11 ms·
Be careful with that one, this isn't as capable as the HIDS solutions available on Windows - it's not going to do things like detect exfiltration using other ex
by arsome 6y ago
Be careful with that one, this isn't as capable as the HIDS solutions available on Windows - it's not going to do things like detect exfiltration using other executables or modification of other files on your system.
For example, if you allowed curl or Firefox, another executable can simply call one of them and send/receive whatever data they need to. It also can't do things like filter ptrace calls which could easily be used to modify another process to perform exfiltration or just spawn another thread and inject a whole new dynamic library to them, a common practice to bypass detection on Windows.
- throw2737 6y agoWindows app firewalls had similar problems, most common was to use explorer.exe
- code-scope 6y agoJust block explorer.exe with windows firewall - if really needed just enable out going access for internal subnet only. There is not need for explorer to access internet! I only allow windows defender, firefox and chrome to access internet in my home computer setup all other apps are blocked unless truly needed. If you block svchost.exe from internet access with windows firewall, it will block the windows update. Enable it once in a while to allow the windows update to go thru when you feel the need.
- simias 6y agoHow does Windows prevent this type of bypass? It seems extremely hard to prevent in an unsandboxed environment.
- _0ffh 6y agoI guess one might try to check the path through the process tree to see if a blacklisted application is the parent (or gp, ggp, etc.) of the process trying to communicate with the outside world.
- simias 6y agoI considered that but IIRC browsers like firefox will accept to load an URL without creating a new child process. For instance if I type "firefox 'http://google.com http://google.com'" in my terminal my already-running firefox instance loads the URL in a new tab, so I assume that some kind of IPC is used behind the scenes to ask the main instance to load the URL. Of course that's harder to exploit nefariously than spawning wget from the same process but when there's a will there's a way...
- xnyan 6y agoI'm not sure what they are talking about, but windows comes with a built-in sandbox now. Adds a little bit of overhead, but besides that works very well.
- arsome 6y agoWindows itself does not, 3rd party firewall/HIDS software (ZoneAlarm, Outpost, etc) for Windows has done this by intercepting APIs to do things like call executables with internet access, OpenProcess calls, raw disk IO, registry writes to startup entries, etc.