Lockdown.exe: Block unknown apps via Windows software restriction policy(d7xtech.com)
d7xtech.com
Lockdown.exe: Block unknown apps via Windows software restriction policy
https://www.d7xtech.com/lockdown/
71 comments
It looks like AppLocker is available in Windows Pro, however not configurable via GPOs: https://msendpointmgr.com/2020/09/20/does-applocker-work-in-...
Is anyone aware of a tool that simplifies setting up AppLocker? I simply would like to whitelist already installed programs and block everything else, ideally without configuring anything.
Is anyone aware of a tool that simplifies setting up AppLocker? I simply would like to whitelist already installed programs and block everything else, ideally without configuring anything.
I opened up the article by just hoping to find this one thing: I simply would like to whitelist already installed programs and block everything else, ideally without configuring anything.
That would really simplify things
That would really simplify things
by default %programfiles% and %programfiles(x86)% are whitelisted, so for most users pretty much that's exactly what they will do with Lockdown, launch it click Enable and that is all that needs to be done. Granted you do need to worry about specifically whitelisting programs not installed to those locations, which are few if any for most people, and actually it wouldn't be a bad feature idea to add an automatic scan for them since some apps insist on running from nested %appdata% folders...
What stops someone from installing a virus to those locations so that they're automatically whitelisted?
the 2005 thing requires local admin rights, and the 2008 one allows users to run code they wrote, which I thought we were not doing.
If you've whitelisted an application that can execute arbitrary code (like the Office products with VBA) then SRP can be bypassed by an unprivileged user.
Which is why Office has a whole set of controls about macros and signing
Presumably AppLocker is implemented in kernel mode because Microsoft realized that doing the whitelisting in user mode was more fraught with potential escapes. The kernel / user security boundary was one they were already defending (and leveraging hardware functionality in processor privilege levels) so creating a new pseudo-security boundary to defend in user mode was a bad idea.
Application-level permissions that aren't enforced by hardware seem like a losing proposition to me. I get that a belt-and-suspenders approach isn't unreasonable, so I guess it's not valueless, but I wouldn't have it as my only line of defense.
Application-level permissions that aren't enforced by hardware seem like a losing proposition to me. I get that a belt-and-suspenders approach isn't unreasonable, so I guess it's not valueless, but I wouldn't have it as my only line of defense.
But then they forced you to rent that feature, spooky
Thanks for the heads up on Windows Defender Application Control (WDAC); it was new to me. Microsoft appears to have renamed it to Microsoft Defender Application Control (MDAC):
Microsoft Defender Application Control https://docs.microsoft.com/en-us/mem/intune/protect/endpoint...
Microsoft Defender Application Control https://www.youtube.com/watch?v=r2m156VWg_c
Replacing AppLocker with Microsoft Defender Application Control in Windows 10 1903 and later https://www.theexperienceblog.com/2019/10/24/replacing-applo...
Microsoft Defender Application Control https://docs.microsoft.com/en-us/mem/intune/protect/endpoint...
Microsoft Defender Application Control https://www.youtube.com/watch?v=r2m156VWg_c
Replacing AppLocker with Microsoft Defender Application Control in Windows 10 1903 and later https://www.theexperienceblog.com/2019/10/24/replacing-applo...
Download a random EXE file from the internet, run it with administrator privilege and improve your security?
What a great idea!
What a great idea!
That's how Windows works 99% of the time
99% of the time it works all the time!
Not really. When I'm downloading Firefox, it's digitally signed by Mozilla. When I'm downloading VLC, it's digitally signed by the VideoLAN foundation.
I actually don't think I have a single piece of non-signed executable on my Windows PC.
I actually don't think I have a single piece of non-signed executable on my Windows PC.
And what is exactly the difference between "downloading a random executable from the Internet" and "downloading a random digitally signed with a random signature executable from the Internet"?
Either the author is random or it is not, and the signature is not really going to discriminate much in this area...
Either the author is random or it is not, and the signature is not really going to discriminate much in this area...
The difference is that someone paid one of the two billion CAs which can issue Authenticode certs about a hundred bucks.
not quite "two billion" lol and the cheapest I know of is Digicert. You're looking at $499/year or$699/year for the extended validation cert (this is a higher quality cert that passes more security checks.) What is this validation you ask? All kinds of identity verification on the business and it's owner to ensure they are who they say they are and they are located where they say they are. The idea is that bad actors aren't willing to pay $$$ annually for any reason much less to expose their identity. Lockdown uses the EV cert.
that's ok, lockdown.exe is digitally signed
And it has been wildly successful because it allows people to make and distribute applications without an army of volunteer packagers or forcing the user to compile from source. It wouldn't be a problem at all if Desktops had gotten around to the idea of sandboxing everything by default the way mobile did.
