Advanced Plus Security Kongo's Computer Security Config 2024

Last updated
Feb 25, 2024
How it's used?
For home and private use
Operating system
Windows 11
On-device encryption
BitLocker Device Encryption for Windows
Log-in security
    • Hardware security key
Security updates
Allow security updates and latest features
Update channels
Allow stable updates only
User Access Control
Always notify
Smart App Control
Off
Network firewall
Enabled
About WiFi router
- Speedport Smart 4
- Firewalla Blue +
Real-time security
Deep Instinct Endpoint Protection
Firewall security
Microsoft Defender Firewall with Advanced Security
About custom security

Hardening tools:
- Firewall Hardening (blocking outbound connections of LOLBins)
- Run by SmartScreen (forces SmartScreen to scan files of choice)

- STOP/DJVU Ransomware Vaccine (immunizes system against this type of ransomware)
- O&O ShutUp10 (recommended settings)
- O&O AppBuster (removed unecessary Windows 11 apps)
- Windows Sandbox



System settings:
- Microsoft Defender running in sandbox (inactive)
- Reputation Based Protections (all modules enabled)
- Smart App Control enabled

- Data Execution Prevention set to AlwaysOn
- Core Isolation: Memory Integrity enabled
-
Kernel-mode Hardware-enforced Stack Protection enabled
- Secure Boot enabled
- Drives encrypted via TPM (BitLocker)
- Windows Update Delivery Optimization disabled
- AutoPlay disabled
- Network Discovery disabled (Public Firewall profile)
- PowerShell --> Constrained Language Mode
- Hide extensions for known file types --> disabled
- Show hidden files --> enabled

- Virtualization enabled (allows Application Sandboxing)
- Custom Exploit Protection Settings for Firefox:
Code:
Block low integrity images - ON
Block remote images - ON
Block untrusted fonts - ON
Control flow guard (CFG) - ON
Data execution prevention (DEP) - ON + Enable thunk emulation - CHECKED
Disable extension points - ON
Force randomization for images (Mandatory ASLR) - ON + Do not allow stripped images - CHECKED
Randomize memory allocations (Bottom-up ASLR) - ON
Validate exception chains (SEHOP) - ON
Validate handle usage - ON
Validate heap integrity - ON
Validate image dependency integrity - ON

Thanks to @oldschool for sharing! :)

ㅤㅤㅤHardware Firewall (Firewalla Blue Plus):
- Active Protect (Strict)
- Ad Block (Strict)
- OISD blocklist enabled in Firewalla
- New Device Quarantine (restricted internet access for newly connected devices)

- Geo-IP Filtering (blocking connections from and to Russian + Chinese IPs)
- Unbound DNS enabled for all devices
‎‎‎ㅤ‎ ‎ ‎ ‎
Periodic malware scanners
Norton Power Eraser, X-Sec and AdwCleaner
Malware sample testing
I do participate in malware testing. See details about my testing environment below.
Environment for malware testing
‎‎‎ㅤㅤㅤ
VMware Workstation Player + Mullvad VPN on host machine while connected to the guest network.

Online Malware Analysis Platforms that I use:


- FileScan.iO
- Intenzer Analyze
- Hybrid Analysis
- VirusTotal
- Sophos Intelix
- Valkyrie
- ANY.RUN
-
Triage
- Kaspersky Threat Intelligence Portal
-
Docguard.iO
- PolySwarm
- Yomi
- Neiki.Dev
- ThreatZone
- UnpacMe


--> Currently I am barely testing
Browser(s) and extensions

Mozilla Firefox v. 123.0.0

Extensions:
- uBlock Origin Lite
- Netcraft

- Bitwarden


Browser privacy and security settings:
- Tracking protection: Strict (enables Total Cookie Protection)
- Enable secure DNS using: Max Protection
- HTTPS-only-mode enabled
- DuckDuckGo set as search engine
- Pocket disabled
- Sending DNT-requests disabled (enabling makes you more identifiable and barely gives any advantage on most sites.)
- Clearing browsing data on exit
- Search suggestions disabled
- Websites overview disabled
- Blocking incoming location, camera and microphone requests
- AutoPlay for audio and video disabled
- Firefox telemetry disabled (also in about:config)
- Blocking pop-ups
- Warn when websites try to install addons enabled
- Protection against fraudulent content and dangerous software enabled



about:config tweaks:
- network.dns.echconfig.enabled =
true
- network.dns.use_https_rr_as_altsvc = true
- fission.autostart = true
- pdfjs.enableScripting =
false
- network.IDN_show_punycode = true
- security.ssl.require_safe_negotiation = true

