Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 608939" data-attributes="member: 32260">That&#039;s right. And, that is the price, that have to be paid in Windows, when one prefers usability over security.<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite120" alt="o_O" title="Er... what?&nbsp; &nbsp; o_O" loading="lazy" data-shortname="o_O" />As I wrote in my previous post:&quot;Yet, whitelisting LNK locations have the side effects, that now I can run all scripts (BAT, CMD, JS, JSE, PS1, VBS, VBE, WSF, HTA), and configuration files (CPL, MSC, REG) in the User Space, by the shortcut in whitelisted location. This loophole can be made smaller if CMD, WSH, and PowerShell scripts are blocked by the reg tweak.&quot;The LNK solution + blocked scripts is appropriate only for home users. It assumes that the system and software are hard to exploit by malware in the wild (updated Windows 8+), and no one bothers to make a targeted attack. In practice, it works exceptionally well, because SRP can also mitigate many exploits.Of course, more security paranoid home user should listen to your advice, and put sponsors (cmd.exe, wscript.exe, cscript.exe, mmc.exe, mshta.exe, powershell.exe, powershell_ise.exe, regedit.exe, and many others) to SRP Black List. This is the solution known in Bouncer, NVT ERP, and other ani-exe porograms. I think about introducing such option in Hard_Configurator. But, that is a solution for users that prefer security over usability.Windows built-in SRP assumes also, that the system can protect users against fileless exploits - which is partially true in Windows 8+ , and even more true in Windows 10.Finally, when the home user needs the enterprise protection, then he/she can go for AppGuard.<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite109" alt=":)" title="Smile&nbsp; &nbsp; :)" loading="lazy" data-shortname=":)" /></blockquote>

[QUOTE="Andy Ful, post: 608939, member: 32260"] That's right. And, that is the price, that have to be paid in Windows, when one [B]prefers usability over security[/B].o_O As I wrote in my previous post: "Yet, whitelisting LNK locations have the side effects, that now I can run all scripts (BAT, CMD, JS, JSE, PS1, VBS, VBE, WSF, HTA), and configuration files (CPL, MSC, REG) in the User Space, by the shortcut in whitelisted location. [B]This loophole can be made smaller if CMD, WSH, and PowerShell scripts are blocked by the reg tweak.[/B]" The LNK solution + blocked scripts is appropriate only for home users. It assumes that the system and software are hard to exploit by malware in the wild (updated Windows 8+), and no one bothers to make a targeted attack. In practice, it works exceptionally well, because SRP can also mitigate many exploits. Of course, more security paranoid home user should listen to your advice, and put sponsors (cmd.exe, wscript.exe, cscript.exe, mmc.exe, mshta.exe, powershell.exe, powershell_ise.exe, regedit.exe, and many others) to SRP Black List. This is the solution known in Bouncer, NVT ERP, and other ani-exe porograms. I think about introducing such option in Hard_Configurator. But, that is a solution for users that [B]prefer security over usability[/B]. Windows built-in SRP assumes also, that the system can protect users against fileless exploits - which is partially true in Windows 8+ , and even more true in Windows 10. Finally, when the home user needs the enterprise protection, then he/she can go for AppGuard.:) [/QUOTE]

Verification