|
|
#126
February 13th, 2009, 12:05 AM
|
|||
|
|||
Re: Maximising Windows XP security with LUA and SRP
Quote:
False alarm, it seems something went wrong while slipstreaming my install disc. I've reinstalled and gpedit is working as expected. |
|
#128
February 21st, 2009, 03:20 PM
|
||||
|
||||
|
Re: Maximising Windows XP security with LUA and SRP
TLU et al, I encounter the following problems when I setup LUAs :
On literally every machine I've done this on (setting up LUAs), the LUA has write privileges to create files/folders in C:\, C:\Programs, C:\Windows, etc.... But the whole point of LUAs is that you only have write access to your LUA folder. This has occurred on 4 different machines running fully legal versions of Windows XP Home and Windows Vista Home Premium. The machines varied from HPs, to Gateways, to Emachines, to Compaqs. To solve this I've had to open Explorer, right click C:\, go to the Security Tab, select the Advanced button, select Users, and make a Deny rule (basically denying everything except the following : Traverse Folder/Execute File, Read Attributes, Read Extended Attributes, List Folder/Read Data, and Read Permissions). Then it works fine. BUT...............on the Vista Machines I went back to modify my deny rule, but I can't! It says I don't have the authority to change the permissions. I've tried turning UAC on, off. I've tried using the Hidden Administrator. I've tried running Explorer as admin but nothing works. Any ideas?
__________________
Current Security Apps - Desktop/Laptop : SRP + LUA + KAFU, Antivir (free - on demand) LUA+SRP+KAFU = WIN!!!111 |
|
#129
February 21st, 2009, 03:52 PM
|
||||
|
||||
|
Re: Maximising Windows XP security with LUA and SRP
Zopzop,
I know tlu or another knowledgeable person has already answered this. It seems that when you convert an admin account in user account under XP, all permissions are not reset as it should, and the user account inherits some rights from the admin account. So you have to go to your admin account, and take ownership of all necessary files, registry keys and folders, until user has no more write permission to program and windows folders. You have these links: http://www.winhelponline.com/blog/re...in-windows-xp/ http://www.wilderssecurity.com/showp...&postcount=146 http://www.wilderssecurity.com/showthread.php?t=233838
__________________
Scientific Linux! |
|
#130
February 21st, 2009, 04:44 PM
|
||||
|
||||
|
Re: Maximising Windows XP security with LUA and SRP
Quote:
But that's the strange thing Lucy, these are freshly created LUAs, not admin accounts that I converted to LUAs. I literally have to strip the USERS group of their write permissions using the security tab. And there's still the problem of me not being able to modify the permissions I created in Vista even when logged on as Hidden Admin.
__________________
Current Security Apps - Desktop/Laptop : SRP + LUA + KAFU, Antivir (free - on demand) LUA+SRP+KAFU = WIN!!!111 |
|
#131
February 22nd, 2009, 05:18 AM
|
||||
|
||||
|
Re: Maximising Windows XP security with LUA and SRP
Quote:
zopzop, the most plausible explanation is that you had installed software that save their settings/data in c:\Program Files and/or c:\Windows instead of in the respective c:\Documents and Settings folders. In order to do that for limited users they have probably manipulated the permissions during the installation process in such a way that everybody has full permissions for these folders. That's extremely bad and irresponsible programming and a blatant violation of Windows security standards! Applying the steps in the links mentioned by Lucy will restore the permissions to their safe defaults - but will break these applications. Thus it might be necessary to grant write permission to your limited account for specific subfolders in c:\Program Files or - better yet - only for the configuration/data files of these programs in c:\Program Files and/or c:\Windows. Quote:
I'm sorry. I have Vista Ultimate but don't really use it. Lucy is more experienced with this Windows version - perhaps she has an explanation? |
|
#132
February 22nd, 2009, 06:07 AM
|
||||
|
||||
|
Re: Maximising Windows XP security with LUA and SRP
Unfortunately, so far no. But I am searching.