- geo.enabled = false
- webgl.disabled = true
- network.trr.mode =
3 (NextDNS)

ㅤㅤ
Secure DNS

- NextDNS with DoH + OISD blocklist (Firefox exclusively)
- Unbound DNS (Network-wide)


Desktop VPN
Proton VPN with Secure Core, NetShield and Permanent Kill Switch
Password manager
Bitwarden Premium
Maintenance tools
PatchMyPC, RuckZuck, UpdateHub, HiBit Uninstaller and Windows built in tools for cleaning and optimization
File and Photo backup
backup to external drive when necessary
Active subscriptions
    • Google One Standard 200GB
System recovery
Aomei Backupper
Risk factors
    • Browsing to popular websites
    • Browsing to unknown / untrusted / shady sites
    • Opening email attachments
    • Buying from online stores, entering banks card details
    • Downloading software and files from reputable sites
    • Sharing and receiving files and torrents
    • Gaming
    • Streaming audio/video content from shady sites
    • Downloading malware samples
Computer specs
GPU: Nvidia Geforce RTX 360 TI
CPU: Intel I5 12600K
RAM: 16 GB DDR4-3200 Crucial
Hard disks: 500 GB Samsung 970 EVO Plus + 1 TB Western Digital Blue
Notable changes
- Updated for year 2024
What I'm looking for?

Looking for minimum feedback.

Kongo

Level 35
Thread author
Verified
Top Poster
Well-known
Feb 25, 2017
2,481
Thats a one very well detailed config, only thing wich comes into my mind is fallback browser if you run into problems with those tweaks of firefox

Heres checklist if you find anything helpful, you could add it as you have firefox tweak sites noted:
Damn, thats quite a lot of stuff to look at. Thanks for sharing! (y)
 

Kongo

Level 35
Thread author
Verified
Top Poster
Well-known
Feb 25, 2017
2,481
+ added CSS Exfil Protection to Firefox (based on @Moonhorse recommended GitHub site)
- replaced old referer about:config tweaks with "network.http.referer.spoofSource = true" which sets the target URL as the referer. (Might result in website breakage)
 
Last edited:

Andy Ful

From Hard_Configurator Tools
Verified
Honorary Member
Top Poster
Developer
Well-known
Dec 23, 2014
8,040
It would be interesting to test this combo on MH. If on EXE files Cylance could be as effective as Defender (HIGH settings), then SWH + Cylance would be a nice combo. Some incomplete tests (rather presentations than tests) can suggest that on malicious EXE files Defender on HIGH settings can be more effective than Cylance.




Of course, the results of the "tests" on the PC Security Channel are only unverified suggestions.:unsure:
Anyway, any AV (also slightly tweaked) which is as effective as Defender (HIGH settings) is worth attention.:)
 

Kongo

Level 35
Thread author
Verified
Top Poster
Well-known
Feb 25, 2017
2,481
It would be interesting to test this combo on MH. If on EXE files Cylance could be as effective as Defender (HIGH settings), then SWH + Cylance would be a nice combo. Some incomplete tests (rather presentations than tests) can suggest that on malicious EXE files Defender on HIGH settings can be more effective than Cylance.




Of course, the results of the "tests" on the PC Security Channel are only unverified suggestions.:unsure:
Anyway, any AV which is as effective as Defender (HIGH settings) is worth attention.:)

Would love to test Cylance and SWH in the Hub, but I think this isn't working like that. SWH would block pretty much all the samples (jar, vbs, js). As you saw in recent tests in the Hub, there are some days where only malicious scrips are shared for testing. I think it is predictable that SWH will block all of them. Those results are simply not highliting the performance of the main AV (Cylance) which is the basic idea behind the tests. Nonetheless I will ask @upnorth and @harlan4096 what they think about this as I am also interested in that combo. (y)
 

