Comment by EvanAnderson | Hacker News Reader

Comment by EvanAnderson | Hacker News Reader

This tool is based on the old (and deprecated) Software Restriction Policy (SRP) API. I see some posters here stating that AppLocker and SRP are the same thing. Their goal is the same, but they're implemented completely differently.

SRP is enforced in user mode, and it can be circumvented by hooking user mode API calls. Back in 2005 Mark Russinovich blogged about bypassing SRP: https://web.archive.org/web/20061219234012/http://blogs.tech...

AppLocker does the enforcement in kernel-mode, so it can't be bypassed with DLL injection. (The kernel side could be patched by a user with local Administrator rights, but that runs afoul of Kernel Patch Protection and raises the bar significantly for an attacker. Users should be using unprivileged accounts for day-to-day work anyway... >grumble<)

SRP in whitelist mode is more difficult to bypass, but it's still possible to patch it out by using WriteProcessMemory: https://blog.didierstevens.com/2008/06/25/bpmtk-bypassing-sr...

I'm not suggesting that this tool isn't useful, but it's not the same thing as AppLocker or Windows Defender Application Control. If SRP ends up being used significantly as a defense attackers will just incorporate bypassing it into their payloads / strategies (start out w/ getting the user to run a Word macro that patches Word's copy of ADVAPI32.DLL, etc).

It looks like AppLocker is available in Windows Pro, however not configurable via GPOs: https://msendpointmgr.com/2020/09/20/does-applocker-work-in-...

Is anyone aware of a tool that simplifies setting up AppLocker? I simply would like to whitelist already installed programs and block everything else, ideally without configuring anything.

I opened up the article by just hoping to find this one thing: I simply would like to whitelist already installed programs and block everything else, ideally without configuring anything.

That would really simplify things

by default %programfiles% and %programfiles(x86)% are whitelisted, so for most users pretty much that's exactly what they will do with Lockdown, launch it click Enable and that is all that needs to be done. Granted you do need to worry about specifically whitelisting programs not installed to those locations, which are few if any for most people, and actually it wouldn't be a bad feature idea to add an automatic scan for them since some apps insist on running from nested %appdata% folders...

What stops someone from installing a virus to those locations so that they're automatically whitelisted?

Thanks for the heads up on Windows Defender Application Control (WDAC); it was new to me. Microsoft appears to have renamed it to Microsoft Defender Application Control (MDAC):

Microsoft Defender Application Control https://docs.microsoft.com/en-us/mem/intune/protect/endpoint...

Microsoft Defender Application Control https://www.youtube.com/watch?v=r2m156VWg_c

Replacing AppLocker with Microsoft Defender Application Control in Windows 10 1903 and later https://www.theexperienceblog.com/2019/10/24/replacing-applo...

the 2005 thing requires local admin rights, and the 2008 one allows users to run code they wrote, which I thought we were not doing.

If you've whitelisted an application that can execute arbitrary code (like the Office products with VBA) then SRP can be bypassed by an unprivileged user.

Which is why Office has a whole set of controls about macros and signing

Presumably AppLocker is implemented in kernel mode because Microsoft realized that doing the whitelisting in user mode was more fraught with potential escapes. The kernel / user security boundary was one they were already defending (and leveraging hardware functionality in processor privilege levels) so creating a new pseudo-security boundary to defend in user mode was a bad idea.

Application-level permissions that aren't enforced by hardware seem like a losing proposition to me. I get that a belt-and-suspenders approach isn't unreasonable, so I guess it's not valueless, but I wouldn't have it as my only line of defense.

But then they forced you to rent that feature, spooky

Reply on news.ycombinator.com