SRP vs VoodooShield

[softie15]

Hi folks, I am trying to understand the following question for Win10 Pro protection.

Say I setup SRP using approach described at
How to make a disallowed-by-default Software Restriction Policy
(and also illustrated in tutorial like one at the end of this post). In short, I allow only things to run from a couple of well known Windows locations that cannot be written to by my user account.

Is there any point in adding VoodooShield to that system? What additional benefits does VS provide then?

I understand VS prevents anything unknown from running but if I already specified I only trust those limited locations and if I cannot even write to them, what additional protection would VS provide?

My apologies if this is a dumb question.

Thanks!

P.S. Youtube video for SRP:

 

[shmu26]

Hi folks, I am trying to understand the following question for Win10 Pro protection.

Say I setup SRP using approach described at
How to make a disallowed-by-default Software Restriction Policy
(and also illustrated in tutorial like one at the end of this post). In short, I allow only things to run from a couple of well known Windows locations that cannot be written to by my user account.

Is there any point in adding VoodooShield to that system? What additional benefits does VS provide then?

I understand VS prevents anything unknown from running but if I already specified I only trust those limited locations and if I cannot even write to them, what additional protection would VS provide?

My apologies if this is a dumb question.

Thanks!

P.S. Youtube video for SRP:

The problem with SRP is its inflexibility. If you have a certain program that needs to run in appdata, you can't allow it. If you want to stop unsafe programs from running from your downloads folder, you can't block them. It's an all-or-nothing deal.
Another thing that SRP will not give you is vulnerable process protection.

If you want SRP with flexibility and vulnerable process protection, it is the product called AppGuard. But it's not free.

Another software to consider is OSArmor. It is free, it is flexible, it has vulnerable process protection, and if you enable advanced options it is SRP-like. But it is still not going to guard your downloads like voodoo does.

 

[Andy Ful]

The problem with SRP is its inflexibility. If you have a certain program that needs to run in appdata, you can't allow it. If you want to stop unsafe programs from running from your downloads folder, you can't block them. It's an all-or-nothing deal.
Another thing that SRP will not give you is vulnerable process protection.
...

I would kindly disagree with you.
But, you are right. "It's an all-or-nothing deal". So, using default deny SRP (with posted setup) + additional SRP rules, the system will be far more restricted (as standard user) than applying OSArmor.

 

[shmu26]

I would kindly disagree with you.
But, you are right. "It's an all-or-nothing deal". So, using default deny SRP (with posted setup) + additional SRP rules, the system will be far more restricted (as standard user) than applying OSArmor.

@Andy Ful you obviously know a lot more about SRP than I do. If you disagree, there must be a reason. Please correct the mistakes you saw in my post.

But getting back to the original question, I would say that if a user has Voodooshield, that alone is enough to protect the system. As for the full capabilities of SRP, @Andy Ful knows about that subject.

 

[HarborFront]

The problem with SRP is its inflexibility. If you have a certain program that needs to run in appdata, you can't allow it. If you want to stop unsafe programs from running from your downloads folder, you can't block them. It's an all-or-nothing deal.
Another thing that SRP will not give you is vulnerable process protection.

If you want SRP with flexibility and vulnerable process protection, it is the product called AppGuard. But it's not free.

Another software to consider is OSArmor. It is free, it is flexible, it has vulnerable process protection, and if you enable advanced options it is SRP-like. But it is still not going to guard your downloads like voodoo does.

So I'll need OSA and VS free as complements will do or I need OSA with the VS paid version?

 

[Andy Ful]

Hi folks, I am trying to understand the following question for Win10 Pro protection.

Say I setup SRP using approach described at
How to make a disallowed-by-default Software Restriction Policy
(and also illustrated in tutorial like one at the end of this post). In short, I allow only things to run from a couple of well known Windows locations that cannot be written to by my user account.

Is there any point in adding VoodooShield to that system? What additional benefits does VS provide then?

I understand VS prevents anything unknown from running but if I already specified I only trust those limited locations and if I cannot even write to them, what additional protection would VS provide?

My apologies if this is a dumb question.

Thanks!

P.S. Youtube video for SRP:

The above SRP setup was pretty good 10 years ago. Nowadays, it is vulnerable because of malicious documents (.pdf, Office, etc.) which can run many Windows programs from whitelisted locations C:\Windows, C:\Windows\system32, etc. So for example, they can execute script engines (CMD, PowerShell, Windows Script Host) to download and execute highly obfuscated PowerShell payloads (keyloggers, trojans, rootkits) bypassing completely your SRP settings and many Antivirus/Antimalware programs.
PowerShell vulnerability is not so dangerous on Windows 10 with your SRP setup, because PowerShell will be executed (as standard user) in Constrained Language mode. But still, many other whitelisted programs can be used to bypass SRP.
You can use additional SRP Disallowed rules to cover those vulnerabilities. If you are lazy, then you can remove SRP from GPO and install Hard_Configurator that will do the above for you, quickly and safely (or buy the excellent AppGuard).
Most people will not like such restrictive setup, so it is better for them to install VoodooShield, OSArmor, etc. (they are both very good programs).

