Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 558704" data-attributes="member: 32260">It&#039;s not a big deal for home users, because even simple drive by attacks are still successful. So, no one bothers to bypass SRP in the wild. Anyway, I am a little bit disappointed.I tried to close this loophole by changing security level to DISSALLOWED and removing LNK from SRP protected extensions. And, what happened then? The EXE and MSI files, CMD scripts, and WHS scripts were protected, but CHM, CPL, HTA, MSC, and REG files were not. So it seems to me that SRP with DISSALLOWED setup must be also covered by blacklisting sponsors (hh.exe, control.exe, mshta.exe, mmc.exe, regedit.exe and maybe some others). It resembles blacklisting in Excubits Bouncer but is safer for Windows OS. Sponsors blacklisted in SRP can be still run by processes with Administrative or System Rights.Of course, the simplest solution is not using shortcuts and blocking them in SRP.</blockquote>

[QUOTE="Andy Ful, post: 558704, member: 32260"] It's not a big deal for home users, because even simple drive by attacks are still successful. So, no one bothers to bypass SRP in the wild. Anyway, I am a little bit disappointed. I tried to close this loophole by changing security level to DISSALLOWED and removing LNK from SRP protected extensions. And, what happened then? The EXE and MSI files, CMD scripts, and WHS scripts were protected, but CHM, CPL, HTA, MSC, and REG files were not. So it seems to me that SRP with DISSALLOWED setup must be also covered by blacklisting sponsors (hh.exe, control.exe, mshta.exe, mmc.exe, regedit.exe and maybe some others). It resembles blacklisting in Excubits Bouncer but is safer for Windows OS. Sponsors blacklisted in SRP can be still run by processes with Administrative or System Rights. Of course, the simplest solution is not using shortcuts and blocking them in SRP. [/QUOTE]

Verification