VoodooShield discussion

[codswollip]

A simple question about "Web Apps"...

Why uncheck the preconfigured web apps? If I don't have Lotus Notes (for example) will unchecking it make VS faster? If not, why not just list the apps with built-in toggling? Being the anal type, I feel compelled to uncheck those I don't have installed. But who knows... I may install one of these in the future, so why would I disable its toggling?

 

[plat1098]

So I caught up on a few pages... about 20 more or so to go, I will get to them asap

Good, the password thing is a very minor thing but nice to be cleared up. How about the USB issue? Any consideration for the persistence of the USB on the gadget once the USB is removed?

But all I need is 10 minutes alone with the Registry... :devil: and we're good.

I am frightened for your registry, @gorblimey Please, be kind, she implores, yanking out keys with joyous abandon.

 

[bjm_]

Hmmm, that is odd, do you have a firewall that is blocking Cuckoo?

apparently, I do (did) (do)....

 

[blueblackwow65]

Hi just wanted to ask with latest beta 4 ,how are the ram scores.I am hitting 75megs ram which is high compared to the 3 versions where 35 was the average.

 

[codswollip]

Hi just wanted to ask with latest beta 4 ,how are the ram scores.I am hitting 75megs ram which is high compared to the 3 versions where 35 was the average.

Same here:

 

[boredog]

Hi just wanted to ask with latest beta 4 ,how are the ram scores.I am hitting 75megs ram which is high compared to the 3 versions where 35 was the average.

Yes that seems like a lot.

 

[plat1098]

The machine has 8 GB of RAM.

With release version 3.59:


With 4.05b: CPU fluctuates a bit.

 

[gorblimey]

I am frightened for your registry,

It's OK, I've learnt to be very suave romancing the stone is far more productive than aggro she gives me everything I ask for

 

[danb]

Hey guys... FYI, VS 4.0 will utilize close to double the amount of RAM that VS 3.0 utilized because it is storing more data in memory. For example, the snapshot in VS 4.0 now contains all of the blacklist, VoodooAi, parent process, etc. data that VS 3.0 did not contain. Either way, it is still super light, even if it averages around 40-50mb or so.

 

[danb]

Good, the password thing is a very minor thing but nice to be cleared up. How about the USB issue? Any consideration for the persistence of the USB on the gadget once the USB is removed?



I am frightened for your registry, @gorblimey Please, be kind, she implores, yanking out keys with joyous abandon.

Yeah, I read all of the posts... I just do not have time to reply to each one right now, but will soon.

But if you guys find bugs, please continue to post them, and I will fix them as I am reading the posts. We will be caught up very soon, and hopefully by then everything will be just right. We are getting close!

 

[danb]

@Peter2150,

Re: New Antiexecutable: NoVirusThanks EXE Radar Pro

I thought I had already explained this several times, but let me try one more time...

1. Microsoft is starting to get really serious about malware, and the security mechanisms / features in Windows 10 will soon be world class.

2. Third party AV software has come a long way the last 4-5 years, and there are some amazing, world class products already on the market.

Both Windows 10 and many of the third party AV software will stop the majority of malware, but either way, the endpoint should be locked when it is at risk due to a running web app or "threatgate application". If anyone, and I mean anyone has a strong argument that suggests the computer should not be locked when it is at risk, please post it... I would be extremely curious.

The reason you do not want to lock the computer when it is not at risk is simple... the ONLY way the mass market will EVER accept a deny-by-default / locking technology is if we limit the frequency of dangerous, useless affirmative prompts as much as possible.

This is the entire reason that the security industry absolutely rejected application whitelisting and other deny-by-default products years ago.

But this is not an excuse to not lock the computer when it is at risk!!!

In short, now that Microsoft is serious about security, when Windows 10's security is fully implemented, your computer still needs to be locked when it is at risk. Or if you prefer, install one of the many great AV's already on the market.

Then just install VS and you are good to go.

When we started 6 years ago, the whole idea of VS was to license our intellectual property / patent to other security companies, which at least for the time being, we are still open to. The initial developers (Dyawyne and Karl), and I never had any intentions to take VS this far on its own. But we released a beta and things kind of got out of hand, and one thing led to another, and here we are.

So now that we are this close, why not finish the job?

 

[danb]

A simple question about "Web Apps"...

Why uncheck the preconfigured web apps? If I don't have Lotus Notes (for example) will unchecking it make VS faster? If not, why not just list the apps with built-in toggling? Being the anal type, I feel compelled to uncheck those I don't have installed. But who knows... I may install one of these in the future, so why would I disable its toggling?

You can uncheck the web apps you do not use, but it will make very little or no difference in speed. The web apps are listed that way (for now) because it is probably easier for most users to understand. But one day we will probably replace that whole section with a list of web apps, and it will only display the web apps that are installed on each computer, along with their icons. So it will look almost the same as it does now, but it will only include web apps that are on the machine, and it will be super easy to add new web apps, because all I will have to do is add them to the list. We will add this in VS 5.0 .

 

[gorblimey]

So now that we are this close, why not finish the job?

If you've got it, you'd be silly not to flaunt it. I see two potential companion products, Hacker Defender Pro and Glasswire which both look after the network end, and both reflect a Default Deny policy, and also reflect Security 101: Any assumption you have not been penetrated is foolish; you task is to mitigate the damage first, and only then then attempt to clean the system.

ATM I'm preferring GW for its better overview of the end-point network, and integration with Windows Firewall. As soon as it gets multi-user, I'll pay for it... And enable WF.

So keep up the good work Dan!