 

[boredog]

I have Appguard setup to block all scripts and powershells both 32 and 64 bit from userspace.. I like Voodooshield because you can drag and drop a file to it's shield desktop icon and scan it with something like 66 AV's. I have never tried OSA though. Another pretty good setup is to use your fav software from within Shadow mode using Shadow Defender. I got SD free on a giveaway nd liked it so much I bought it.

 

[softie15]

The above SRP setup was pretty good 10 years ago. Nowadays, it is vulnerable because of malicious documents (.pdf, Office, etc.) which can run many Windows programs from whitelisted locations C:\Windows, C:\Windows\system32, etc. So for example, they can execute script engines (CMD, PowerShell, Windows Script Host) to download and execute highly obfuscated PowerShell payloads (keyloggers, trojans, rootkits) bypassing completely your SRP settings and many Antivirus/Antimalware programs.
PowerShell vulnerability is not so dangerous on Windows 10 with your SRP setup, because PowerShell will be executed (as standard user) in Constrained Language mode. But still, many other whitelisted programs can be used to bypass SRP.
You can use additional SRP Disallowed rules to cover those vulnerabilities. If you are lazy, then you can remove SRP from GPO and install Hard_Configurator that will do the above for you, quickly and safely (or buy the excellent AppGuard).
Most people will not like such restrictive setup, so it is better for them to install VoodooShield, OSArmor, etc. (they are both very good programs).

Thanks Andy,

I am still somewhat confused. Say I am running an Acrobat Reader and open a malicious pdf document that executes some script. Would not VoodooShield allow that as well because as far it's concerned, I am running an allowed program (Acrobat Reader)?

Secondly, that malicious program won't be able to write to any location a file it can execute later, so I guess the attack would be limited to 1 time run?

My goal is to have very restrictive Wind10 Pro setup, where aside from browser and few specific programs I cannot run anything else. My goal is to download least number of necessary security software that is not from Microsoft or Adobe, so as assure the environment is super secure by running least number of other software. I don't mind downloading from a couple of other well known publishers (like Comodo, Avira, Avast, AVG, etc). But, while I like VoodooShield on another one of my computers, I am thinking of NOT downloading VoodooShield if I can achieve similar levels of security without it.

I already went through various GPO settings recommended by CIS hardening for example. Is there some way to know how to best configure SRP to achieve my goal? For example, I think Hard_Configurator is doing a lot of the things that I already manually configure, but I have not setup SRPs yet and curious how to manually set them up without downloading/running Hard_Configurator. Is there a DIY description / instructions you can provide for what Hard_Configurator is doing for a good restrictive SRP setup?

Thank you very much!

Justin

 

[Andy Ful]

Thanks Andy,

I am still somewhat confused. Say I am running an Acrobat Reader and open a malicious pdf document that executes some script. Would not VoodooShield allow that as well because as far it's concerned, I am running an allowed program (Acrobat Reader)?

Secondly, that malicious program won't be able to write to any location a file it can execute later, so I guess the attack would be limited to 1 time run?

My goal is to have very restrictive Wind10 Pro setup, where aside from browser and few specific programs I cannot run anything else. My goal is to download least number of necessary security software that is not from Microsoft or Adobe, so as assure the environment is super secure by running least number of other software. I don't mind downloading from a couple of other well known publishers (like Comodo, Avira, Avast, AVG, etc). But, while I like VoodooShield on another one of my computers, I am thinking of NOT downloading VoodooShield if I can achieve similar levels of security without it.

I already went through various GPO settings recommended by CIS hardening for example. Is there some way to know how to best configure SRP to achieve my goal? For example, I think Hard_Configurator is doing a lot of the things that I already manually configure, but I have not setup SRPs yet and curious how to manually set them up without downloading/running Hard_Configurator. Is there a DIY description / instructions you can provide for what Hard_Configurator is doing for a good restrictive SRP setup?

Thank you very much!

