8 ms·

Lockdown.exe: Block unknown apps via Windows software restriction policy

66 points by miles 5y ago

mech422 5y ago
Neat idea! TBH, I had no idea windows had security features like SRP.
- technion 5y ago
  Windows 2008 R2/8.1 introduced Applocker, which was a more advanced replacement for the older SRP. Current Windows 2019/Windows 10 offers WDAC, which is more advanced still. There's a lot of security discussions that really don't give these technologies credit. For example, a WDAC policy can prevent early launch rootkits ever loading, and will be enforced by Secure Boot.
  - im3w1l 5y ago
    There are secure boot compatible grub binaries right? Can you use a legit grub to boot into a malicious hypervisor that runs windows?
    - johncolanduoni 5y ago
      If you use TPM-stored keys with full disk encryption, the boot measurements will change and you won’t be able to decrypt the existing Windows install.
    - technion 5y ago
      Yes, but you've blown away your chance to have mimikatz extract anything from memory, which is more commonly the goal for loading malicious drivers.
  - mech422 5y ago
    Thanks! I really should read up on this stuff at some point. I've actually never had to do any windows coding, so my knowledge about it is sorely lacking.
miles 5y ago
The description reads in part, "Lockdown also goes a step further and restricts not only executables, but DLLs and other code libraries as well." I wasn't sure if this would include batch files, so I tried testing; sure enough, they were blocked if not run from a whitelisted directory.
- londons_explore 5y ago
  It presumably doesnt include vbs and python scripts, since as far as windows is concerned those files are no different to bitmap files opening with mspaint?
  - dncornholio 5y ago
    If you whitelist mspaint, than it doesn't matter where the file is you are opening. So I guess you have to whitelist the python and VBS executables first
    - londons_explore 5y ago
      But thats my point... These default rules that whitelist all of c:windows and c:Programs will end up whitelisting those...
  - mavhc 5y ago
    You choose what extensions are filtered in SRP settings
  - FoolishTech 5y ago
    VBS and PY extensions are included in what is blocked...
    - miles 5y ago
      Thanks for adding them, Nick. I see from the 1.1.1 release notes that you also added JS, JSE, and PS1 on top of the Windows default list of 30 executable file types.
makach 5y ago
This is very interesting, it is not an understatement that this is an advanced tool. I wonder, how do you update your your OS and your application with this enabled?
- DaiPlusPlus 5y ago
  You disable them before doing a Windows Update.
- viraptor 5y ago
  I'm not sure how that applies to this app specifically, but it relies on Windows restriction policies. With those policies normally you have multiple options: You can add the policy to non-admin users only and run updates as an admin. You can allow whole directories, which means that windows update can work as usual. Or you can push new hash updates as needed. But as I mentioned - I'm not sure how exactly lockdown integrates in this system.
- mavhc 5y ago
  You whitelist c:\windows and c:\program files Applications are a bigger problem, use chocolatey and whitelist its dir too
silverfox17 5y ago
What would be the advantage of using this over AppLocker or the built-in Windows tools?
- ale42 5y ago
  I think the advantage would be that you can use it on Windows versions not supporting AppLocker... (e.g. home). Anyway, as far as I understand it, it actually uses the same underlying mechanism as AppLocker.
xupybd 5y ago
Anyone have recommendations for protecting windows server from ransomware?
- mavhc 5y ago
  Don't let people log into it, install updates. But it's usually the user data that's the problem, and that's shared to all the other users. So don't let users run unauthorised code by using SRP/Applocker
- ComodoHacker 5y ago
  Have a good backup strategy and execute it well, including mandatory backup testing. Pull-only backups are preferable.
  - _wldu 5y ago
    And be sure users can't write to the backup folder, otherwise the backup files will be encrypted too.
    - ComodoHacker 5y ago
      That's the 'pull-only' part.
PradeetPatel 5y ago
This may sound a bit silly. But how is this different from the default Windows applocker?
- brazzledazzle 5y ago
  I would bet it’s using applocker APIs under the hood. Maybe a nicer/easier interface? If I’m right that means Microsoft shipped those with home versions despite not having the group policy endpoints. It may be possible to import local policies to manage it but I’ve never tried.
  - the_angry_angel 5y ago
    It's using the precursor to AppLocker - Software Restriction Policies (https://docs.microsoft.com/en-us/windows-server/identity/software-restriction-policies/software-restriction-policies https://docs.microsoft.com/en-us/windows-server/identity/sof...). They were deprecated in 1803.
    - Spare_account 5y ago
      >They were deprecated in 1803. For a few moments I thought you were being sarcastic about the fact that Software Restriction was deprecated ages ago by mentioning a date two hundred years in the past. Then I realised it's a Windows 10 version number. Edit: For reference, 1803 was released in 2018 https://en.wikipedia.org/wiki/Windows_10_version_history#Version_1803_(April_2018_Update) https://en.wikipedia.org/wiki/Windows_10_version_history#Ver...