 

[danb]

OK... I did this many times just now. The problem seems to involve "Advanced Snapshot"

1. Exit VS
2. Delete all db files
3. Open VS, take advanced snapshot.
4. Double click *.rar file. Notification appears. "Allow"
5. Close WinRAR.
6. Double click *.rar file. Notification appears. "Allow"
7. Close WinRAR.
8. Check Settings/Whitelist. Find winrar.exe (allowed by snapshot). Delete from whitelist.
9. Double click *.rar file. Notification appears. "Allow"
10. Close WinRAR.
11. Double click *.rar file. No Notification appears.

ADVANCED Snapshot whitelist seems to be broken for WinRAR (and others.. for example, I have the same problem with 7zfm.exe)

If I delete all db and then allow only regular snapshot all seems to work fine.

Thank you for the clear and specific troubleshooting steps... that helps A LOT!!!

I followed your procedure, with and without the advanced snapshot, and VS did not block anything at all. VS is auto allowing winrar because it is in Program Files, whether I take an advanced snapshot or not.

Do you have "Automatically Allow all software from the Program Files Folders" unchecked or something?

BTW, sometimes people will install VS then immediately go into settings and lock everything down. I highly recommend users not do this. If you want to change all of the settings to lock everything down, at least run VS on Smart or AutoPilot mode for a couple of hours first.

I am not saying that you are doing this... but some users will lock everything down super tight, and then are surprised when VS blocks something .

Also, some of the settings have ability to conflict with each other if you change way too many of them. I cannot think of an example now, but in general, the settings are supposed to stay pretty much default, and the user should probably change no more than 3-5, or they might run into conflicts. And by conflicts, I do not mean bugs, I mean conflicts in the logic that cannot be resolved. The truly funny thing is that there is ALWAYS a good reason when something is blocked, when these logic conflicts occur. Sometimes the reason is difficult to find, but trust me, there is always a reason.

 

[danb]

If you've got it, you'd be silly not to flaunt it. I see two potential companion products, Hacker Defender Pro and Glasswire which both look after the network end, and both reflect a Default Deny policy, and also reflect Security 101: Any assumption you have not been penetrated is foolish; you task is to mitigate the damage first, and only then then attempt to clean the system.

ATM I'm preferring GW for its better overview of the end-point network, and integration with Windows Firewall. As soon as it gets multi-user, I'll pay for it... And enable WF.

So keep up the good work Dan!

Very cool, thank you! Yeah, Glasswire is super cool, I have been playing with it a lot lately... and yeah, it would be a killer companion product for VS.

BTW do you mean Hacker Deterrent Pro? (typo)

If so, yeah, Michael might be on to something there. ForgottenSeer 58943 and I talked privately about what an integration of HDP and VS would look like, and I think we could do some amazing stuff. But the HDP thread kind of got off on the wrong foot, and there were some misunderstandings, and unfortunately it looks like Michael may not be coming back anytime soon. That is the problem with posting text... a lot of times there are serious misunderstandings.

 

[gorblimey]

unfortunately it looks like Michael may not be coming back anytime soon.

Silly me yes, Hacker Deterrent Pro

I just posted on Terra Privacy's Hacker Deterrent Pro that there does seem to be some life in the project. We should keep an eye on it, that is really seriously good stuff.

 

[gorblimey]

@danb, errrr, about preconfigured web apps I remember we sort of agreed over on That Other Site that really the only apps of any consequence are browsers, simply because they offer the most opportunities for network interaction. OTOH, where are we on IRC etc?

The biggest problem I can see with preconfigured web apps is the sheer number of titles where we're going back to enumerating badness. IMHO, VS should look to see what is running at any moment and ask if that is to be monitored as a web app. That way, things like MS Word probably won't count as all they really do is go searching for that truly-vital-cos-the-document-won't-work-without-it macro. Which will most likely be pinged by VS anyway

 

[shmu26]

@danb, errrr, about preconfigured web apps I remember we sort of agreed over on That Other Site that really the only apps of any consequence are browsers, simply because they offer the most opportunities for network interaction. OTOH, where are we on IRC etc?

The biggest problem I can see with preconfigured web apps is the sheer number of titles where we're going back to enumerating badness. IMHO, VS should look to see what is running at any moment and ask if that is to be monitored as a web app. That way, things like MS Word probably won't count as all they really do is go searching for that truly-vital-cos-the-document-won't-work-without-it macro. Which will most likely be pinged by VS anyway

It's true that MS Word is not much of a threat, as far as connecting to the web is concerned. But downloaded docs are indeed a threat, for various reasons.
When VS turns on, due to a web app, you are getting stronger protection, so it makes sense to manually add MS Word, Excel and Powerpoint to the web apps list.
I assume Dan didn't do that by default because it will make VS turn on too often, and the extra prompts might drive a noob user past his frustration point.
But it is a good tweak for an advanced user with a higher frustration point. So it seems to me, at least.

 

[shmu26]

I haven't tested the beta's yet. But with 3.59 the shutdowns are slow on all systems, including my 8 Core Ryzen, and the other boxes. All of them have SSD's.

If shutdown is slow, try this, it might help:
1 put VS in training mode
2 Shutdown
3 Restart
4 Take VS out of training mode

 

[codswollip]

Do you have "Automatically Allow all software from the Program Files Folders" unchecked or something?

No, that is checked.

I just experienced this issue with thunderbird.exe. I launched the program repeatedly and each time I got a notification (which I allowed but had no effect since thunderbird.exe was whitelisted by snapshot). Coincidentally, the user log did not record any of these launches.

In the end, I deleted the snapshot whitelist entry/launched thunderbird.exe and "allowed" the program. After doing so, I received no further notifications with subsequent thunderbird.exe launches.

I'm not sure whether this program was whitelisted by the basic or advanced snapshot, but either way, its whitelist entry was ineffective.