Core force ?not for low end user (Me)

Longboard · Oct 22, 2006

So;
Noticed core force some time ago: went to web site had palpitations after looking around.

Got this for how to stop 0day exploits:

Hi, in view of the recent news about multiple instances of security bugs in IE or related components and the existence of exploits being use in the wild, I wanted to provide some ideas about how to deal with these issues in the absense of official patches.
Generally, preventing exploitation of these bugs is straight forward with Core Force. You just need to add the appropiate filesystem or registry restrictive permission to the Internet Explorer profile (or to any othe application profile that could be used as an attack vector). Once that is done, you can then *share* your program profiles with others, thus helping them to protect their systems.

For example in the case of the recent 0-day exploit against VML code in IE which according to Microsoft won't be patched until October 10th (http://www.microsoft.com/technet/security/advisory/925568.mspx) you can simple deny execution permission to the vulnerable DLL (vgx.dll) with a filesystem permission setting for:
"%ProgramFiles%\Common Files\Microsoft Shared\VGX\vgx.dll"

Similarly, to protect against attacks on flawed Active-X controls such as the one used by the 0-day exploit that is floating around for the Direct Animation Path activeX control (http://blogs.technet.com/msrc/archive/2006/09/15/456607.aspx) which is implemented in file %windir%\system32\Daxctle.ocx and registry key [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{D7A7D7C3-D47F-11D0-89D3-00A0C90833E6}] you can deny execution access to the file and deny write access to the registry key (but make sure to set the kill bit first!)

An even better option could be to create a Core Force policy called "Protect against 0-day" and to put all these permission settings in it, then assign the policy to the proper security levels of the application's profile, that way the only thing that changes over time is the specific policy against 0-day (which will change as official patches come out and you deploy them to your systems) but the rest of the profile remains the same. Note however that some of these 0-day bugs can have several programs as attack vectors (ie. daxctle.ocx can be exploited with IE and with outlook express and who knows what else...)
Click to expand...

I'm afraid to say that si a foreign language to me.
I might have been tempted to try this utility but woah: at first glance, for me this would be v difficult.
I appreciate that this level of config probably accords with the "99.9" blocking claims but I would have to stick to some more cellar dweller type apps with easier GUI and hope for the best.

Unless some one can steer me in another direction, this is for super power users.

Maybe go back to look at Commodo.

Regards.

Alphalutra1 · Oct 22, 2006

Yes, it is definately for super power users. However, the granularity that one can lock down the Windows filesystem and registry is insane. This granularity though is what makes it incredibly difficult to properly implement Core force to its full potential. So if that entire thing was a foreign language to you, I would definately recommend not using Core force, but rather another firewall such as comodo which offers a good amount of protection, maybe even couple the firewall of your choice with a HIPS such as SSM, which while it offers a great deal of protection, you still have to answer popups, but this is much easier than coreforce.

Cheers,

Alphalutra1

djg05 · Oct 22, 2006

Longboard said:

So;
Noticed core force some time ago: went to web site had palpitations after looking around.

Got this for how to stop 0day exploits:

I'm afraid to say that si a foreign language to me.
I might have been tempted to try this utility but woah: at first glance, for me this would be v difficult.
I appreciate that this level of config probably accords with the "99.9" blocking claims but I would have to stick to some more cellar dweller type apps with easier GUI and hope for the best.

Unless some one can steer me in another direction, this is for super power users.

Maybe go back to look at Commodo.

Regards.
Click to expand...

I did try out Core Force as it looked quite promising, I could get some things to work and not others. Creating policies I did not find straightforward and there is little help available on the forum for the less knowledgeable. Development also seems to be slow which is understandable being open source.

Longboard · Oct 23, 2006

However, the granularity that one can lock down the Windows filesystem and registry is insane. This granularity though is what makes it incredibly difficult to properly implement Core force to its full potential. So if that entire thing was a foreign language to you, I would definately recommend not using Core force, but rather another firewall such as comodo which offers a good amount of protection, maybe even couple the firewall of your choice with a HIPS such as SSM,
Click to expand...

Thanks, Good suggestion
And abracadabra: the magic of Wilders: Comodo and SSM

Creating policies I did not find straightforward and there is little help available on the forum for the less knowledgeable.
Click to expand...

Agree, the replies to posts I could see were mostly way beyond my ability to interpret.

Log in or Sign up

Core force ?not for low end user (Me)

Longboard Registered Member

Alphalutra1 Registered Member

djg05 Registered Member

Longboard Registered Member

Log in or Sign up

Core force ?not for low end user (Me)

Longboard Registered Member

Alphalutra1 Registered Member

djg05 Registered Member

Longboard Registered Member

Useful Searches