Eh, half the time I watch people use linux, they google "how to XYZ" and then copy paste all sudo commands in the guide.
Or they just pipe the output of curl to bash running as root.
There’s an awful lot of companies that use this as their deployment method.
People of requisite cautiousness will vet the shell script – but I suspect most will not.
People of requisite cautiousness will vet the shell script – but I suspect most will not.
But malware makers of requisite cautiousness will serve a different script to those that look at the source with a browser.
Any user who intends to review a script they intend to run on the computer will do something like this:
If you don't trust author/distributors (whether it is ad hoc distribution or appstore distribution), it is probably better to rely on third party distributors as found in traditional GNU/Linux distributions. They aren't flawless, but the delays are there partly to help making trusting a random group of independent developers more trustworthy.
If you don't trust first party author/distributors or third party distributors, I guess you have a sufficiently sandboxed setup that means `curl | sh` is actually safe, or else you download the source code, review the whole package, and build it or don't, so you don't want to `curl | sh` anyway.
curl https://potentially-malicious.com/get-infected.sh > get-infected.sh
$EDITOR get-infected.sh
[[ $POST_REVIEW_OPINION -eq happy ]] && bash ./get-infected.sh || rm ./get-infected.sh
(1) $EDITOR probably has syntax highlighting, which will help you understand the text better. Always do your code reviews with the supportive assistance of tools.
(2) If you intend to review a script before you run it on your computer, it is intrinsic to the task that you review the script you are about to run on the computer. As you observe, a malicious user might detect the User-Agent and give a different script. But completely non-malicious changes could happen too: for instance, there could be an update or you could type in the command wrongly and accidentally review one script but run another.
If you don't trust author/distributors (whether it is ad hoc distribution or appstore distribution), it is probably better to rely on third party distributors as found in traditional GNU/Linux distributions. They aren't flawless, but the delays are there partly to help making trusting a random group of independent developers more trustworthy.
If you don't trust first party author/distributors or third party distributors, I guess you have a sufficiently sandboxed setup that means `curl | sh` is actually safe, or else you download the source code, review the whole package, and build it or don't, so you don't want to `curl | sh` anyway.
I'm not sure "Any user who intends to review a script" would do this. I'd bet that most would at most open it, take a quick look and run it. But good advice!
Random unsigned internet developers have a considerably better track record than Microsoft itself when it comes to screwing up my computer.
If you view Microsoft as a threat to your computer, running random unsigned internet binaries isn't going to make your computer safer, even if you're running Microsoft tools. If a random binary has a 1 in 100 chance of being malware, and a Microsoft binary has a 1 in 50 chance of ignoring your interests in the pursuit of some other gain, running Microsoft binaries doesn't make running random binaries one bit safer.
Basically: Microsoft is irrelevant to the equation.
You are better off not using Microsoft products if you don't trust them, and considering the safety and security of artefacts produced by random unsigned internet developers independently of the safety and security of artefacts produced by Microsoft.
Also, if you're subject to this kind of logical fallacy, you might consider not installing Microsoft products just to avoid the distraction in your reasoning. Every platform will have a different set of trade-offs.
Basically: Microsoft is irrelevant to the equation.
You are better off not using Microsoft products if you don't trust them, and considering the safety and security of artefacts produced by random unsigned internet developers independently of the safety and security of artefacts produced by Microsoft.
Also, if you're subject to this kind of logical fallacy, you might consider not installing Microsoft products just to avoid the distraction in your reasoning. Every platform will have a different set of trade-offs.
That's pretty much my point. If a person's standard of safety is blindly running code from the reckless idiots at Windows Update I'm surprised they'd balk at running an executable whose only reputation is word of mouth. I wouldn't do either.
but you can trust it because of the authoritative language on its webpage !
It's this sort of attitude that's destroyed the hobbyist programming community for the Windows Platform.
It's also an outdated view:
1. Most Windows software is signed with an Authenticode cert which requires the author to prove who they are to the CA and hand over at least $99.
2. Windows these days has SmartScreen running all the time, which checks executable file hashes against a cloud based database and blocks apps with known issues. Doesn't help if it's an unknown but massively reduces the risk.
3. Windows has a policy that can be enforced that blocks the execution of any software that doesn't pass points #1 and #2.
It's also an outdated view:
1. Most Windows software is signed with an Authenticode cert which requires the author to prove who they are to the CA and hand over at least $99.
2. Windows these days has SmartScreen running all the time, which checks executable file hashes against a cloud based database and blocks apps with known issues. Doesn't help if it's an unknown but massively reduces the risk.
