0

Let's assume some things:

  • Back-ups do run every X minutes, yet the things I save should be permanent.

  • There's a firewall and virus scanner in place, yet there happens to be a zero day attack on me.

  • I am using Windows. (Although feel free to append Linux / OS X parts to your answer)

Here is the problem

  • Any software can change anything inside my user folder.

  • Tampering with the files could cost me my life, whether it's accessing / modifying or wiping them.

So, what I want to ask is:

  • Is there a permission-based way to disallow programs from accessing my files in any way by default?

  • Extending on the previous question, can I ensure certain programs can only access certain folders?

  • Are there other less obtrusive ways than using Comodo? Or can I make Comodo less obtrusive?

For example, the solution should be proof against (DO NOT RUN):

del /F /S /Q %USERPROFILE%
4
  • Well, since you mentioned zero-day exploits, I assume there's not a whole lot you can do about those. Make sure that at least once a month or so you backup to an external drive, in case that you actually are attacked in some way.
    – cutrightjm
    Jun 16, 2012 at 2:11
  • @ekaj: Well, I'm running a 64-bit system so the chance on a root kit bypassing security set by some other driver is probably low. Comodo is a perfect working example, although it comes with too much other things than just file access. As for backing up, you can assume that it happens X minutes, but that doesn't prevent any program from tampering with the data... (Like, payloading an executable I have compiled, accessing some personal data, removing a file in which I just stored something that I had to permanently keep, ...) Jun 16, 2012 at 2:14
  • If I were to back up the data (not considering the computer actually in use) and I had EXTREMELY sensitive data, I would probably take a pretty good size HDD and make various partitions, then encrypt each one with a password that's semi-memorable and relative to the partition. This seems like a pain, but I don't have any better ideas =p
    – cutrightjm
    Jun 16, 2012 at 2:44
  • With xp sp2 and older, winpooch, while obnoxious, did exactly this. It used some undocumented hooks so it broke, and wasn't kept up to date after that.
    – Journeyman Geek
    Jun 16, 2012 at 12:46

4 Answers 4

2

You could put all your important data in a folder only the Administrators group has write access1 to. Any program that wishes to write/delete this data would have to be elevated through UAC, providing you some security against tampering.

Expanding on that idea, you could save all files to a temporary location and manually copy/move to this secured folder through Windows Explorer (or similar), reducing the number of programs that need to be elevated and given access to this folder. explorer.exe itself limits write access to TrustedInstaller, which provides further protection against tampering.

This is all assuming the malware cannot bypass Windows' ACL security. And it also assumes you are very careful about which programs you elevate.

While it's not quite as restrictive as limiting each program to a set of folders, nor will it stop most of your user profile being wiped, it will protect those files you deem important enough to protect.

Whether it's any more secure or any less trouble than regular backups is another matter entirely.


1Read access should also be restricted if it's sensitive data, where you wish to remove the potential for malware to upload to the attacker.

1

You must take a white listing software approach in combination with a directories that are writable will not be executable style of control. In practice this means Software Restriction Policies and only install software you know to be trust worthy.

white listing: User is a limited (standard) user. Software is only installed as Admin to non-user directory; ie program files, etc.

Writable but not executable locations: Any directory that the user can write to is marked, via SRP, to not allow .dll's or .exe's to run from. You can copy them there but they won't run. The fact that the user is non-admin ensures this. Browser highjack's to temp directories don't work anymore. Download viruses for fun; does not matter.

1

Tom, have you thought about using a virtual machine and separating the two OS's completely to test the software?

Something like VMWare Player maybe (which is free)..

1
  • Testing each software product might be unfeasible. Jun 16, 2012 at 12:44
1

You could run applications under different user accounts. For example, have a secondary user account set up for web browsing, and then use "run as" functions to execute that program as that user. This can be done with batch files or PowerShell scripts as well to make it more transparent. This won't be as secure as the isolation provided by virtualization, but in most cases it means that two exploits have to happen (malware getting into the secondary account by a first, and privilege escalation to Administrator or LOCAL_SYSTEM for the second).

Software restriction policies can also be put into effect (http://technet.microsoft.com/en-us/library/bb457006.aspx) which will deny unauthorized programs, or lower privileges for authorized but untrusted programs. I used this tactic back when I was on Windows XP for my web browsers and email programs so that they'd drop administrator rights, but it can also drop a program to the same access as the Guest account. This is a fairly complicated thing to set up, and needs a fair amount of experience in working with group policies, but can provide the same isolation as the "run as" method automatically whenever a given executable is launched.

All in all though, @indifferentDrum's suggestion of virtual machines is going to be the easiest approach for most situations, and likely will be more secure at a small performance penalty, but a combination of various approaches is worth looking at for the different threats - you might be well to consider setting up sandbox accounts and runas shortcuts for web browsing, while launching completely untrusted software in virtual machines and preventing accidental execution from your downloads folder with a software restriction policy that denies the ability to run anything living in that folder.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .