I'm trying Core Force

[TNT]

Well, after using Sygate for quite a long time, and after the announcement that Symantec bought it and apparently will not update or maintain the freeware version, I decided to switch to the new Core Force (http://force.coresecurity.com/) integrated firewall/IDS/lockdown solution (released with a "free" Apache license). Mind you, not that I've ever been such a fan of Sygate, I only used because I was quite accustomed to it and it was a reasonable "personal" firewall.

So, how's Core Force? Well, I'm trying to contain my enthusiasm here, but THIS SOFTWARE RULES!!! ;D It's NOT friendly nor simple, and it certainly is NOT a breeze to configure. In fact, it's probably the biggest Windows security software I've seen when it comes to number of configuration options, and many of those are not easy to figure out if you don't know what you're doing. It is, as stated, much, MUCH more than just a firewall; rather, it is a locking-down solution for network, filesystem, registry, etc. It is still early in its development stage but from what I've seen this seems to promise really a lot. Needless to say, as it is right now, its firewall alone leaves Sygate in the dust.

[FatalChaos]

I used core force for a while, and I liked it's features. For what it could do, i thought it had a VERY nice interface, and it had a ton of really good features and ran pretty light for what it offered. However, I had problems with the rules i set not loading, and it slowed down browsing. In the future, I think this security software will be very good though.

[TNT]

{QUOTE-> I used core force for a while, and I liked it's features. For what it could do, i thought it had a VERY nice interface, and it had a ton of really good features and ran pretty light for what it offered. However, I had problems with the rules i set not loading, and it slowed down browsing. In the future, I think this security software will be very good though. <-QUOTE}Hmmm... for the experience I'm having so far, it does load the rules I set without problems. I must say, however, that I'm having some issue with Firefox, as it seems to hang for a while when handling file downloads/uploads: the windows for folder browsing is slowed down; I see that the default is a "Medium-low" ruleset for Firefox, yet it blocks many attempts of this program at writing/reading from the filesystem (in Windows\Registration) and the registry. I'll see. I'm quite impressed with this software, though; the granularity it offers is quite amazing.

[Mrkvonic]

Hi,
I can understand you want to switch because you don't like it, but there's no reason to dump it yet. How long has Kerio 2 been out? And yet, it's one of the favorite little thingies in the community. The current version of SPF is stable and has no bugs. You can probably run it for a while (1-2 years) before it becomes obsolete or buggy or full of exploits (that will have emerged then). Besides, becoming part of Symatec, although not boding well, might not mean anything. Furthermore, the old version might come out of spotlight and not be a popular target. Or the other way around, who knows?
If you don't want friendly or simple - try Jetico, maybe?
It is a firewall with application control - very powerful.
Mrk

[TNT]

{QUOTE-> Hi,
I can understand you want to switch because you don't like it, but there's no reason to dump it yet. How long has Kerio 2 been out? And yet, it's one of the favorite little thingies in the community. The current version of SPF is stable and has no bugs. You can probably run it for a while (1-2 years) before it becomes obsolete or buggy or full of exploits (that will have emerged then). Besides, becoming part of Symatec, although not boding well, might not mean anything. <-QUOTE}Hmm... I switched already. ;) Sygate was ok, though, never had anything against it.

[deviladvocate]

Glad you liked it. TNT

[TNT]

{QUOTE-> Glad you liked it. TNT <-QUOTE}Yes, it's very good, although it has some stability issues (but that's understandable, it's early in the development stage). This has got to be the most fine-grained "lockdown" security software available today for Windows, at least between the ones affordable by people like me. :dry: I really hope this project grows and gets the support it deserves, because it has the potential to become a really important piece of software (even though it's most definitely not for "everybody").

[deviladvocate]

Well TNT, the only other windows security software I know of that might be comparable to Coreforce for fine-grained security is probably the $$ware Tiny firewall with it's super comprehensive sandboxing.

Honestly though I wonder how Tiny survives, there can't be that many super geeks out there willing to pay for it. It's a strictly niche audience only kind of product.

I have utter respect for people who can tame Tiny (infinity is one of them i think) and Coreforce. They are the truly super cybergeeks I bow in awe to.

Besides these two, there is GESWALL, which as I said feels like a slightly less daunting version of Coreforce, altough from what I have gathered GESWALL is more stable then Coreforce.

[hollywoodpc]

Tiny is easy if you spend time on it . But , it will take some time . The reason it is so monsterous is because it has many features that standalonf programs can do . It can replace PG , just to name one . Many HIPS programs arew replaced as well by Tiny . So much to this firewall . I agree . It sounds like CoreForce is close to this .