3. Windows has a policy that can be enforced that blocks the execution of any software that doesn't pass points #1 and #2.
I'm interested in where you can you get a code certificate for $99? My renewal is coming up and I'm paying $699/annual for a extended validation cert; I'm willing to consider a standard cert but even they are $499/annual. Buying a 3 year cert provides very little discount... that 3 year ev cert on Lockdown and my other apps is a $2000 deal.
Ah it's gone up a bit since I last looked, and you have to hunt around but the base cost seems to be $129:
https://www.ssl.com/certificates/code-signing/buy/
That's a yearly cost, but you only need to keep renewing if you are signing and releasing new apps or updates. Existing apps you've signed will remain valid if if you don't renew your cert (unlike websites etc.)
Also, it seems that the LARGE cost for the EV certs is only really needed for things like Windows drivers.
https://www.ssl.com/certificates/code-signing/buy/
That's a yearly cost, but you only need to keep renewing if you are signing and releasing new apps or updates. Existing apps you've signed will remain valid if if you don't renew your cert (unlike websites etc.)
Also, it seems that the LARGE cost for the EV certs is only really needed for things like Windows drivers.
wow, I hadn't researched in a while, but that looks sketchy. I purchased one that cheap some time around 2011 and the company ended up having certs revoked and went out of business, and the next best thing I found was digicert at a fraction of the cost of the comodo and the like.
they do have EV for $350/annual or $750/3 year cert so I might try that it is certainly cheaper than digicert.
and yes EV is good for more than drivers, it allows EXEs to bypass smartscreen prompts that would otherwise trigger on standard certs that have to go through reputation checks in smartscreen.
they do have EV for $350/annual or $750/3 year cert so I might try that it is certainly cheaper than digicert.
and yes EV is good for more than drivers, it allows EXEs to bypass smartscreen prompts that would otherwise trigger on standard certs that have to go through reputation checks in smartscreen.
You make good points - The pricing is still a good example of how it's a tax on hobbyist developers.
Is there any 'free' Authenticode cert providers out there? Doing the same job as LetsEncrypt but for code?
Is there any 'free' Authenticode cert providers out there? Doing the same job as LetsEncrypt but for code?
The description reads in part,
"Lockdown also goes a step further and restricts not only executables, but DLLs and other code libraries as well."
I wasn't sure if this would include batch files, so I tried testing; sure enough, they were blocked if not run from a whitelisted directory.
"Lockdown also goes a step further and restricts not only executables, but DLLs and other code libraries as well."
I wasn't sure if this would include batch files, so I tried testing; sure enough, they were blocked if not run from a whitelisted directory.
It presumably doesnt include vbs and python scripts, since as far as windows is concerned those files are no different to bitmap files opening with mspaint?
VBS and PY extensions are included in what is blocked...
Thanks for adding them, Nick. I see from the 1.1.1 release notes that you also added JS, JSE, and PS1 on top of the Windows default list of 30 executable file types.
If you whitelist mspaint, than it doesn't matter where the file is you are opening. So I guess you have to whitelist the python and VBS executables first
But thats my point... These default rules that whitelist all of c:windows and c:Programs will end up whitelisting those...
You choose what extensions are filtered in SRP settings
This may sound a bit silly. But how is this different from the default Windows applocker?
I would bet it’s using applocker APIs under the hood. Maybe a nicer/easier interface? If I’m right that means Microsoft shipped those with home versions despite not having the group policy endpoints. It may be possible to import local policies to manage it but I’ve never tried.
It's using the precursor to AppLocker - Software Restriction Policies (https://docs.microsoft.com/en-us/windows-server/identity/sof...).
They were deprecated in 1803.
They were deprecated in 1803.
>They were deprecated in 1803.
For a few moments I thought you were being sarcastic about the fact that Software Restriction was deprecated ages ago by mentioning a date two hundred years in the past.
Then I realised it's a Windows 10 version number.
Edit: For reference, 1803 was released in 2018 https://en.wikipedia.org/wiki/Windows_10_version_history#Ver...
For a few moments I thought you were being sarcastic about the fact that Software Restriction was deprecated ages ago by mentioning a date two hundred years in the past.
Then I realised it's a Windows 10 version number.
Edit: For reference, 1803 was released in 2018 https://en.wikipedia.org/wiki/Windows_10_version_history#Ver...
Oh wow I'd totally forgotten about SRP. I wonder if they'll decide to maintain AppLocker and SRP implementations concurrently.
Neat idea! TBH, I had no idea windows had security features like SRP.
Windows 2008 R2/8.1 introduced Applocker, which was a more advanced replacement for the older SRP.
Current Windows 2019/Windows 10 offers WDAC, which is more advanced still.