__________________
Scientific Linux! |
|
#133
February 24th, 2009, 06:03 PM
|
|||
|
|||
|
Re: Maximising Windows XP security with LUA and SRP
Quote:
I'll be honest here: when it comes to WinXP Home Edition, you don't want to screw around with adding SRP as suggested. Things don't turn out as they should. (Exactly like you have experienced). This *may* result in potential security (or other) issues down the road; unless you re-confirm everything by testing malware on it, and then compare it with WinXP Professional Edition. Quote:
I have to say, that is an AWESOME find! The Trust-No-Exe is a better alternative for XP Home Edition as well as WinNT and Win2K users, as its not a quick "hack job" to get things to work. (You don't change XP Home such that you are violating Microsoft's EULA you've agreed to when you installed Windows). This is similar to SRP on XP Pro, except: (1) You can't make an exception for Admin Users! Once you apply it, it takes effect on ALL accounts including the SYSTEM one! (So its identical to SRP when its set to All Users as compared to selecting All Users except local administrators). (2) Trust-No-Exe doesn't allow you to make adjustments on the file types like SRP. Instead, it does things this way...(From the website). Quote:
|
|
#134
February 26th, 2009, 02:12 PM
|
||||
|
||||
|
Re: Maximising Windows XP security with LUA and SRP
Hello all,
inspired by Lucy's excellent thread on implementing SRP in all Vista versions I'm presenting here an alternative easy method how to do it in XP Home. The attached file is equivalent to implementing SRP as shown on http://www.mechbgon.com/srp/ for XP Pro and Vista Business/Ultimate. Just rename it to SRP-New_Path.reg and execute it with admin rights. A reboot is not necessary. The advantage: You will not need pcwXPProme and pcwGPinst - just apply the reg file and you're done. The disadvantage: Since the group policy editor is not available with this method it's not so comfortable to add a new extension or a New Path Rule. Rather, you have to do it in the registry. However, these two tasks are not difficult. If you want to add a new extension to the existing list just start regedit with admin rights (e.g. with SuRun) and go to H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ P o l i c i e s \ M i c r o s o f t \ W i n d o w s \ S a f e r \ C o d e I d e n t i f i e r s doubleclick "ExecutableTypes" - now you can add any extension you want (although I don't consider this necessary as this list is already rather comprehensive). Adding a New Path Rule is a little bit more complicated. I've already added one as an example in the above file for c:\NewApps. Quote:
Just change the value for ItemData from c:\\NewApps to any path you want, like g:\\MyApps (please note the double backslash!). If you want to add another New Path Rule just copy above section to the end of the reg file, go to http://www.guidgen.com/Index.aspx , create a new GUID and replace the bold GUID above between the {brackets} with the newly created GUID. Save the reg file and execute it. Important: You have to repeat this step for every new path rule - you can't use the same GUID twice! All told, this method is actually much easier than the steps discussed before. You need gpedit.msc, though, if you want to implement other SRP strategies. One last word: If you chose this method I suggest to install FajoXP in order to add the Security Tab available in XP Pro. (You don't need that if you apply pcwXPProme). Last edited by tlu : March 2nd, 2009 at 07:03 AM. |
|
#135
February 26th, 2009, 03:15 PM
|
|||
|
|||
|
Re: Maximising Windows XP security with LUA and SRP
Quote:
Any chance you could also supply us with an 'undo' reg file that deletes entries created by SRP-New_Path(.txt).reg from the registry?
__________________
soccerfan |
|
#136
February 26th, 2009, 03:23 PM
|
|||
|
|||
|
Re: Maximising Windows XP security with LUA and SRP
Tlu, are you also going to provide in this means methods to lock down user startup entries as well? A simple inclusion of regini and cacls in a batch woudl suffice. You are aware also that you can create a vbs script that uses TypeLib to automate the GUID generation? Lot's of further options to make this an easier for the advnaced user. I doubt any of this is going to be user friendly for those who are not advances. I mean now you are talking reg hacks instead of snap-in console's. A big difference between the two.
Still, I like this idea a lot, and I think it could prove a good project to do some custom scripting on. Especially the part to sort out the different path rules in the registry and display them, maybe with a chekcbox type affair to enable or disable. Sul. |
|
#137
February 26th, 2009, 04:52 PM
|
||||
|
||||
|
Re: Maximising Windows XP security with LUA and SRP
The undo is not necessary. Just put 40000 instead of 0 in value "DefaultLevel".
This will switch off SR policy. To switch it on, replace 40000 by 0. Easy
__________________
Scientific Linux! |
|
#138
February 26th, 2009, 05:04 PM
|
||||
|
||||
|
Re: Maximising Windows XP security with LUA and SRP
Quote:
True, but unless you need a New Path rule it's just a doubleclick to implement SRP. It couldn't be easier, could it? |
|
#139
February 26th, 2009, 05:06 PM
|
||||
|
||||
|
Re: Maximising Windows XP security with LUA and SRP
If one starts talking of hack about it when it is actually only registry configuration, so any install is potentially a giant hack...