[TNT]

{QUOTE-> Tiny is easy if you spend time on it . But , it will take some time . The reason it is so monsterous is because it has many features that standalonf programs can do . It can replace PG , just to name one . Many HIPS programs arew replaced as well by Tiny . So much to this firewall . I agree . It sounds like CoreForce is close to this . <-QUOTE}Yep, Core Force features many things that Process Guard does (as well as many more).

[Kenjin]

{QUOTE-> Yep, Core Force features many things that Process Guard does (as well as many more). <-QUOTE}
well, actually core force misses the most important features of process guard: protection against termination or modification of a process and global hooks / physical memory protection. the only things they have in common is execution protection and to some extent driver installation protection.

[TNT]

{QUOTE-> well, actually core force misses the most important features of process guard: protection against termination or modification of a process and global hooks / physical memory protection. the only things they have in common is execution protection and to some extent driver installation protection. <-QUOTE}Well, they have in common execution hook protection; also, Core Force picks up attempts made by executables to run dll's, which Process Guard misses. As a matter of fact, Core Force protected against the WMF exploit (in its default setting), Process Guard didn't (although with it the infection could be contained). I'm not trying to knock Process Guard here, but the fact that Process Guard does more things on one side doesn't make Core Force less of a protection on the other. Oh, they also feature executable hashing and checking at run time, so that's another thing they have in common. Core Force also has configurable file/directory reading/modification protection (from defined processes), Process Guard doesn't... I'm not sure why this should be considered a 'lesser' feature than process modification.

By the way, I'm using both at the moment.

[Kenjin]

{QUOTE-> Well, they have in common execution hook protection; also, Core Force picks up attempts made by executables to run dll's, which Process Guard misses. As a matter of fact, Core Force protected against the WMF exploit (in its default setting!), Process Guard didn't. I'm not trying to knock Process Guard here, but the fact that Process Guard does more things on one side doesn't make Core Force less of a protection on the other. Oh, they also feature executable hashing and checking at run time, so that's another thing they have in common. Core Force also has configurable file/directory reading/modification protection (from defined processes), Process Guard doesn't... I'm not sure why this should be considered a 'lesser' feature than process modification.

By the way, I'm using both at the moment. <-QUOTE}
execution protection...yes...as i said already. the hashing and checking is part of execution protection feature, it has no use on its own or for other areas.
i am not trying to knock core force either and i didnt say anything about which product is better nor which is a 'lesser' feature. in my previous post i had just pointed out that contrary to your statement core force does actually not feature many things that process guard does. they simply cover different areas and have only little overlap.

[TNT]

{QUOTE-> execution protection...yes...as i said already. the hashing and checking is part of execution protection feature, it has no use on its own or for other areas.
i am not trying to knock core force either and i didnt say anything about which product is better nor which is a 'lesser' feature. in my previous post i had just pointed out that contrary to your statement core force does actually not feature many things that process guard does. they simply cover different areas and have only little overlap. <-QUOTE}Hmm... ok. They do have a little overlap: I get promped for the same question... "should I run this" ;)... although with Core Force this only happens as an executable trying to launch another executable (or dll). The overlap is not enough to become too much, though, in that I agree. They can coexist.

[TNT]

Version 0.80 seems far more stable. :)

[TNT]

{QUOTE-> I have utter respect for people who can tame Tiny (infinity is one of them i think) and Coreforce. They are the truly super cybergeeks I bow in awe to. <-QUOTE}Hmmm... that's a little bit too much. This software is complicated, but not that complicated. ;D I love that its firewall is a (somewhat limited... but still ahead of many personal firewalls) version of OpenBSD's pf :thumb: Also great is that you can export rules (I used Deep Freeze, I can test the rules and re-import them when thawed, or on another computer).

[Brinn]

{QUOTE-> Yes, it's very good, although it has some stability issues (but that's understandable, it's early in the development stage). <-QUOTE}
That's one reason why I'm waiting. I just recently reformatted and making this big a shift in my security setup is something I would play around with just before reformatting. But I really like what I've seen so far.

[TNT]

{QUOTE-> That's one reason why I'm waiting. I just recently reformatted and making this big a shift in my security setup is something I would play around with just before reformatting. But I really like what I've seen so far. <-QUOTE}Well, as I said, version 0.80 seem much more stable. I haven't experienced stability issues yet with this one.