There's a lot of security discussions that really don't give these technologies credit. For example, a WDAC policy can prevent early launch rootkits ever loading, and will be enforced by Secure Boot.
Current Windows 2019/Windows 10 offers WDAC, which is more advanced still.
There's a lot of security discussions that really don't give these technologies credit. For example, a WDAC policy can prevent early launch rootkits ever loading, and will be enforced by Secure Boot.
There are secure boot compatible grub binaries right? Can you use a legit grub to boot into a malicious hypervisor that runs windows?
If you use TPM-stored keys with full disk encryption, the boot measurements will change and you won’t be able to decrypt the existing Windows install.
Yes, but you've blown away your chance to have mimikatz extract anything from memory, which is more commonly the goal for loading malicious drivers.
Thanks! I really should read up on this stuff at some point. I've actually never had to do any windows coding, so my knowledge about it is sorely lacking.
This is very interesting, it is not an understatement that this is an advanced tool. I wonder, how do you update your your OS and your application with this enabled?
I'm not sure how that applies to this app specifically, but it relies on Windows restriction policies. With those policies normally you have multiple options: You can add the policy to non-admin users only and run updates as an admin. You can allow whole directories, which means that windows update can work as usual. Or you can push new hash updates as needed.
But as I mentioned - I'm not sure how exactly lockdown integrates in this system.
But as I mentioned - I'm not sure how exactly lockdown integrates in this system.
You whitelist c:\windows and c:\program files
Applications are a bigger problem, use chocolatey and whitelist its dir too
Applications are a bigger problem, use chocolatey and whitelist its dir too
You disable them before doing a Windows Update.
What would be the advantage of using this over AppLocker or the built-in Windows tools?
I think the advantage would be that you can use it on Windows versions not supporting AppLocker... (e.g. home). Anyway, as far as I understand it, it actually uses the same underlying mechanism as AppLocker.
It's a shame SRP (aka Applocker), being a very useful feature, is underutilized due to bad UI and docs.
But using a third party tool (unsigned btw) to manage such a sensitive part of the system is a bad idea.
I would use it if it was a PS script I can verify.
But using a third party tool (unsigned btw) to manage such a sensitive part of the system is a bad idea.
I would use it if it was a PS script I can verify.
Note that SRP is not Applocker, but aside from that I agree.
SRP isn't Applocker, and Lockdown IS in fact digitally signed... By your rationale it would be a bad idea to use most any software worth using. Also what if the tool were open source would you use it then, or would you not be able to "verify" that I wonder. Not everyone can verify PS scripts either, so what would be the recommendation for those who couldn't?
Yes, Lockdown.exe is indeed signed. I saw that installer isn't signed and didn't bother to look at the exe inside.
Don't generalize my point about openness, I understand that for many unlike me it wouldn't add any benefits.
My recommendation would be for Microsoft to not abandon Applocker, provide it with decent UI and enable it on home editions.
Don't generalize my point about openness, I understand that for many unlike me it wouldn't add any benefits.
My recommendation would be for Microsoft to not abandon Applocker, provide it with decent UI and enable it on home editions.
ahh, an oversight indeed. the installer is signed now.
Anyone have recommendations for protecting windows server from ransomware?
Don't let people log into it, install updates.
But it's usually the user data that's the problem, and that's shared to all the other users. So don't let users run unauthorised code by using SRP/Applocker
But it's usually the user data that's the problem, and that's shared to all the other users. So don't let users run unauthorised code by using SRP/Applocker
Have a good backup strategy and execute it well, including mandatory backup testing. Pull-only backups are preferable.
And be sure users can't write to the backup folder, otherwise the backup files will be encrypted too.
That's the 'pull-only' part.
SRP is enforced in user mode, and it can be circumvented by hooking user mode API calls. Back in 2005 Mark Russinovich blogged about bypassing SRP: https://web.archive.org/web/20061219234012/http://blogs.tech...
AppLocker does the enforcement in kernel-mode, so it can't be bypassed with DLL injection. (The kernel side could be patched by a user with local Administrator rights, but that runs afoul of Kernel Patch Protection and raises the bar significantly for an attacker. Users should be using unprivileged accounts for day-to-day work anyway... >grumble<)
SRP in whitelist mode is more difficult to bypass, but it's still possible to patch it out by using WriteProcessMemory: https://blog.didierstevens.com/2008/06/25/bpmtk-bypassing-sr...
I'm not suggesting that this tool isn't useful, but it's not the same thing as AppLocker or Windows Defender Application Control. If SRP ends up being used significantly as a defense attackers will just incorporate bypassing it into their payloads / strategies (start out w/ getting the user to run a Word macro that patches Word's copy of ADVAPI32.DLL, etc).