AppGuard 4.x 32/64 Bit - Releases

Discussion in 'other anti-malware software' started by Jryder54, Oct 29, 2013.

Thread Status:
Not open for further replies.
Page 161 of 316
  1. Mr.X

    Mr.X Registered Member

    Joined:
    Aug 10, 2013
    Posts:
    4,811
    Location:
    .
    oh yes yes! I completely forgot this request. I think 30 is a good number, not less.
     
    Mr.X, Dec 29, 2015
    #4001
  2. bjm_

    bjm_ Registered Member

    Joined:
    May 22, 2009
    Posts:
    4,458
    Location:
    .
    guess, we'll have to ask BRN
    recall member offered blanket recommends are difficult and yet ....
     
    bjm_, Dec 29, 2015
    #4002
  3. bjm_

    bjm_ Registered Member

    Joined:
    May 22, 2009
    Posts:
    4,458
    Location:
    .
    who's browser...?
    ammend to #3987 from BRN
    From: appguard@blueridgenetworks.com
    Date: Tue, 29 Dec 2015 08:20:48 -0500
    I wouldn’t recommend making the c:\users\user\downloads as private. Then you won’t be able to download files from a browser there. Just don’t keep anything important there.
    Regards,
    Barb
     
    bjm_, Dec 29, 2015
    #4003
  4. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    20,590
    If you do that you won't be updating Firefox. They are now integral to the updating process
     
    Peter2150, Dec 29, 2015
    #4004
  5. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    20,590
    @bjm_ If you have your browser set to privacy mode in appguard it means the browser can't access it, so setting any folder you want to download to is at best a futile act. Asking that borders on asking a silly question. Knowing Barb is busy, it probably didn't dawn on her what you were asking.

    But feel free to try it, just don't be surprised
     
    Peter2150, Dec 29, 2015
    #4005
  6. guest

    guest Guest

    yours

    that is just confirmed what i said


    trying it is already silly, by logic making private something that is totally not private and need interactions with the least private programs (aka browsers) is nonsense. :D

    this is the same as putting your phone number in private list and not giving it to people supposed to contact you :p
     
    guest, Dec 29, 2015
    #4006
  7. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    20,590

    Couldn't agree more :)
     
    Peter2150, Dec 29, 2015
    #4007
  8. pegr

    pegr Registered Member

    Joined:
    Apr 8, 2008
    Posts:
    2,280
    Location:
    UK
    I agree it would be pointless to include an individual executable in both the user-space definition and the guarded apps list. It wouldn't cause a problem though. All executables in the guarded apps list are allowed to run guarded, exempting them from user-space run restrictions.

    The situation is different with user-space folders. The guarded apps list provides a way of exempting individual executables in user-space folders from user-space run restrictions, allowing them to run with the Privacy and MemoryGuard settings specified.
     
    pegr, Dec 29, 2015
    #4008
  9. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    20,590
    You might send an email to Appguard@blueridgenetworks.com Posting here there is no guarantee they will see it.
     
    Peter2150, Dec 29, 2015
    #4009
  10. guest

    guest Guest

    i asked long time ago, they said there is no need, since not many processes should be in power apps.
     
    guest, Dec 29, 2015
    #4010
  11. guest

    guest Guest

    is it Barb talking? :D

    https://www.youtube.com/watch?v=C1B5_uXp2Mo
     
    Last edited by a moderator: Dec 30, 2015
    guest, Dec 30, 2015
    #4011
  12. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    20,590
    Doesn't sound like her to me
     
    Peter2150, Dec 30, 2015
    #4012
  13. guest

    guest Guest

    it is me, or Dropbox.exe bypass (able to execute under) AG Lockdown mode even if Guarded ?!
     
    guest, Dec 30, 2015
    #4013
  14. wojtek

    wojtek Registered Member

    Joined:
    Jan 5, 2014
    Posts:
    33
    yes, me too, but it was a long time ago. Maybe, some number of fresh requests could help.
     
    wojtek, Dec 30, 2015
    #4014
  15. Cutting_Edgetech

    Cutting_Edgetech Registered Member

    Joined:
    Mar 30, 2006
    Posts:
    5,694
    Location:
    USA
    Not sure since i've never tested AG against Dropbox.exe bypass. What type of malware is it? Is it an SSL trojan? Are you using AG default settings, or are you using your own custom config?

