full-disclosure - Windows Software Restriction Policy Protection Bypass

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <51b4f5740606090352x10799754i8e9a29d351822dd3@mail.gmail.com>
Date: Fri Jun  9 11:52:14 2006
From: dinis.cruz at googlemail.com (Dinis Cruz)
Subject: Windows Software Restriction Policy Protection
	Bypass

This MS answer speaks volumes to their approach to security (I had
similar made to me in the past)

> 09.06.06 - Vendor response
>
> "Software  Restriction  Policy  and  Group  Policy  are  not meant to be
> complete  security features...For full security, we recommend using ACLs
> to protect the appropriate resources in your environment..."

Maybe they should update some of their docs:

>From http://www.microsoft.com/technet/prodtechnol/winxppro/maintain/rstrplcy.mspx

"...Software restriction policies are a new feature in Microsoft(r)
Windows(r) XP and Windows Server 2003. This important feature provides
administrators with a policy-driven mechanism for identifying software
programs running on computers in a domain, and controls the ability of
those programs to execute. Software restriction policies can improve
system integrity and manageability?which ultimately lowers the cost of
owning a computer..."

"...Software restriction policies are a part of Microsoft's security
and management strategy to assist enterprises in increasing the
reliability, integrity, and manageability of their computers. Software
restriction policies are one of many new management features in
Windows XP and Windows Server 2003.

This article provides an in-depth look at how software restriction
policies can be used to: Fight viruses,Regulate which ActiveX controls
can be downloaded,Run only digitally signed scripts,,Enforce that only
approved software is installed on system computers,Lockdown a
machine..."

>From http://www.microsoft.com/technet/security/prodtech/windowsxp/secwinxp/xpsgch06.mspx

"...Software restriction policy provides administrators with a way to
identify software and control its ability to run on local computers.
This tool can help protect computers that run Microsoft(r) Windows(r)
XP Professional against known conflicts and safeguard them against
malicious software such as viruses and Trojan horse programs. Software
restriction policy integrates fully with the Active Directory(r)
directory service and Group Policy. You can also use it on stand-alone
computers...."

Dinis Cruz
Owasp .Net Project