    - brazzledazzle 5y ago
      Oh wow I'd totally forgotten about SRP. I wonder if they'll decide to maintain AppLocker and SRP implementations concurrently.
someperson 5y ago
Download a random EXE file from the internet, run it with administrator privilege and improve your security? What a great idea!
- mavhc 5y ago
  That's how Windows works 99% of the time
  - type0 5y ago
    99% of the time it works all the time!
  - dannyw 5y ago
    Not really. When I'm downloading Firefox, it's digitally signed by Mozilla. When I'm downloading VLC, it's digitally signed by the VideoLAN foundation. I actually don't think I have a single piece of non-signed executable on my Windows PC.
    - AshamedCaptain 5y ago
      And what is exactly the difference between "downloading a random executable from the Internet" and "downloading a random digitally signed with a random signature executable from the Internet"? Either the author is random or it is not, and the signature is not really going to discriminate much in this area...
      - formerly_proven 5y ago
        The difference is that someone paid one of the two billion CAs which can issue Authenticode certs about a hundred bucks.
        FoolishTech 5y ago
        not quite "two billion" lol and the cheapest I know of is Digicert. You're looking at $499/year or$699/year for the extended validation cert (this is a higher quality cert that passes more security checks.) What is this validation you ask? All kinds of identity verification on the business and it's owner to ensure they are who they say they are and they are located where they say they are. The idea is that bad actors aren't willing to pay $$$ annually for any reason much less to expose their identity. Lockdown uses the EV cert.
longtom 5y ago
Does this require Windows Enterprise/Education?
- mavhc 5y ago
  Not currently, but MS have said they're not working on SRP any more
ComodoHacker 5y ago
It's a shame SRP (aka Applocker), being a very useful feature, is underutilized due to bad UI and docs. But using a third party tool (unsigned btw) to manage such a sensitive part of the system is a bad idea. I would use it if it was a PS script I can verify.
- Dah00n 5y ago
  Note that SRP is not Applocker, but aside from that I agree.
- FoolishTech 5y ago
  SRP isn't Applocker, and Lockdown IS in fact digitally signed... By your rationale it would be a bad idea to use most any software worth using. Also what if the tool were open source would you use it then, or would you not be able to "verify" that I wonder. Not everyone can verify PS scripts either, so what would be the recommendation for those who couldn't?
  - ComodoHacker 5y ago
    Yes, Lockdown.exe is indeed signed. I saw that installer isn't signed and didn't bother to look at the exe inside. Don't generalize my point about openness, I understand that for many unlike me it wouldn't add any benefits. My recommendation would be for Microsoft to not abandon Applocker, provide it with decent UI and enable it on home editions.
    - FoolishTech 5y ago
      ahh, an oversight indeed. the installer is signed now.
EvanAnderson 5y ago
This tool is based on the old (and deprecated) Software Restriction Policy (SRP) API. I see some posters here stating that AppLocker and SRP are the same thing. Their goal is the same, but they're implemented completely differently. SRP is enforced in user mode, and it can be circumvented by hooking user mode API calls. Back in 2005 Mark Russinovich blogged about bypassing SRP: https://web.archive.org/web/20061219234012/http://blogs.technet.com/markrussinovich/archive/2005/12/12/circumventing-group-policy-as-a-limited-user.aspx https://web.archive.org/web/20061219234012/http://blogs.tech... AppLocker does the enforcement in kernel-mode, so it can't be bypassed with DLL injection. (The kernel side could be patched by a user with local Administrator rights, but that runs afoul of Kernel Patch Protection and raises the bar significantly for an attacker. Users should be using unprivileged accounts for day-to-day work anyway... >grumble<) SRP in whitelist mode is more difficult to bypass, but it's still possible to patch it out by using WriteProcessMemory: https://blog.didierstevens.com/2008/06/25/bpmtk-bypassing-srp-with-dll-restrictions/ https://blog.didierstevens.com/2008/06/25/bpmtk-bypassing-sr... I'm not suggesting that this tool isn't useful, but it's not the same thing as AppLocker or Windows Defender Application Control. If SRP ends up being used significantly as a defense attackers will just incorporate bypassing it into their payloads / strategies (start out w/ getting the user to run a Word macro that patches Word's copy of ADVAPI32.DLL, etc).
- longtom 5y ago
  It looks like AppLocker is available in Windows Pro, however not configurable via GPOs: https://msendpointmgr.com/2020/09/20/does-applocker-work-in-windows-10-pro-yes-it-does/ https://msendpointmgr.com/2020/09/20/does-applocker-work-in-... Is anyone aware of a tool that simplifies setting up AppLocker? I simply would like to whitelist already installed programs and block everything else, ideally without configuring anything.
  - jve 5y ago
    I opened up the article by just hoping to find this one thing: I simply would like to whitelist already installed programs and block everything else, ideally without configuring anything. That would really simplify things

