3

How to disable the network interface (or delay its activation) during windows boot? this is meant to avoid network leaks that can happen before a firewall application start to monitor the network at boot time.

3

Situation:

The network card are activated just after their drivers are loaded and startup of network service, so pretty early in the windows boot sequence, exposing windows to potential network risks for those who use third party firewall. (because most firewalls load after windows login)

A possible Solution would consist of disabling the network cards on an early boot stage like BootExecute but the problem with this solution is that it require a native application to do the job and it's not easy to get it done as native functions are not documented

Solution:

The idea is to disable the driver to avoid it's activation at boot... after the system complete boot, a scheduled task will enable the driver, load it, and set it to disable for future reboot while keeping it active and loaded at the current time

Diagram: (ND = Network Driver)
ND Disabled --> Boot --> Desktop --> ND Enabled --> ND Loaded --> ND Disabled (But still loaded) 

The application consist of 2 scheduled scripts one run before the windows login (at startup) the other run after windows login (desktop) the reason of having 2 scripts is to avoid device detection error

Scheduled task script (before logon):

wmic path win32_networkadapter where index=0 call disable
wmic path win32_networkadapter where index=1 call disable
netsh interface set interface "Ethernet" disable
netsh interface set interface "Wi-Fi" disable

Scheduled task script (after logon):

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wifidriver /f /v Start /t REG_DWORD /d 3
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ethernetdriver /f /v Start /t REG_DWORD /d 3
wmic path win32_networkadapter where index=0 call enable
wmic path win32_networkadapter where index=1 call enable
netsh interface set interface "Ethernet" enable
netsh interface set interface "Wi-Fi" enable
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wifidriver /f /v Start /t REG_DWORD /d 4
reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ethernetdriver  /f /v Start /t REG_DWORD /d 4

Sources:

Debugging user mode, starting a service, windows boot process, driver load order and start type value for services

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.