Justin

You can lock your system using SRP and some other policies, but that will require some learning. I found out that this subject is hard to understand for most people. Read first the below articles:
How do Software Restriction Policies work (part 1) ?
How do Software Restriction Policies work (part 2) ?
How do Software Restriction Policies work (part 3) ?
If you will not understand something, then simply ask the question on one of the above threads.
You can also read the Hard_Configurator manual (see attachment).​

 

[shmu26]

Say I am running an Acrobat Reader and open a malicious pdf document that executes some script. Would not VoodooShield allow that as well because as far it's concerned, I am running an allowed program (Acrobat Reader)?

Voodooshield will block the script, because it has special rules to protect Acrobat Reader and other exploitable programs from exactly that scenario.
And even if the script somehow managed to outsmart Voodooshield, and downloaded the payload, it will be blocked Voodooshield, because it will run from user space.

 

[Andy Ful]

That is the difference between SRP (preventive) and VoodooShield (reactive) anti-script security (for Windows Script Host). SRP simply block any script execution (as standard user) from the userspace. VoodooShield will allow running the script if it can pass by anti-script rules, but will block any script caught by the rules.
SRP are safer from the operating system point of view, because SRP do not block script execution invoked by processes running as administrator (Windows updates, scheduled system tasks, etc.).
On the other side, VoodooShield can block script execution invoked by malicious code running either as standard user or as admninistrator. That is so in theory, because when the malware is running with administrative rights it is usually too late.
Both SRP and VoodooShield can be used to lock the system. The interesting feature of the second is as follows:
"VoodooShield locks your computer and blocks all new, non-whitelisted executable code (including viruses and malware), while your computer is running a web app (browser, email, etc.). "
So SRP can be more restrictive, but VoodooShield is smarter (more usable for most users).
Yet, SRP are built into Windows so they provide a very good compatibility (great plus when using Windows 10).

...
And even if the script somehow managed to outsmart Voodooshield, and downloaded the payload, it will be blocked Voodooshield, because it will run from user space.

Except when the script will download and execute filelessly, a kind of script payload (trojan, rootkit, keylogger).

 

[shmu26]

Except when the script will download and execute filelessly, a kind of script payload (trojan, rootkit, keylogger).

Voodooshield usually prompts when a script runs. So if the payload is a script, Voodooshield should catch it.

 

[Andy Ful]

Voodooshield usually prompts when a script runs. So if the payload is a script, Voodooshield should catch it.

Not this time. The script payload is run from memory.
VoodooShield cannot check the script payloads' code, because it does not have memory checking module.
SRP also cannot do it, but their restrictions will block the initial script. In reality, VoodooShield will probably block most of the initial scripts in the wild, so no worry.

 

[Sunshine-boy]

execute filelessly

Rehips can handle this!

 

[shmu26]

Rehips can handle this!

If the sequence began with an application running in isolation.

 

[Sunshine-boy]

What about the App control? wouldn't alert?

 

[shmu26]

What about the App control? wouldn't alert?

Yes, in normal cases, but we are discussing some kind of a odd-ball script that evades the usual rules.

 

[Andy Ful]

Rehips can handle this!

Not really. It can partially handle this only when the initial script is sandboxed (keylogger will run sandboxed). So you would have to run, for example, all documents sandboxed (and other vulnerable content).
I did so some years ago when using Sandboxie.

 

[softie15]

The above SRP setup was pretty good 10 years ago. Nowadays, it is vulnerable because of malicious documents (.pdf, Office, etc.) which can run many Windows programs from whitelisted locations C:\Windows, C:\Windows\system32, etc. So for example, they can execute script engines (CMD, PowerShell, Windows Script Host) to download and execute highly obfuscated PowerShell payloads (keyloggers, trojans, rootkits) bypassing completely your SRP settings and many Antivirus/Antimalware programs.

Hi Andy, I did my homework that you suggested and I am still trying to understand the above reply. First, thank you very much for all those references and the work you've done to help us, mere mortals! You indicated 3 potential holes in the original default-deny SRP setup I had quoted: embedded CMD, Powershell, and WSH executions. So if I were to block executions of these 3 would this be enough?

Or is there other important gaping holes? E.g. other ways for malicious code to get executed by downloaded Acrobat document?

I read your links multiple times as well as the excellent Hard Configurator manual. If you don't mind answering some more questions...

What I ultimately want to do is to have as secure as possible of a setup for Win 10 Pro + Comodo Firwall/HIPS + Avira AV + Excel/Word + Acrobat Reader + MS PDF writer + Browser (e.g. Firefox) + basic windows utilities (e.g. Notepad/Wordpad/Calculator/Paint). Nothing else needs to run for this (standard) user. Only above mentioned software needs to run and work. All auto-updates should run too; and per your documents, I think SRP should not interfere with those, since they are likely going to run as admin (except for Firefox?), right?