66 points by miles 5y ago

mech422 5y ago

Neat idea! TBH, I had no idea windows had security features like SRP.

technion 5y ago
Windows 2008 R2/8.1 introduced Applocker, which was a more advanced replacement for the older SRP. Current Windows 2019/Windows 10 offers WDAC, which is more advanced still. There's a lot of security discussions that really don't give these technologies credit. For example, a WDAC policy can prevent early launch rootkits ever loading, and will be enforced by Secure Boot.
- im3w1l 5y ago
  There are secure boot compatible grub binaries right? Can you use a legit grub to boot into a malicious hypervisor that runs windows?
  - johncolanduoni 5y ago
    If you use TPM-stored keys with full disk encryption, the boot measurements will change and you won’t be able to decrypt the existing Windows install.
  - technion 5y ago
    Yes, but you've blown away your chance to have mimikatz extract anything from memory, which is more commonly the goal for loading malicious drivers.
- mech422 5y ago
  Thanks! I really should read up on this stuff at some point. I've actually never had to do any windows coding, so my knowledge about it is sorely lacking.

miles 5y ago

The description reads in part, "Lockdown also goes a step further and restricts not only executables, but DLLs and other code libraries as well." I wasn't sure if this would include batch files, so I tried testing; sure enough, they were blocked if not run from a whitelisted directory.

londons_explore 5y ago
It presumably doesnt include vbs and python scripts, since as far as windows is concerned those files are no different to bitmap files opening with mspaint?
- dncornholio 5y ago
  If you whitelist mspaint, than it doesn't matter where the file is you are opening. So I guess you have to whitelist the python and VBS executables first
  - londons_explore 5y ago
    But thats my point... These default rules that whitelist all of c:windows and c:Programs will end up whitelisting those...
- mavhc 5y ago
  You choose what extensions are filtered in SRP settings
- FoolishTech 5y ago
  VBS and PY extensions are included in what is blocked...
  - miles 5y ago
    Thanks for adding them, Nick. I see from the 1.1.1 release notes that you also added JS, JSE, and PS1 on top of the Windows default list of 30 executable file types.

makach 5y ago

This is very interesting, it is not an understatement that this is an advanced tool. I wonder, how do you update your your OS and your application with this enabled?