Kongo

Level 35
Thread author
Verified
Top Poster
Well-known
Feb 25, 2017
2,481
I'm curious about the reason for using 3 different driver update programs? Comparing differences and which one of the 3 would you recommend
Sumo and PatchMyPc are software updaters, and not driver updaters. The only driver updater I (had) is Driver Easy, I just forgot to remove it from my config... 😅 So now I am only using Windows built updates to update the most important drivers, and GeForce Expierence for my GPU. From the software updaters I can recommend both. PatchMyPC is the more convenient option of the two, as it can install software updates with one click. Sumo however detects far more programs than PatchMyPc but can't update them within the software and only rederects you to the website of the program. I would recommend using both, as PatchMyPC is portable and doesn't even require any installation at all. (y)
 

Kongo

Level 35
Thread author
Verified
Top Poster
Well-known
Feb 25, 2017
2,481
Remember that "Experience" had some security vulnerabilities in the past.

If you regulary read some IT news sites, I'm sure you always know about updates so doing it manually keeps your system safer (y)
I think all vulnerabilities were patched by now? I didn't really hear much about that, so correct me if I am wrong...
 
F

ForgottenSeer 85179

Andy Ful

From Hard_Configurator Tools
Verified
Honorary Member
Top Poster
Developer
Well-known
Dec 23, 2014
8,040
Would love to test Cylance and SWH in the Hub, but I think this isn't working like that. SWH would block pretty much all the samples (jar, vbs, js). As you saw in recent tests in the Hub, there are some days where only malicious scrips are shared for testing. I think it is predictable that SWH will block all of them. Those results are simply not highliting the performance of the main AV (Cylance) which is the basic idea behind the tests. (y)
Yes, you are right. I was thinking about the comparison of detections on EXE files:
Cylance vs. Defender (HIGH settings, SWH is often used with Defender).

By the way, it would be interesting to use one fixed AV in all MH tests, as a reference detection. It could be any AV (with settings agreed by testers) that would reflect the average (in a statistical sense) detection of commercial AVs.
 

Kongo

Level 35
Thread author
Verified
Top Poster
Well-known
Feb 25, 2017
2,481
Yes, you are right. I was thinking about the comparison of detections on EXE files:
Cylance vs. Defender (HIGH settings, SWH is often used with Defender).
But then the Hub isn't the right playground for such comparisons, as exe samples are the least shared ones for the tests. :confused:
By the way, it would be interesting to use one fixed AV in all MH tests, as a reference detection. It could be any AV (with settings agreed by testers) that would reflect the average (in a statistical sense) detection of commercial AVs.
You better share this idea with @upnorth or @harlan4096 as they are in charge of the Malware Hub tests and the procedures. (y)
 

Andy Ful

From Hard_Configurator Tools
Verified
Honorary Member
Top Poster
Developer
Well-known
Dec 23, 2014
8,040
But then the Hub isn't the right playground for such comparisons, as exe samples are the least shared ones for the tests. :confused:
Yes, that can be a problem. But if you like, you can test Cylance for a few months on all samples and then look if there is a significant difference (for EXE files) compared to top AVs tested on MH at the same testing period.(y)
It seems that Cylance was tested on MH two years ago. Cylance got very poor scores in AV-Test. It was tested 3 times in the Consumer category in 2020 June, August, October, and in the Business category April, June, August, October. It would be interesting if the poor results are related to scripts, macros, etc. (covered in your setup by SWH).
 

Kongo

Level 35
Thread author
Verified
Top Poster
Well-known
Feb 25, 2017
2,481
Yes, that can be a problem. But if you like, you can test Cylance for a few months on all samples and then look if there is a significant difference (for EXE files) compared to top AVs tested on MH at the same testing period.
Will add it in my next voting on my profile. :)
It would be interesting if the poor results are related to scripts, macros, etc. (covered in your setup by SWH).
That must be the case, as Cylance literally only detects PE-files...
 

Andy Ful

From Hard_Configurator Tools
Verified
Honorary Member
Top Poster
Developer
Well-known
Dec 23, 2014
8,040
That must be the case, as Cylance literally only detects PE-files...
Yes, this is a very probable explanation for the most part of the poor results. But, we still do not know how effective can be Cylance on PE files. We have only PC Security Channel "tests" that suggest a more complex scenario. Anyway, the effectiveness of Cylance increases for fresher samples (like in MH), so the results can be interesting.
 
