3 ms·

I also like Microsoft Defender application guard: https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-application-guard/test

by _8j50 4y ago

I also like Microsoft Defender application guard: https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-application-guard/test-scenarios-md-app-guard https://docs.microsoft.com/en-us/windows/security/threat-pro... You can open a PDF in edge inside a hyper-v contained environment. VBS in general is much better in windows. Qubes is the right direction for sure for nix though. But IMO a standard way of doing this is needed instead of a distro. Something like KVM contained cgroups? My wish is I could define rules where some execv syscall when matching would execute under a virtualized environment.

GekkePrutser 4y ago
The solution loses a bit of its shine coming from the company that created the tech for most weaponised documents though (VBA Macros)
- _8j50 4y ago
  Meh, hardly the only attack vector, not even the biggest one these days. They made a lot of things. VBA Macros are very powerful and useful in the Excel world, those people are not learning python and writing scripts. O365 wasn't a thing then to make key distribution easier. But they do have signed macros now. The need for users to have smart documents that interact with the FS and processes on the system and talk to the local network was there and continues to be there. Evem libreoffice has their own macros that do similar things. The crappy part here is email, the almost 4 decade old tech they slap features on to no end. If there was a well thought out modern async federated messaginf service it should require attachment capability declaration so if the recipient org has a "no process exec" policy an attachment of any kind when opened would not be allowed to have child processes(zone indentifiers already enforce policies like this in windows).
neodypsis 4y ago
That's cool. Hopefully macOS implements something similar in the near future.

by _8j50 4y ago

GekkePrutser 4y ago

The solution loses a bit of its shine coming from the company that created the tech for most weaponised documents though (VBA Macros)

_8j50 4y ago
Meh, hardly the only attack vector, not even the biggest one these days. They made a lot of things. VBA Macros are very powerful and useful in the Excel world, those people are not learning python and writing scripts. O365 wasn't a thing then to make key distribution easier. But they do have signed macros now. The need for users to have smart documents that interact with the FS and processes on the system and talk to the local network was there and continues to be there. Evem libreoffice has their own macros that do similar things. The crappy part here is email, the almost 4 decade old tech they slap features on to no end. If there was a well thought out modern async federated messaginf service it should require attachment capability declaration so if the recipient org has a "no process exec" policy an attachment of any kind when opened would not be allowed to have child processes(zone indentifiers already enforce policies like this in windows).

neodypsis 4y ago

That's cool. Hopefully macOS implements something similar in the near future.