DaiPlusPlus 5y ago
You disable them before doing a Windows Update.
viraptor 5y ago
I'm not sure how that applies to this app specifically, but it relies on Windows restriction policies. With those policies normally you have multiple options: You can add the policy to non-admin users only and run updates as an admin. You can allow whole directories, which means that windows update can work as usual. Or you can push new hash updates as needed. But as I mentioned - I'm not sure how exactly lockdown integrates in this system.
mavhc 5y ago
You whitelist c:\windows and c:\program files Applications are a bigger problem, use chocolatey and whitelist its dir too

silverfox17 5y ago

What would be the advantage of using this over AppLocker or the built-in Windows tools?

ale42 5y ago
I think the advantage would be that you can use it on Windows versions not supporting AppLocker... (e.g. home). Anyway, as far as I understand it, it actually uses the same underlying mechanism as AppLocker.

xupybd 5y ago

Anyone have recommendations for protecting windows server from ransomware?

mavhc 5y ago
Don't let people log into it, install updates. But it's usually the user data that's the problem, and that's shared to all the other users. So don't let users run unauthorised code by using SRP/Applocker
ComodoHacker 5y ago
Have a good backup strategy and execute it well, including mandatory backup testing. Pull-only backups are preferable.
- _wldu 5y ago
  And be sure users can't write to the backup folder, otherwise the backup files will be encrypted too.
  - ComodoHacker 5y ago
    That's the 'pull-only' part.

PradeetPatel 5y ago

This may sound a bit silly. But how is this different from the default Windows applocker?

brazzledazzle 5y ago
I would bet it’s using applocker APIs under the hood. Maybe a nicer/easier interface? If I’m right that means Microsoft shipped those with home versions despite not having the group policy endpoints. It may be possible to import local policies to manage it but I’ve never tried.
- the_angry_angel 5y ago
  It's using the precursor to AppLocker - Software Restriction Policies (https://docs.microsoft.com/en-us/windows-server/identity/software-restriction-policies/software-restriction-policies https://docs.microsoft.com/en-us/windows-server/identity/sof...). They were deprecated in 1803.
  - Spare_account 5y ago
    >They were deprecated in 1803. For a few moments I thought you were being sarcastic about the fact that Software Restriction was deprecated ages ago by mentioning a date two hundred years in the past. Then I realised it's a Windows 10 version number. Edit: For reference, 1803 was released in 2018 https://en.wikipedia.org/wiki/Windows_10_version_history#Version_1803_(April_2018_Update) https://en.wikipedia.org/wiki/Windows_10_version_history#Ver...
  - brazzledazzle 5y ago
    Oh wow I'd totally forgotten about SRP. I wonder if they'll decide to maintain AppLocker and SRP implementations concurrently.

someperson 5y ago

Download a random EXE file from the internet, run it with administrator privilege and improve your security? What a great idea!

mavhc 5y ago
That's how Windows works 99% of the time
- type0 5y ago
  99% of the time it works all the time!
- dannyw 5y ago
  Not really. When I'm downloading Firefox, it's digitally signed by Mozilla. When I'm downloading VLC, it's digitally signed by the VideoLAN foundation. I actually don't think I have a single piece of non-signed executable on my Windows PC.
  - AshamedCaptain 5y ago
    And what is exactly the difference between "downloading a random executable from the Internet" and "downloading a random digitally signed with a random signature executable from the Internet"? Either the author is random or it is not, and the signature is not really going to discriminate much in this area...
    - formerly_proven 5y ago
      The difference is that someone paid one of the two billion CAs which can issue Authenticode certs about a hundred bucks.
      - FoolishTech 5y ago
        not quite "two billion" lol and the cheapest I know of is Digicert. You're looking at $499/year or$699/year for the extended validation cert (this is a higher quality cert that passes more security checks.) What is this validation you ask? All kinds of identity verification on the business and it's owner to ensure they are who they say they are and they are located where they say they are. The idea is that bad actors aren't willing to pay $$$ annually for any reason much less to expose their identity. Lockdown uses the EV cert.

