6 ms·

I still keep a collection of these on hand for locked down Windows machines where I am denied admin. Cannot install anything, but I retain the power to copy and

I still keep a collection of these on hand for locked down Windows machines where I am denied admin. Cannot install anything, but I retain the power to copy and run random binaries.

themodelplumber 5y ago
That's where they really shine. I did the same when I had to get stuff done on absolutely ancient bog-standard Dell Windows machines a while back. I think they had IE 10, no PDF reader, no office software, no media player. I was supposed to do regular office work with that setup (weird situation). One visit to Portable Apps and my hours spent in the office were so much better. I still use the site for fun or for simple utility value even in Linux sometimes.
vxNsr 5y ago
> but I retain the power to copy and run random binaries. This is seen as bad practice and is on its way out. Many companies are implementing IT policies that prevent all binaries from running unless the source is a privileged location (e.g. program files) or it’s signed by Microsoft’s private key (and this is only because Teams for some idiotic reason is still installed in appdata against all best practices and MS own explicit guidance.)
- RMPR 5y ago
  > (and this is only because Teams for some idiotic reason is still installed in appdata against all best practices and MS own explicit guidance.) Maybe it's because the Teams Desktop client is a rebranding of Skype's[0]. I guess it's easier said than done in their case. 0: At least on Linux for whatever reason the temp folder of Teams is called Skype, when the system notifies you, it goes along the lines of "Skype is using your Microphone"
  - whyoh 5y ago
    >Maybe it's because the Teams Desktop client is a rebranding of Skype's I think it's just because that's the default behavior for Electron apps and they're too lazy to change it. IIRC, VSCode had the same problem, but they fixed it eventually.
- foxhop 5y ago
  Honestly, it's not bad practice to run a binary, that's literally how computing works. Binaries all the way down, why bless one over another, you heard the situation, the host OS was not functional. Running random binaries in this case was likely more secure. I advocate for the human over the company every time. When only allowed signed binaries, reboot into owned OS. When locked out of the boot loader, bring a computer the size of a standard power adaptor. When locked out of WIFI Mac or ethernet ports, sling from a ephemeral hot spot tethered to cell access. Cat will bring a dead mouse. M$ is the mouse.
- em500 5y ago
  Moreover, companies seem to be increasingly disabling access to USB storage, and/or running everything on remote servers so the laptops are little more than expensive video terminals.
  - hulitu 5y ago
    AFAIK you can always bring your own "keyboard driver" on USB. And i haven't seen this "running everything on remote servers" from some times. It is more like run everything from remote locations in browser.
- hulitu 5y ago
  And you still can run code in the browser.
  - vxNsr 5y ago
    Sure but the assumption being made by this policy is that it’s difficult to break the browser sandbox. This isn’t being implemented bec IT doesn’t like ppl running random binaries. It’s to prevent malware from gaining access to the system. There are still many common hacks that rely on executing binaries that have been downloaded, as long as the infiltration point doesn’t also have elevated access these types of hacks are prevented.
Terry_Roll 5y ago
I'm surprised more people dont use AppLocker, then you wouldnt be able to run random binaries. https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview https://docs.microsoft.com/en-us/windows/security/threat-pro...
- AnIdiotOnTheNet 5y ago
  We tried this at work when the first big ransomware wave hit. Despite our best efforts it just didn't work out. A shocking number of utilities used by various departments did all sorts of strange things like dropping executables in %TEMP% when running some internal process. Not to mention all the different versions of things like GoToMeeting and its ilk. It was a management nightmare to try and keep up and we ultimately determined it wasn't worth the hassle.
  - Terry_Roll 5y ago
    Why not "Unity" them in VMware, or sandbox them? Choosing the right software is critical though, just because something is popular doesn't make it the right one to use. WannaCry showed the world how joined up these attacks are, considering it exploited a bug in that old networking protocol. I found it interesting how they hit the crownjewels of many countries, psychologically I think it was a big message sent, asserting their dominance over others.
    - AnIdiotOnTheNet 5y ago
      Then the VM gets compromised instead of their workstation, no real difference. Even if you just mean sandboxing or using a VM for a single application, that interferes with all the integration of those applications. Again, more trouble than it is worth and too confusing for the users. They have a job to do, and it is our job to make sure they can do it with a minimum of fuss. We have implemented a lot of other ransomware mitigations to protect data on servers, which is where the users should be keeping anything important anyway, but if a workstation gets hit we just burn it to the ground and start over with it from a standardized corporate image. We've also implemented mechanisms for early detection with automated triggers to cut any affected users and workstations off until an admin can look at it. And we've altered our backup strategy to make damaging one set of backups from anywhere but a locally connected console as impossible as we can.
leokennis 5y ago
I'm surprised you are allowed to use USB drives! When I put a USB drive into my employers laptop I have to let Windows erase and format it with bitlocker before I could even use it.