[Hulk]

Any thaughts on Core Force ::)

[TNT]

{QUOTE-> Any thaughts on Core Force ::) <-QUOTE}Well, I re-post the message I sent to another user who asked the same thing:

It is actually one of the best security apps for Windows I've ever seen. But as said, it requires some learning and a bit of time. Also, it's not an application where "you just try", as misconfiguring it would give a false sense of security.

Also, although great for locking down your machine, it's not "a security application to end all security applications", and I would still use some other layers of protection to be on the safe side.

Personally, I use it with Process Guard full, KAV, Deep Freeze and Snoopfree, but this is probably overkill for most users. Of course, it should not be installed along with another software firewall. There are some known issues with other security software listed here: http://force.coresecurity.com/index.php?module=base&page=known-issues but basically, it seems the compatibility issues are quite rare.

The approach is very interesting, very "fine grained" because you can define the permissions every process can have at network level, filesystem level and registry level. You can, for instance, define that Firefox should be able to read/write only certain registry keys, read/write/execute/delete/list from certain directories (or single files, or types of files as it supports wildcards), and of course be able to connect to certain sites and not others, etc. Every application you configure produces logs for attempted access outside its permissions, and you can decide your own logging setup for every application (you can even log everything it does or tries to do).

The firewall itself is quite configurable, has stateful detection, you can define TCP flags, etc.

It also comes with a lot of defined policies for known applications and at system level (for instance, there are policies that make impossible for Firefox to execute or install unknown plugins, etc). You can "raise" the security level for an application (or the whole system) temporarily for example if you're visiting untrusted sites, etc. And of course you can define your own policies for the firewall, the filesystem and the registry protection.

It has protection from hooks, execution protection (even of dlls)...

Well, I'm pretty enthusiastic of this product. It does take time to configure it (for some applications, like Opera and Firefox, you need a little bit of initial tweaking); but I really like it.

[Hulk]

Cheers for that TNT, I need to learn a lot about firewall rules and security and how to set this firewall up but the main reason for me to choose this firewall is that a lot of firewalls are not as configurable and also I am a bit paranoid about large companies and what they sell to the average internet user, I want a rock solid program that I know has been designed by a company that is interested in internet security and not just a quick buck as they say, after what I have read on the internet and what I have seen i also am quite enthusiastic about this - maybe at last a program to be trusted.8) 8) 8) 8)

[TNT]

{QUOTE-> Cheers for that TNT, I need to learn a lot about firewall rules and security and how to set this firewall up but the main reason for me to choose this firewall is that a lot of firewalls are not as configurable and also I am a bit paranoid about large companies and what they sell to the average internet user, I want a rock solid program that I know has been designed by a company that is interested in internet security and not just a quick buck as they say, after what I have read on the internet and what I have seen i also am quite enthusiastic about this - maybe at last a program to be trusted.8) 8) 8) 8) <-QUOTE}Good, good... ;D I also like the development policy of this product, and I do think it has the potential to become a very important product, though I acknowledge that it's not for everybody... for one thing, unlike say, Sygate personal, you need to create a profile for many applications (at least for the "risky" ones) to really use Core Force at its full potential (it has a limited list of pre-configured application profiles, i.e. Firefox, Opera, Internet Explorer, but these are the basic stuff... and these need some tweaking). It does have a "system" profile, but it's suited for the system, not for applications.

That said, I had been using Sygate personal for three years. I decided to switch to Core Force about two weeks ago and, in retrospect, I think there's absolutely no comparison. Core Force rules! :)

[Hulk]

I agree as I was using Kerio up until Dec before the take over but before I also used Sygate but stopped because of the symantec take over, I then used Mcafee which I got with the security suite, the AV is good but I wanted to really streamline security and tighten it up - with a bit of luck help and knowledge I think I can do it.;D 8)

[TNT]

{QUOTE-> I agree as I was using Kerio up until Dec before the take over but before I also used Sygate but stopped because of the symantec take over, I then used Mcafee which I got with the security suite, the AV is good but I wanted to really streamline security and tighten it up - with a bit of luck help and knowledge I think I can do it.;D 8) <-QUOTE}Well, feel free to ask me with a private message if you need some help, I'll be happy to help... in case I know the answer... :)... or else you can ask in their forums. :)

[Hulk]

Thanks will do.:D

[EASTER.2010]

I just like to add that i also am investigating this program CoreForce for the very first time and in my early examinations of it i must admit, even though it's in early beta, it sure resembles a true Fort Knox type program complete with most if not all and the kitchen sink. I might add so far on an XP Professional Windows system it seems to work well alongside System Safety Monitor.
So far what i allowed to bypass SSM, CF is captured.

