Advanced Security oldschool's surfing laptop configuration

[oldschool]

I've turned SAC on after Windows & Defender definition updates. I'm now MS's guinea pig. Only time will tell as to effects.

Edit: I've also enabled file hash computation in MS Defender.

 

[oldschool]

Interesting development. I had CleanMem installed prior to turning SAC on and, after SAC was turned on, it blocked parts of it due to being unsigned, effectively breaking it. I opened a new issue in Feedback Hub, submitted a sample to MS, and uninstalled CleanMem. Finally, I re-installed CleanMem on a whim and SAC has not blocked it. Very interesting, indeed. Or am I missing something?

 

[ForgottenSeer 97327]

Interesting development. I had CleanMem installed prior to turning SAC on and, after SAC was turned on, it blocked parts of it due to being unsigned, effectively breaking it. I opened a new issue in Feedback Hub, submitted a sample to MS, and uninstalled CleanMem. Finally, I re-installed CleanMem on a whim and SAC has not blocked it. Very interesting, indeed. Or am I missing something?

I had simular experience with ISG (intelligent Security Graph of WDAC). I used to test my WDAC config being active with an unsigned applicatiion. This worked from 2019 until end 2022. When I was updating an image with WDAC ISG with Bitdefender Free and another image with WDAC ISG combined with AVAST Free. All of a sudden ISG allowed the unsigned app, first I thought that my WDAC ran in audit mode, but ISG had whitelisted the unsigned app while I was updating my images.

I read somewhere that Smartscreen, ISG and SAC share (parts) of the same cloud whitelist backbone. So ISG seems to benefit from SAC. This made me think that Microsoft is really trying to make SAC work for general use. Your experience is another example that Microsoft is preparing SAC for a broad audience rollout.

 

[oldschool]

So ISG seems to benefit from SAC. This made me think that Microsoft is really trying to make SAC work for general use. Your experience is another example that Microsoft is preparing SAC for a broad audience rollout.

From my not-very-technical perspective, I would have to agree, contrary to what some MS critics claim. SAC is not simply a whitelisting protection. My experience was quite surprising.

 

[ForgottenSeer 98186]

So ISG seems to benefit from SAC.

ISG is the "data layer" that collects and processes the data which is eventually enforced by WDAC and SAC (based upon WDAC) policies.

What is not exactly clear is how or to what extent non-subscribing users are interfaced with ISG.

Source:

Understand App Control for Business policy rules and file rules

Learn how App Control policy rules and file rules can control your Windows 10 and Windows 11 computers.

learn.microsoft.com

 

[oldschool]

I've now successfully run Mindfulness at the computer, which is not signed, and definitely not prevalent, with no block from SAC. So far, I'm impressed. Of course, my machine has very few programs and YMMV.

 

[Zero Knowledge]

I've turned SAC on after Windows & Defender definition updates. Only time will tell as to effects.

Living life in the fast lane! SAC looks good but the compatibility issues worry me. Sad that they nulled SRP in Windows 11 otherwise I would upgrade.

 

[oldschool]

Sad that they nulled SRP in Windows 11

Likewise, my friend!

 

[ForgottenSeer 97327]

ISG is the "data layer" that collects and processes the data which is eventually enforced by WDAC and SAC (based upon WDAC) policies.

View attachment 273048

It is as your clips says "Intelligent Secure Graph Authorization"

 

[ForgottenSeer 97327]

I've now successfully run Mindfulness at the computer, which is not signed, and definitely not prevalent, with no block from SAC. So far, I'm impressed.

Kind of fun that Mindfulness made you worry Good to see you are happy again, so ....

sit upright close your eyes, breathe in, relax and say "Smart App Control" while breathing out and repeat for around 15 minutes

 

[oldschool]

I'm going to try out browser compartmentalization since I recently installed Chrome after @Sammo's posts here and here tweaked my curiousity. The 'plan' is to use Edge for sensitive browsing like purchases, email, etc., Chrome for tech and forum stuff, and Firefox for more general browsing. Use Chrome's µBO in medium mode. We'll see how this goes.

 

[oldschool]

At @Correlate's request, I've provided my Edge settings below:

Profiles - All OFF except Passwords set as needed
Privacy, etc. - Tracking protection @ Strict
                Clear browsing data on exit @ all checked except Passwords & Site permissions
                Privacy @ all OFF
                Optional diagnostics @ OFF
                Search & Service improvement :) @ OFF
                Personalizations & advertising @ OFF
                Security @ All ON except Website typo info & Site safety info
                Services @ All OFF except Enhance images
                Address bar & search @ search on address bar
Appearance - Home, Favorites & History @ ON
Sidebar - All OFF
Start, Home & New tabs - Preload new tab @ OFF
Share,copy & paste - Use format selected above... @ OFF
Cookies & data stored - Block 3rd party cookies @ ON
Default browser @ ??? :)
Downloads - All OFF except Show downloads menu
System & performance - All @ OFF except Hardware acceleration @ ON & Turn on effciency mode @ ALWAYS
Accessibility - All @ OFF except Show downloads menu & Use F12 to open dev tools @ ON

 

[oldschool]

MS Defender relies on the BAFS and the cloud backend but in case you're interested in configuring the signature update interval for the latest sigs, the best interval I've found is 2 hours. Enjoy the goodness of built-in features!

My Chrome hardening flags:

List of Interesting Experimental Flags for Google Chrome to Try Out

I just asked him, I will reply here when I get an answer.

malwaretips.com

 

[oldschool]

Back to search.disroot.org. Non-profit, indexed search engine. No ads.

 

[oldschool]

Changed default browser to Chrome.

 

[blackice]

Changed default browser to Chrome.

Umbra would be proud!

Out of curiosity what’s the deal breaker for Firefox?

 

[Moonhorse]

Changed default browser to Chrome.

Chrome is probably fastest browser to set up nowadays, all other browsers are bloated except firefox wich is aswell fast to set up

Google save browsing is pretty decent

Are you going to try out the new nvidia rtx super resolution that is meant for chrome ?

 

[ForgottenSeer 97327]

@oldschool preloading new tab disabled, but have you enabled startup boost in Edge?

 

[Shadowra]

Changed default browser to Chrome.

Chrome... my enemy...

 

[brambedkar59]

Changed default browser to Chrome.

I am also tempted but only one thing is stopping me. Chrome doesn't warn when you accidently close windows with many tabs open. I have lost several forms because of that. Also sleeping tabs are nice to have.