__________________
Scientific Linux! |
|
#140
February 26th, 2009, 05:58 PM
|
|||
|
|||
|
Re: Maximising Windows XP security with LUA and SRP
Quote:
lol, this is 'hacking into' the registry, 'hacking up' the registry, and often applying a registry 'hack'. Like I say, introducing registry tampering is not preferred for novice. Very much too easy to go 'hacking' and then say 'you idiots gave bad advice, now my machine is borked'. Where you say 'I told you not to futz with registry unless you know what you mean to do'. Seen it before, will see it again.  Sul. |
|
#141
February 26th, 2009, 06:56 PM
|
|||
|
|||
|
Re: Maximising Windows XP security with LUA and SRP
Ok, I am now curious again with SRP and the registry. Does anyone have an idea of what this is? It exists on default xpsp2 machines, before SRP rules are made. It obviously is rules already existing, but wondering what significance the parent key 0 has vs. the other keys made after custom SRP rules are made. And how does it keep from actually downloading mdac11.cab or other file? I don't see that.
Code:
Sul. EDIT: Digging around on this, I found many instances of the same values existing, but found not a real explanation of why they exist and why they don't show. These may provide clue to help hand made values show in mmc. It is curious to have values by default the are commented 'no downloading' when in fact, to my knowledge, SRP has no network blocking feature. Strange. Last edited by Sully : February 26th, 2009 at 07:23 PM. |
|
#142
February 27th, 2009, 06:27 AM
|
|||
|
|||
|
Re: Maximising Windows XP security with LUA and SRP
Not to get too off topic but...
Quote:
I've just read the MICROSOFT WINDOWS XP HOME EDITION (RETAIL) END-USER LICENSE AGREEMENT FOR MICROSOFT SOFTWARE Published: June 1, 2004. The only problem I can see arising from this policy would be that the Limited Warranty might not apply if SRP is added to XP Home, as this could be considered 'abnormal use'. |
|
#143
February 27th, 2009, 07:17 AM
|
||||
|
||||
|
Re: Maximising Windows XP security with LUA and SRP
As already pointed, SRP itself is included in parental control.
Modifying or applying SRP directly from registry is therefore not abnormal, as it is simply a shortcut to the procedure, and maybe a tweak.
__________________
Scientific Linux! |
|
#144
February 27th, 2009, 10:21 AM
|
|||
|
|||
|
Re: Maximising Windows XP security with LUA and SRP
Yes, I understand your point that merely modifying the registry cannot be considered any kind of 'abnormal use'. But I'm not sure what you mean when you say that "SRP itself is included in parental control."
Frankly, I don't see how any of the actions mentioned in this thread would violate the EULA, so I hope aussiebear explains why he claimed that. |
|
#145
February 27th, 2009, 02:47 PM
|
|||
|
|||
|
Re: Maximising Windows XP security with LUA and SRP
Quote:
Parental controls is a feature of Windows Vista Home (Basic and Premium). It is not a feature of Windows XP Home. Also, here is some generic language from Microsoft regarding modifying the registry: http://support.microsoft.com/kb/137454 (just a randomly selected URL from MS) "WARNING: Using Registry Editor incorrectly can cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk. Wrapping the registry tweaks with an executable with a GUI would be preferable for novice users, which are probably most home users. For example, "enable SRP", "disable SRP", "add/remove/modify file extension", etc. |
|
#146
February 27th, 2009, 02:55 PM
|
|||
|
|||
|
Re: Maximising Windows XP security with LUA and SRP
Quote:
See posts #12, 15 and 17 on this thread " the future of SRP: AppLocker" here: http://www.wilderssecurity.com/showthread.php?t=234089 Parental controls on Vista Home has what one might call "SRP Lite". |
|
#147
February 27th, 2009, 03:58 PM
|
|||
|
|||
|
Re: Maximising Windows XP security with LUA and SRP
Quote:
|
|
#148
February 27th, 2009, 04:16 PM
|
|||
|
|||
|
Re: Maximising Windows XP security with LUA and SRP
Quote:
|
|
#149
April 10th, 2009, 03:09 AM
|
|||
|
|||
|
Re: Maximising Windows XP security with LUA and SRP
Updates updates updates....