Glad this topic was put up for some discussion, thanks. I'll post my own reviews as time permits.

Thanks again.

[EASTER.2010]

Disappointing news but not hopeless by any stretch. Seems it is a very efficient application in what it is designed to do, however it's not yet up to par in the stability department just yet, at least from my experience with it.

Several times it shut down suddenly and over a period of some consistent usage it seemed to slow my system down to a near-crawl. Seeing as it's early beta theres plenty of work and effort to go into it this program yet.

So far out of several many i've put on this one gets my most attention and interest.

[TNT]

{QUOTE-> Disappointing news but not hopeless by any stretch. Seems it is a very efficient application in what it is designed to do, however it's not yet up to par in the stability department just yet, at least from my experience with it.

Several times it shut down suddenly and over a period of some consistent usage it seemed to slow my system down to a near-crawl. Seeing as it's early beta theres plenty of work and effort to go into it this program yet.

So far out of several many i've put on this one gets my most attention and interest. <-QUOTE}Version 0.80 is pretty stable for me (unlike 0.70, which did have stability problems). Looks like you might have some conflict in your configuration; I noticed that you posted in the CF forum too. :) It seems to me it would be a good idea if you send them the memory dump so they can check into it. BTW as they said, the program crashing (though a problem) doesn't leave the system exposed, as the permission remain enforced in the kernel drivers.

[EASTER.2010]

{QUOTE-> BTW as they said, the program crashing (though a problem) doesn't leave the system exposed, as the permission remain enforced in the kernel drivers. <-QUOTE}

Say TNT Hello :)

That's good to know in that respect. The first potential for intrusions can occur most when your electronic defenses are down so yeah that was a disturbing moment as were a few others.
I'll will have everyone know however that even in it's early current phase CoreForce ranks at the very top of my personal list of potential BESTS!

I'm only disappointed in that it randomly closes at various points of usage consistently with that build (version) during any session, plus noticed some performance loss on regular applications that i don't particularly assign to CoreForce but MicroSlop!
They make any developer have to keep a bottle of Exceldrin handy :wacko:
M$ is never been up to par when it comes to GUI/images stability in any of their OS's that i've experienced, including after adding Video Cards etc. to take up some of that limitation.

No, CoreForce absolutely covers the entire playing field inside and out and that is very Impressive!! to put it mildly & accurately. It's likely because of that, they need to re-distribute the program's allocated resources more efficiently to handle all that is monitors without closing down on occasion.

When time permits i like to re-install again and put a watch also on the kernel drivers to ensure they are in fact active when the program pukes out.
Funny thing is it was an event report that they use to periodically review performance that created the crashes.

UPDATE:

Re-installed and wouldn't you just know it, this time after a re-start my screen seized up and sent me reaching for the reset button.

However after the 2nd boot up everything seem to level out. It's almost as if CoreForce is literally SURGING to completely pass thru each and every possible computer circuit, image, icon and what have you on the system. I know sounds a bit exaggerating but this is one Power-Packed collection of security defense code if you ask me.

Also finally discovered the settings i was looking for to give some of those safe programs some breathing room like the Internet Mail combo i use that puts them all into one easy to access program. With default settings i was catching heck from prompts every single access, login, read, copy, transfer and all that jazz just to get one account thru :blink:

I'll say this, CoreForce is made of metal! If they finally get this proggy worked out well enough & stable to safely accommadate everyone's platform and configs it is DEFINITELY!! a MUST HAVE!!! :thumb:

[Zero3K]

Well, I'm using it currently. Its pretty good once you set it up correctly and after a few hours of having it run, its total memory usage (for me) is 14 MBs. Btw, can anyone use the link on its website to request a new password and have it work? (because its not working for me)

[gerardwil]

{QUOTE->
CORE FORCE R0.91 updated

Posted by: Administrator on July 25, 2006 6:52:23 PM (47 Reads)

A new build of CORE FORCE R0.91 is now available that fixes a problem in the registry protection module.

The new build (R0.91 #135) fixes some invalid registry permissions checks that were incorrectly generated in build #134. This problem would break some security profiles by applying invalid registry permissions.

We urge users of CORE FORCE to upgrade to this new build to avoid experiencing erratic behaviour because of this issue.
<-QUOTE}

http://force.coresecurity.com/index.php?module=base&page=main