SuRun 1.1 released

Hi all,

I wanted to let you know that SuRun 1.1 was released today. It has quite a few new goodies over 1.0. You can find the download here: http://kay-bruns.de/wp/software/surun/ . You can find a detailed discussion about SuRun on this thread: https://www.wilderssecurity.com/showthread.php?t=196737&highlight=surun .

I want to give tlu the credit for finding this little treasure.

ENJOY!

 

Many thanks.

And i concur completely with crediting tlu for it's introduction and all his help here with the details.

He's like a human Help File with his replies, comparisons, and details on it's functions

 

Hi,

I´ve installed the new version and during testing it didn´t cause any problems initially (of course I made it trusted in all my HIPS), but there still seem to be some problems. Perhaps you can check them out.

1 Didn´t you all notice that you can not install or run apps "sandboxed" via SBIE anymore?
2 Can having no (thus blank) password for the limited account cause trouble, when you want to log in automaticly? You can test this with TweakUI.
3 All of a sudden, Maxthon works correctly inside LUA, how come?

Also, it would be cool if someone could translate the page where is explained how SuRun works, into English. Or perhaps someone can explain it as simple as possible. I was also wondering if it would make sense if SuRun used a driver to do its stuff, would this perhaps be more secure, and would it make apps launch more quickly as admin?

 

*Bump*

Where is everbody at? EASTER, you seem to be running it with quite a few security apps installed, so can you perhaps shed some light? And what about tlu?

 

I dont know about the rest but I dont see the need to run other (maybe a AV) security apps with Surun and SRP. I have no problem running software inside sandboxie with surun.

 

This program is a GREAT solution when you have to run LUA stubborn programs.

Like KMplayer and so on ....

Easy to manage apps as admin temporary.

 

I run into a problem with this latest SuRun just getting it to carve my Admin rights down to User. With the previous version it works like a charm, but this one, no matter how many times i log off or reboot, it remains Admin So i re-installed the previous version again untill i can get a better grip on why this is happening.

On the previous version though i can't seem to get it to take EQS starting always as Admin, have to manually initiate it after boot up. Also on the earlier version if i call the Settings Menu, the screen locks up and just freezes. Bahh! I'm missing something here.

I'll have to brush up on the newest versions instructions because i thought it would squelch the Admin account down to user after install, that's what the earlier one does and i verify that with PrivBar.

On the flip end though, this newest version is easier to use the Settings Menu and no screen freezes, but i can't get it to dump my rights after install, it just stays Admin. The earlier version automatically on the start up boot screen adds the ADMIN + USER account choice, but newest one won't for me.

Any ideas?

 

Which version 1101 or 1102?

 

Based on the information in your post, it seems that one of your other security applications (EQS?) are restricting/blocking SuRun's files or keys in some way for it to function properly.

This is a problem when running as a "limited administrator", where you restrict the privileges of running processes in the admin account. If there's a problem such as the above described, then all your applications are running with full privileges since you are in an administrator environment from the beginning. The solution to this is to create a "real" limited user account, where any problem with tools such as SuRun won't let the applications run with full privileges since you are in a restricted environment from the beginning, and therefore always protected by the accounts restricted permissions and policies.

/C.

 

Thanks Cerxes

That may very well be. I know i checked some of Alycyon's Ban List rules so i'll have to review my install again and see, if no joy, like you mention, i'll just have to settle with making a new limited account, but the problem with that is don't you have to start all over again with installing programs and the like?

I really liked installing to my current Admin account and having it reduced to USER. LoL That way i get a two Log On screens, one for strickly Admin and the other my named (new) Limited Account.

Combined with EQS, this is a formidable DUO!

EASTER

 

This is really strange, because on my machine, surun.exe gets stuck in the sandbox, and SBIE won´t do a thing. I also wonder if SBIE can work inside LUA in the first place? Don´t you need to have write access to "program files"? I need to check this out.

Btw, I thought it was kind of strange that when you choose "Modify dll IAT" (setting in SuRun), my HIPS didn´t even make a sound, you would think that this kind of stuff could also be used in a malicious way. So seems like another thing that HIPS forgot to monitor?

I´m not sure what you mean, but AFAIK you HAVE to run in a true limited account to make SuRun work, seems like you are talking about DropMyRights, but that has got nothing to do with EASTER´s problem, I think.

 

No, every domain user can be included in the SuRunner group.

No, I´m talking about SuRun. The reason why you think I´m talking about DMR (or UAC, SuDown etc) is because they basically work in a similar way when applied, namely, it takes the current user´s token and removes certain privileges and SID´s from it, then using that token to start another process.

I wasn´t talking about EASTER´s problem in that specific part that you quoted, I was talking about the potential consequences if you having problems with tools that restricts the processes in an administrator account.

/C.