As has been discussed, part of xp and newer OS's is the inclusion of processes checking the SAFER registry keys when starting. So regardless of version, SAFER values exist and are enabled by default. What is enabled? For one, the allowing of certain key directories, that has been noted you don't want to touch. More interesting is that some Hash rules exist for some older versions of files from MS, presumably to ensure you don't get previous versions from some older program that could mess with newer dependencies. Anyway, now we know that SAFER registry values exist by default (not sure on xp home but all others it seems). So by using Tlu's or Lucy's registry files, you can add easily to the SRP. Hmm. Let us also state a few things. Pardon me if this is not 100% technically correct. Too many visits to msdn lately. Group Policy, aka GP. This is a database, sort of, that holds your GP settings. In xp pro, you would use a MMC snap-in, probably gpedit.msc or secpol.msc to get access to SRP policies. You would set parameters for SAFER or make new path rules, hash rules, etc. Once you create a new rule, I believe that gpupdate is fired. The rule SHOULD take effect immediately. If not, running gpupdate makes it so. When you make this GP rule, a SAFER registry value is also placed into the registry. You can delete the SAFER reg values, and the policies exist still in the GP, so your SRP rules are still in place, but they do not acutally work without the registry values. I have played with it a lot now. Even though you see your rule in the snap-in, the lack of a regsitry value makes it inactive. However, after you delete the reg val, it will not take effect until the registry is reloaded. Rebooting does this, or simply killing explorer.exe and then reloading it will reload the registry. Now that the reg val has been deleted, you see that the rule, still visible in the snap-in, has no effect whatsoever. Running gpupdate does not reinstate it. In fact, once the reg val is deleted, nothing seems to reinstate it. Intesting too, say that you make a rule to deny notepad.exe. Ok. Now, if you delete that reg val, and then run notepad, it fails. If you simply kill explorer.exe, and run it without restarting explorer, the registry is already reloaded and notepad starts. Conversely, if you kill explorer, and then delete the reg val, notepad will fail to start until you have explorer up and running again, then notepad will run. Just some interesting stuff to know I guess about how reloading the registry sort of works. Back to it then. We can implement SRP on many OS's now with just some registry values, not even needing the snap-in, because indeed the policies listed in the gp will stay visible but inert if the SAFER reg vals are deleted. Nice stuff to know for us geeks. Now, let us move on to another feature most talked about using with LUA and SRP. KAFU. While I have not completely immersed myself into all that it does, we know it protects some User autostart locations. A few registry keys and a couple directories. Well, you migh have guessed by now that I have been playing with that too. Actually, I have a while ago created it for my own scripting purposes the same thing KAFU does. As I don't even know where my copy is, perhaps some others can help with some testing. My findings are that when restricting the registry, you have 2 modes to use pertaining to KAFU. Normally, (what I found anyway) is that a reg key, say HKCU\software\microsoft\windows\currentversion\run, is allowed pretty much Admin FULL, World FULL, Creator FULL and System FULL. To lock it down, you would use only Admin FULL and World READ. I will say, that it took a few tries to actually get all subkeys to stay protected. This is what I have not tested with KAFU. Let me digress. Take this parent key HKCU\software\microsoft\windows\currentversion\run At first glance, just restricting that key, means that you cannot modify, actually create a new subkey, like HKCU\software\microsoft\windows\currentversion\run\NewStartup nor, it would seem, can you create a new value in that key. However, it is not as straight forward after that. Without some scripting, using common regini.exe will not prevent the creating of subkeys in subkeys that already exist. lol, so if you started with HKCU\software\microsoft\windows\currentversion\run\NewStartup and you restricted the key HKCU\software\microsoft\windows\currentversion\run to be read only for World, the command is not recursive. Meaning, while you could not create new keys in Run, you could create any number of new keys/values in Run\NewStartup. How does KAFU handle this recursiveness? I don't know. Maybe someone can test it to see. Now, we can expound with some further details. Obviously, I have a method that will lock down all subkeys and not just the parent. And a method for reversing this. I found some interesting things though. If you run my method, as an admin or as a user, you can lock down the parent key and all the subkeys. If you were to then unlock the registry values, as an admin, it becomes totally unlocked. This is expected. But, what I found as that as a User, you can run the unlock method. This was suprising. Why would a user be allowed to set registry permissions on objects that were set to admin FULL and world READONLY? Regardless, sure enough, a User can run this method, and it unlocks ALL the subkeys. In my example then, a user can unlock Run\MyStartup, and all subkeys/values. However, the parent key Run\, cannot be unlocked by a User, only by an admin. So this leads to a question. What does KAFU do. What does it do when ran in admin mode and user mode. Does it present the same strange results? Further, what are the ramifications of this? Is it possible then for something to attempt registry key modification even though one is a user? How does one go about correcting this? Setting restrictions on the parent key above Run\ would be ridiculous. Not something I would want to do. There you have it. Ramblings of incessant geekness that pertain to nothing unless you really are a geek like myself. Enjoy. Sul. |
|
#150
April 10th, 2009, 10:23 AM
|
||||
|
||||
|
Re: Maximising Windows XP security with LUA and SRP
Quote:
__________________
MALWARE IS OVER! (If You Want It) Give security a chance. Get to know Windows Security Settings and Policies. |
| « Previous Thread | Next Thread » |
| Thread Tools | Search this Thread |
|
|