longtom 5y ago

Does this require Windows Enterprise/Education?

mavhc 5y ago
Not currently, but MS have said they're not working on SRP any more

ComodoHacker 5y ago

It's a shame SRP (aka Applocker), being a very useful feature, is underutilized due to bad UI and docs. But using a third party tool (unsigned btw) to manage such a sensitive part of the system is a bad idea. I would use it if it was a PS script I can verify.

Dah00n 5y ago
Note that SRP is not Applocker, but aside from that I agree.
FoolishTech 5y ago
SRP isn't Applocker, and Lockdown IS in fact digitally signed... By your rationale it would be a bad idea to use most any software worth using. Also what if the tool were open source would you use it then, or would you not be able to "verify" that I wonder. Not everyone can verify PS scripts either, so what would be the recommendation for those who couldn't?
- ComodoHacker 5y ago
  Yes, Lockdown.exe is indeed signed. I saw that installer isn't signed and didn't bother to look at the exe inside. Don't generalize my point about openness, I understand that for many unlike me it wouldn't add any benefits. My recommendation would be for Microsoft to not abandon Applocker, provide it with decent UI and enable it on home editions.
  - FoolishTech 5y ago
    ahh, an oversight indeed. the installer is signed now.

EvanAnderson 5y ago

This tool is based on the old (and deprecated) Software Restriction Policy (SRP) API. I see some posters here stating that AppLocker and SRP are the same thing. Their goal is the same, but they're implemented completely differently. SRP is enforced in user mode, and it can be circumvented by hooking user mode API calls. Back in 2005 Mark Russinovich blogged about bypassing SRP: https://web.archive.org/web/20061219234012/http://blogs.technet.com/markrussinovich/archive/2005/12/12/circumventing-group-policy-as-a-limited-user.aspx https://web.archive.org/web/20061219234012/http://blogs.tech... AppLocker does the enforcement in kernel-mode, so it can't be bypassed with DLL injection. (The kernel side could be patched by a user with local Administrator rights, but that runs afoul of Kernel Patch Protection and raises the bar significantly for an attacker. Users should be using unprivileged accounts for day-to-day work anyway... >grumble<) SRP in whitelist mode is more difficult to bypass, but it's still possible to patch it out by using WriteProcessMemory: https://blog.didierstevens.com/2008/06/25/bpmtk-bypassing-srp-with-dll-restrictions/ https://blog.didierstevens.com/2008/06/25/bpmtk-bypassing-sr... I'm not suggesting that this tool isn't useful, but it's not the same thing as AppLocker or Windows Defender Application Control. If SRP ends up being used significantly as a defense attackers will just incorporate bypassing it into their payloads / strategies (start out w/ getting the user to run a Word macro that patches Word's copy of ADVAPI32.DLL, etc).

longtom 5y ago
It looks like AppLocker is available in Windows Pro, however not configurable via GPOs: https://msendpointmgr.com/2020/09/20/does-applocker-work-in-windows-10-pro-yes-it-does/ https://msendpointmgr.com/2020/09/20/does-applocker-work-in-... Is anyone aware of a tool that simplifies setting up AppLocker? I simply would like to whitelist already installed programs and block everything else, ideally without configuring anything.
- jve 5y ago
  I opened up the article by just hoping to find this one thing: I simply would like to whitelist already installed programs and block everything else, ideally without configuring anything. That would really simplify things