    Edited 12/30 @ 5:33 pm
    Are you just talking about the Dropbox installer software?
     
    Cutting_Edgetech, Dec 30, 2015
    #4015
  16. guest

    guest Guest

    yes, the executable of the legit apps (Dropbox for Windows) it can be launched even guarded on Lockdown Mode. some days ago it couldn't. im not sure if dropbox changed something or not or i missed something.
     
    Last edited by a moderator: Dec 30, 2015
    guest, Dec 30, 2015
    #4016
  17. syrinx

    syrinx Registered Member

    Joined:
    Apr 7, 2014
    Posts:
    427
    I don't know what I'm talking about here but figured I'd throw it in, I recall seeing a thread or two concerning sandboxie where an attacker was able to start the WinRM service even from within a box and then use it to escape [eg used the admin rights that the service it started provides]. (fixed in current versions) AppGuard is a different beast and I don't know the specifics of that exploit but it doesn't seem far fetched to theorize that it might be possible to exploit WinRM or some other service in a similar fashion if AG allows a protected app to start a service. In which modes of AG and how that code is first able to run would be another question all together. :-/ I don't know enough about that exploit to be sure either way.
     
    syrinx, Dec 31, 2015
    #4017
  18. marzametal

    marzametal Registered Member

    Joined:
    Mar 19, 2014
    Posts:
    766
    I think it'll be hard to do if the user is running a LUA, since all relevant buttons to modify service status are greyed out. I think what would be more of a concern is that "mmc.exe" runs the show for more than one of the Administrative Tools. Wouldn't targetting that exe produce more of a chi-ching payload than trying to bypass one service setting... ?
     
    marzametal, Dec 31, 2015
    #4018
  19. hjlbx

    hjlbx Guest

    @guest

    Dropbox for Windows - where is file path for executable ?

    Isn't it ProgramData or one of the other data (User Space) folders ?
     
    hjlbx, Dec 31, 2015
    #4019
  20. guest

    guest Guest

    it is in System Space (Program Files x86)
     
    guest, Dec 31, 2015
    #4020
  21. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    20,590

    Not sure that applies here. The problem here was the way Firefox now updates, and it just required setting an exe guarded. that exe does happen to have a service but once guarded it can't write to the system area.
     
    Peter2150, Dec 31, 2015
    #4021
  22. bjm_

    bjm_ Registered Member

    Joined:
    May 22, 2009
    Posts:
    4,458
    Location:
    .
    Hello Wilders,
    1) With C:\Sandbox in User Space Yes, I'm wondering....
    Since, I have to run AG at Install to launch trial/test programs sandbox'd.
    Am I protecting anything by AppGuard at Install..?

    2) With C:\Sandbox in User Space Yes, I'm wondering....
    Since, I always run Guarded Firefox sandbox'd.
    What am I protecting more with Sandbox in User Space Yes beyond protection offered with Guarded Firefox sandbox'd.
    I mean Guarded Firefox is always run in restricted sandbox. Firefox is isolated. What runs in sandbox stay's in sandbox.
    What does C:\Sandbox in User Space Yes, add to protection beyond protection offered by Guarded Firefox sandbox'd.
    Thanks
     
    bjm_, Dec 31, 2015
    #4022
  23. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    20,590
    1. When AG is either at install or off, it doesn't protect. That's why using an AE helps protect you

    2. Go back and read and reread several times. the impact of c:\sandbox written above by PEGR

    In many ways SBIE and Appguard do offer similiar protections. But their are subtle differences and well worth using both

    BJM, first get it working using the approaches in this thread. Then figure out the why. ALso keep in mind that to much analysis can lead to paralysis
     
    Peter2150, Dec 31, 2015
    #4023
  24. Mr.X

    Mr.X Registered Member

    Joined:
    Aug 10, 2013
    Posts:
    4,811
    Location:
    .
    Homophones > their | they're | there
    Pick one you like, either way sound the same :argh:
     
    Mr.X, Dec 31, 2015
    #4024
  25. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    20,590

    Relevanceo_O?
     
    Peter2150, Dec 31, 2015
    #4025
Page 161 of 316
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...