using RunBySmartScreen. What do you think?

I'm not sure if it's a common way to use it either. I've only used it for installers myself so far.

 

[Andy Ful]

I'm not sure if it's a common way to use it either. I've only used it for installers myself so far.

Ha, ha. It seems, that most users apply only one half of RunBySmartScreen.
RunBySmartScreen works like on-demand "SRP + Forced SmartScreen" (although it does not use SRP). So, when the user opens a file by pressing Enter or the left-mouse--click, the file is opened normally. When he/she uses the right-mouse-click and chooses RunBySmartScreen, the file opening is restricted and the alert is displayed (for unsafe files). In this way, the user can apply two security setups by simply choosing between normal file opening and opening it via the right-mouse-click RunBySmartScreen entry.
If you open in MS Office or Adobe Reader a document from a flash drive, then it will not be opened in Protected view. If you will do it via RunBySmartScreen, then the MOTW is added and MS Office or Adobe Reader will open the document in Protected view (as if it was downloaded by the web browser).

MT members usually pay attention to file extensions and do not open files with unsafe or unknown extensions. So, they can use only one half of RunBySmartScreen.

 

[oldschool]

I got a quick reply about an adblocking issue on the Brave forum, which motivated me to download the Nightly version with its improved adblock features. Will report here.

 

[oldschool]

Exploit Protection settings for browsers (thanks to @Umbra). These haven't broken anything yet, e.g. extensions crashing.

- for Brave, Edge and Firefox:

Block low integrity images - ON
Block remote images - ON
Block untrusted fonts - ON
Control flow guard (CFG) - ON
Data execution prevention (DEP) - ON + Enable thunk emulation - CHECKED
Disable extension points - ON
Force randomization for images (Mandatory ASLR) - ON + Do not allow stripped images - CHECKED
Randomize memory allocations (Bottom-up ASLR) - ON
Validate exception chains (SEHOP) - ON
Validate handle usage - ON
Validate heap integrity - ON
Validate image dependency integrity - ON

ADD for Edge Chromium only:

Code integrity guard - ON (with or without Also allow images signed by M$ Store CHECKED)

 

[oldschool]

Back to Bitdefender Trafficlight in Brave and Firefox after some testing of Emsisoft and Malwarebytes. Disabled search results scanning.

I also cleaned up the thread.

 

[blackice]

Back to Bitdefender Trafficlight in Brave and Firefox after some testing of Emsisoft and Malwarebytes. Disabled search results scanning.

I also cleaned up the thread.

And your avatar!

 

[ForgottenSeer 85179]

And your avatar!

The new-old(school)

 

[oldschool]

Revised setup as above.

 

[blackice]

Revised setup as above.

Did you get bored sitting home inside all day?

 

[oldschool]

Did you get bored sitting home inside all day?

No, I ran errands in the morning and was cooking later. We got the order today that we're to shelter in place starting 3/18. It's one thing afer another.

 

[Outpost]

Very good and light setup.

 

[Parsh]

Exploit Protection settings for browsers (thanks to @Umbra). These have broken anything yet, e.g. extensions crashing.

- for Brave, Edge and Firefox:
Block low integrity images - ON
Block remote images - ON
Block untrusted fonts - ON
Control flow guard (CFG) - ON
Data execution prevention (DEP) - ON + Enable thunk emulation - CHECKED
Disable extension points - ON
Force randomization for images (Mandatory ASLR) - ON + Do not allow stripped images - CHECKED
Randomize memory allocations (Bottom-up ASLR) - ON
Validate exception chains (SEHOP) - ON
Validate handle usage - ON
Validate heap integrity - ON
Validate image dependency integrity - ON

ADD for Edge Chromium only:
Code integrity guard - ON (with or without Also allow images signed by M$ Store CHECKED)

Exactly mine These settings were the most practical without breaking the chromium browser. Helpful to an extent to avoid common exploit techniques.
I just could not enable 'Code Integrity Guard' as it messed up ESET's protection.
A chrome-specific DLL eplgChrome.dll and the Safe Banking monitoring DLL are signed by ESET itself. Hence blocked, raising multiple error dialog boxes everytime.

 

[oldschool]

I just could not enable 'Code Integrity Guard' as it messed up ESET's protection.

I'm not surprised.

 

[Digmor Crusher]

Hmm, what the heck happened to "WIndows Defender for a Year" experiment???

 

[oldschool]

Hmm, what the heck happened to "WIndows Defender for a Year" experiment???

What can I say? Sheltering in place so I have more time on my hands. Now that you've shamed me I may have to revert!

 

[SeriousHoax]

I just could not enable 'Code Integrity Guard' as it messed up ESET's protection.
A chrome-specific DLL eplgChrome.dll and the Safe Banking monitoring DLL are signed by ESET itself. Hence blocked, raising multiple error dialog boxes everytime.

Yes this is expected from almost every AV except Emsisoft and some others maybe.

 

[oldschool]

Hmm, what the heck happened to "WIndows Defender for a Year" experiment???

You shamed me, my friend - so I've reverted to Windows Defender. Cheating on the challenge was fun but it didn't last long!

 

[Digmor Crusher]

Hallelujah.