Reply to thread

Message

<blockquote data-quote="notabot" data-source="post: 795653" data-attributes="member: 75970">Thanks @ Andy, I plan to block sponsors via WDAC when I get a free evening&nbsp; do you have a list of sponsors&nbsp; ?I can’t agree regarding GPO and Office, it eg lets you block downloaded active content ( or active content altogether). If you refer to exploitation of office without active content by eg buffer overflows , these are complex, big apps and probably to have undiscovered exploits. But this is not a commodity attack.&nbsp; To cover these Exploit Guard ( to reduce the probability of exploit succeeding ) + WDAC for sponsors ( to reduce chances of privilege escalation ) + SRP ( to reduce what an exploited app can do from user space ). This lockdown is probably as good as it gets. We also have to consider that a document that’s meant to do a 0day without active content and also bypasses the other 3 mitigation layers, while entirely possible, is probably something that us home users don’t need to be worried about and I don’t believe there’s anything that can block an attack that’s so elaborate</blockquote>

[QUOTE="notabot, post: 795653, member: 75970"] Thanks @ Andy, I plan to block sponsors via WDAC when I get a free evening do you have a list of sponsors ? I can’t agree regarding GPO and Office, it eg lets you block downloaded active content ( or active content altogether). If you refer to exploitation of office without active content by eg buffer overflows , these are complex, big apps and probably to have undiscovered exploits. But this is not a commodity attack. To cover these Exploit Guard ( to reduce the probability of exploit succeeding ) + WDAC for sponsors ( to reduce chances of privilege escalation ) + SRP ( to reduce what an exploited app can do from user space ). This lockdown is probably as good as it gets. We also have to consider that a document that’s meant to do a 0day without active content and also bypasses the other 3 mitigation layers, while entirely possible, is probably something that us home users don’t need to be worried about and I don’t believe there’s anything that can block an attack that’s so elaborate [/QUOTE]

Verification