I do not mind using GPO / registry editing as much as needed. However, I cannot download or run any other 3rd party software (outsides of Microsoft, Adobe, or a large security firm). Unfortunately, that includes Hard Configurator too.

With that in mind, I have a number of questions for proper manual SRP setup...

(1) For my desired setup, what are

(1a) recommended DFT list?
Default list from the manual: WSC, WS, VB, URL, SHS, SCT, SCR, REG, PIF, PCD, OCX, MST, MSP, MSC, MDE, MDB, LNK, JAR, ISP, INS, INF, HTA, HLP, EXE, DLL, CRT,CPL, COM, CMD, CHM, BAT, BAS, ADP, ADE
+ MSI
+ PS1, PS2, PSC1, PSC2, PS1XML, PS2XML
+ JS, JSE, VBE, VBS, WSF, and WSH
+ anything else??

(1b) recommendations as to which sponsors to Disallow? E.g. regedit.exe, others? all that are listed in Hard Configurator?

(2) What's the difference between
(2a) "blocking a sponsor" like powershell
(2b) manually creating SRP Disallow rule for "powershell.exe" and "powershell_ise.exe"
(2c) adding powershell extensions (PS1, PS2, PSC1, PSC2, PS1XML, and PS2XML) to DFT
(2d) <No PowerShell Exec.> option in Hard Configurator?

My understanding:
- 2a=2b
- 2c is complimentary to 2a/2b and both act on User Space files only (2b seems more powerful than 2a/2b)
- 2d simply sets HKLM\Software\Policies\Microsoft\Windows\PowerShell!EnableScripts to 0 to prevent any powershell execution, including those from System Space. I.e. 2d is even more powerful than others?

Why does this Warning in the manual say to NOT use (2c) + (2d)? "Do not add PS1, PS2, PSC1, PSC2, PS1XML, and PS2XML extensions, if <No PowerShell Exec.> is set to ‘ON’." Later however it says "In the unsafe environment, all the above restricting options should be activated, for the maximum PowerShell mitigation."...

So if I want as-safe-as-possible environment, should I have all of these settings setup?

More on (2d). The Hard Configurator manual says: "In Windows 64Bit there are two PowerShell Hosts (32Bit and 64Bit), but both are disabled/enabled by the below registry key"
- What about HKLM\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows\PowerShell key? Is it not used?
- Rather than edit registry would you recommend using GPO Admin Templates > Windows Components > Windows PowerShell > Turn on Script Execution -> set to Disabled?

Finally, the BIG question: Will the system run into issues with these settings given the limited usage of this system as I described it above?

(3) Similar questions for WSH
(3a) Can I effectively apply <Disable Win. Script Host> option manually by setting Enable to 0 for
HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings
HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Script Host\Settings
?
(3b) What are the donwsides if I also add JS, JSE, VBS, VBE, WSF, and WSH extensions to DFT?
(3c) For "block WSH sponsor" option, which exe's should I block aside from wscript.exe and cscript.exe? and how does this option relate to (3a) and (3b)?

The BIG question: Potential issues with above settings for running only the software I had described?

(4) Do you see any issues with Disallow rule for cmd.exe? Can it make other programs stop working? It does not appear at https://excubits.com/content/files/blacklist.txt but it is called out in Hard Configurator manual.

(5) Should I just go through all of the excubits blacklist and created Disallow rules for all? Any of them might cause trouble in the desired setup? Did you find any of them to be mire "high risk" for system stability over others?

(6) With Disallowed security level default, should I protect lnk files still?
From Hard Configuarator manual: "<Protect Shortcuts> is suited to work with SRP 'Basic User' security level. If the security level is changed to 'Disallowed' the LNK extension should be removed from Designated File Types.."
Specifically, would you recommend to add lnk extension to DFT and then Allow path rules for 'Windows', 'Program Files', 'Program Files (x86)', 'Desktop', 'Power Menu', 'Start Menu', 'Quick Launch', 'Taskbar', and 'Public Desktop' locations?
Is it better to use path rules or guids?

(7) Would VoodooShield add anything more to such protection or would it be redundant?

Thank you so much!

Justin

P.S. I noticed Windows Defender in my 1709 Win 10 Pro has autoruns set to be run from ProgramData dir; so I think "C:\ProgramData\Microsoft\Windows Defender" has to be added as additional "system space"... (I don't run Windows Defender; except optionally in its limited / manual mode) but it's still in autoruns apparently.

 

[Andy Ful]

I can help you with the above questions, but first I would like to know if you considered using CF with @cruelsister settings?