Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 559844" data-attributes="member: 32260">[USER=50782]@Windows_Security[/USER] I am not so sure about it, in many cases a drive by attack can gently ignore both UAC and Smartscreen. Both malware file and the shortcut can be dropped to the User Space (no copy alert) without &#039;Mark of the Web&#039; (no Smartscreen check on the run), and executed without elevation (no UAC alert). Thanks to Microsoft, SRP will stop direct malware execution, but sadly, not indirect execution by the shortcut.It is also interesting, that after copying the same shortcut to the System Space (for example C:\Windows) above trick does not work.I would like the missing option in SRP to whitelist shortcuts by hash.By the way, using SRP with something like Voodoo Shield may be a good idea.[USER=28210]@Av Gurus[/USER]My reply to your question was not correct, it should be:Almost anywhere (except whitelisted folders).</blockquote>

[QUOTE="Andy Ful, post: 559844, member: 32260"] [USER=50782]@Windows_Security[/USER] I am not so sure about it, in many cases a drive by attack can gently ignore both UAC and Smartscreen. Both malware file and the shortcut can be dropped to the User Space (no copy alert) without 'Mark of the Web' (no Smartscreen check on the run), and executed without elevation (no UAC alert). Thanks to Microsoft, SRP will stop direct malware execution, but sadly, not indirect execution by the shortcut. It is also interesting, that after copying the same shortcut to the System Space (for example C:\Windows) above trick does not work. I would like the missing option in SRP to whitelist shortcuts by hash. By the way, using SRP with something like Voodoo Shield may be a good idea. [USER=28210]@Av Gurus[/USER] My reply to your question was not correct, it should be: Almost anywhere (except whitelisted folders). [/QUOTE]

Verification