I still keep a collection of these on hand for locked down Windows machines where I am denied admin. Cannot install anything, but I retain the power to copy and run random binaries.

themodelplumber 5y ago

That's where they really shine. I did the same when I had to get stuff done on absolutely ancient bog-standard Dell Windows machines a while back. I think they had IE 10, no PDF reader, no office software, no media player. I was supposed to do regular office work with that setup (weird situation). One visit to Portable Apps and my hours spent in the office were so much better. I still use the site for fun or for simple utility value even in Linux sometimes.

vxNsr 5y ago

> but I retain the power to copy and run random binaries. This is seen as bad practice and is on its way out. Many companies are implementing IT policies that prevent all binaries from running unless the source is a privileged location (e.g. program files) or it’s signed by Microsoft’s private key (and this is only because Teams for some idiotic reason is still installed in appdata against all best practices and MS own explicit guidance.)

RMPR 5y ago
> (and this is only because Teams for some idiotic reason is still installed in appdata against all best practices and MS own explicit guidance.) Maybe it's because the Teams Desktop client is a rebranding of Skype's[0]. I guess it's easier said than done in their case. 0: At least on Linux for whatever reason the temp folder of Teams is called Skype, when the system notifies you, it goes along the lines of "Skype is using your Microphone"
- whyoh 5y ago
  >Maybe it's because the Teams Desktop client is a rebranding of Skype's I think it's just because that's the default behavior for Electron apps and they're too lazy to change it. IIRC, VSCode had the same problem, but they fixed it eventually.
foxhop 5y ago
Honestly, it's not bad practice to run a binary, that's literally how computing works. Binaries all the way down, why bless one over another, you heard the situation, the host OS was not functional. Running random binaries in this case was likely more secure. I advocate for the human over the company every time. When only allowed signed binaries, reboot into owned OS. When locked out of the boot loader, bring a computer the size of a standard power adaptor. When locked out of WIFI Mac or ethernet ports, sling from a ephemeral hot spot tethered to cell access. Cat will bring a dead mouse. M$ is the mouse.
em500 5y ago
Moreover, companies seem to be increasingly disabling access to USB storage, and/or running everything on remote servers so the laptops are little more than expensive video terminals.
- hulitu 5y ago
  AFAIK you can always bring your own "keyboard driver" on USB. And i haven't seen this "running everything on remote servers" from some times. It is more like run everything from remote locations in browser.
hulitu 5y ago
And you still can run code in the browser.
- vxNsr 5y ago
  Sure but the assumption being made by this policy is that it’s difficult to break the browser sandbox. This isn’t being implemented bec IT doesn’t like ppl running random binaries. It’s to prevent malware from gaining access to the system. There are still many common hacks that rely on executing binaries that have been downloaded, as long as the infiltration point doesn’t also have elevated access these types of hacks are prevented.

Terry_Roll 5y ago

I'm surprised more people dont use AppLocker, then you wouldnt be able to run random binaries. https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview https://docs.microsoft.com/en-us/windows/security/threat-pro...

AnIdiotOnTheNet 5y ago
We tried this at work when the first big ransomware wave hit. Despite our best efforts it just didn't work out. A shocking number of utilities used by various departments did all sorts of strange things like dropping executables in %TEMP% when running some internal process. Not to mention all the different versions of things like GoToMeeting and its ilk. It was a management nightmare to try and keep up and we ultimately determined it wasn't worth the hassle.
- Terry_Roll 5y ago
  Why not "Unity" them in VMware, or sandbox them? Choosing the right software is critical though, just because something is popular doesn't make it the right one to use. WannaCry showed the world how joined up these attacks are, considering it exploited a bug in that old networking protocol. I found it interesting how they hit the crownjewels of many countries, psychologically I think it was a big message sent, asserting their dominance over others.
  - AnIdiotOnTheNet 5y ago
    Then the VM gets compromised instead of their workstation, no real difference. Even if you just mean sandboxing or using a VM for a single application, that interferes with all the integration of those applications. Again, more trouble than it is worth and too confusing for the users. They have a job to do, and it is our job to make sure they can do it with a minimum of fuss. We have implemented a lot of other ransomware mitigations to protect data on servers, which is where the users should be keeping anything important anyway, but if a workstation gets hit we just burn it to the ground and start over with it from a standardized corporate image. We've also implemented mechanisms for early detection with automated triggers to cut any affected users and workstations off until an admin can look at it. And we've altered our backup strategy to make damaging one set of backups from anywhere but a locally connected console as impossible as we can.

leokennis 5y ago

I'm surprised you are allowed to use USB drives! When I put a USB drive into my employers laptop I have to let Windows erase and format it with bitlocker before I could even use it.