  • Like
Reactions: Kongo and Venustus

Andy Ful

From Hard_Configurator Tools
Verified
Honorary Member
Top Poster
Developer
Well-known
Dec 23, 2014
8,040
Bearing in mind that Cylance does not detect scripts, it seems that you can test it in two scenarios: Cylance alone and with SWH (similar tests were done on MH for some AVs with SysHardener). Comparing the results of both could be interesting, because in some cases, the initial EXE malware might use scripts in the infection chain. Of course, two testing scenarios will make the testing procedure more complex and time-consuming.:(

Edit
If the impact of SWH on the detection of PE files will be visible, then I can consider adding the enforcement for 'All users' to SWH. For now, I think that adding it is questionable. :unsure:
 
Last edited:
  • Like
Reactions: Moonhorse and Kongo

Kongo

Level 35
Thread author
Verified
Top Poster
Well-known
Feb 25, 2017
2,481
Bearing in mind that Cylance does not detect scripts, it seems that you can test it in two scenarios: Cylance alone and with SWH (similar tests were done on MH for some AVs with SysHardener). Comparing the results of both could be interesting, because in some cases, the initial EXE malware might use scripts in the infection chain. Of course, two testing scenarios will make the testing procedure more complex and time-consuming.:(
I reached out to @upnorth and @harlan4096 and asked if it's possible to do the combo. As you already said, combos were allowed before, but now after some rule changes they are not anymore. This is due to the fact that it can be very confusing for some of the viewers of the tests and could result in a "Wild Western" of security software tests here on the Hub. (to quote @upnorth ) I also have to agree with him, as results of the combo would be very predictable and don't really show the capabilities of the AV.
 
Last edited:

Andy Ful

From Hard_Configurator Tools
Verified
Honorary Member
Top Poster
Developer
Well-known
Dec 23, 2014
8,040
I reached out to @upnorth and @harlan4096 and asked if it's possible to do the combo. As you already said, combos were allowed before, but now after some rule changes they are not anymore. This is due to the fact that it can be very confusing for some of the viewers of the tests and could result in a "Wild Western" of security software tests here on the Hub. (to quote @upnorth ) I also have to agree with him, as results of the combo would be very predictable and don't really show the capabilities of the AV.
I respect this decision, although it has some serious cons.
The case of Cylance is special. It is not a full AV that can detect all files - it can detect only PE files. So, one can argue that Cylance alone should not be tested at all on MH alongside the full AVs. The comparison with full AVs will probably prevent many users from using Cylance.:(
On the other side, testing it with an anti-script layer without showing the real detection of Cylance alone, would be confusing and could promote Cylance compared to other AVs. In my opinion, the only fair solution is performing the dual test = Cylance alone compared to Cylance + anti-script layer. This would clearly show the pros and cons of using Cylance. Furthermore, this would be fair for all, including Home users that search for sensible protection.(y)

There is no perfect way of testing such products as Cylance, so we should accept the final decision of the MH testers.(y)

Post edited.
 
Last edited:

Kongo

Level 35
Thread author
Verified
Top Poster
Well-known
Feb 25, 2017
2,481
I respect this decision, although it has some serious cons.
The case of Cylance is special. It is not a full AV that can detect all files - it can detect only PE files. So, one can argue that Cylance alone should not be tested at all on MH alongside the full AVs. The comparison with full AVs will probably prevent many users from using Cylance.:(
On the other side, testing it with an anti-script layer without showing the real detection of Cylance alone, would be confusing and could promote Cylance compared to other AVs. In my opinion, the only fair solution is performing the dual test = Cylance alone compared to Cylance + anti-script layer.(y)

There is no perfect way of testing such products as Cylance, so we should accept the final decision of the MH testers.(y)
I am quite new in the Hub and don't think that I am the right contact person in that case. I understand your doubts and also what you are trying to say, but I think you should discuss that further in a private chat with either @upnorth or @harlan4096 if you want. :)
 
  • Like
Reactions: Andy Ful

Andy Ful

From Hard_Configurator Tools
Verified
Honorary Member
Top Poster
Developer
Well-known
Dec 23, 2014
8,040
I am quite new in the Hub and don't think that I am the right contact person in that case. I understand your doubts and also what you are trying to say, but I think you should discuss that further in a private chat with either @upnorth or @harlan4096 if you want. :)
I am sorry for bloating your thread. I think that the problem does not require further discussion. The MH testers know best what to do. (y):)
 

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top