Security Based Project Idea

[RobC]

Ok. I finally have a worthwhile idea to pitch for the project. This one is security based and spurred on by the security article here, and in particular, this quote:

 

One clear symptom that you have a case of "Enumerating Badness" is that you've got a system or software that needs signature updates on a regular basis, or a system that lets past a new worm that it hasn't seen before. The cure for "Enumerating Badness" is, of course, "Enumerating Goodness." Amazingly, there is virtually no support in operating systems for such software-level controls. I've tried using Windows XP Pro's Program Execution Control but it's oriented toward "Enumerating Badness" and is, itself a dumb implementation of a dumb idea.

 

How difficult would it be to write a program that monitors all code executed by the system? This would look at programs that run, etc and decide, based on a list of rules, what is allowed to run. Anything else would be prevented and logged with the ability to allow it if it is a legitimate application.

 

Not being a programmer, I don't quite know the implications of this task such as processor time, memory usage, etc. but I think this would be a very useful feature for schools. Certainly it would stand as a big barrier to spyware, malware, adware, etc, as well as stopping staff & pupils trying to install unauthorised applications.

 

Can someone tell me if this is possible, and whether it can be added to the (potential) features list for the Edugeek Project?

 

Cheers,

 

Rob.

[russdev]

well project (once i get my net connection sroted) is an admins tool kit in not so many words and adding it as part of project not an issue..

 

As for program side not sure problem is have to make sure that it very small as it need to run a lot if think of amount of work doing for example just do task list to see amount it would have to check before you start doing anything.

 

but could be possable...

 

what do others think?

 

russ

[Geoff]

How difficult would it be to write a program that monitors all code executed by the system? This would look at programs that run, etc and decide, based on a list of rules, what is allowed to run.

 

Certainly on Linux systems, this is possible today. Playing with mount options is an obvious starting point. Then you can move on to more complex measures like Systrace, Tripwire and SELinux or GRSecurity.

 

Disclaimer: Here be dragons.

 

I don't believe this is possible on Windows at the moment. You need intimate support from the OS internals to do this kind of thing and it just doesn't exist.

[russdev]

was thinking about this problem being is that got antivirus software that intercepts programs and then this could slow system right down...

 

russ

[uk101man]

It is possible in vb to list all running application and with that information could compare every title against a safe list and the close the program that is not on the list

 

Tom

[webman]

It is possible in vb to list all running application and with that information could compare every title against a safe list and the close the program that is not on the list

 

Tom

 

Comparing by window title can sometimes be unreliable as there are no strict rules applications adhere to and can change regularly, but it is certainly possible and a lot easier on resources. AFAIK, this is how Ranger does it.

[uk101man]

i would have to check my coding but i think it possible to pull the programs path and name, which i'm guessing you could use to check against a safe list

[E1uSiV3]

using names as a basis for comparison is a bad idea, for instance, i could just rename a malicious piece of code to a process name that has been declared safe to run and voila, md5sums of the exes would be more useful, but would need to be updated when the program version changes

 

On a side note, doesnt windows group policies have a similar sort of system for safe program execution (which uses the path system and invariably can be bypassed with the method above)

[webman]

@E1uSiV3: Yes, I know the exact GPO you are thinking of and it goes back to Win9x days, "Only allow the following programs to be executed" or similar wording. In Win9x it was possible to rename an EXE to something that was allowed, but as far as I know, the newer Win2K+ version of this GPO actually makes a hash of the file, which means that users can't rename EXEs they want to run - but secondly, when applications change, you must remember to re-do the hash of the EXE otherwise it might not run at all

[pete]

I have a nasty feeling that hashes + automatic patching = bad things.

 

You'd have to be able to easily check which system file hashes have changed, whether the change is legit (or not) and be able to push out the new hashes as part of the patching process.

 

Is anyone here using this function with success / beyond testing?

[wesleyw]

I would have thought that the hashing for Windows System patches and the like would be fine just the application software would be the issue? I suppose it depends on how much software you run and how frequently it needs patching. As long as you run the update then make the changes I can't see a problem with that solution?

 

Wes

[mac_shinobi]

Dont exe's or any other file types that are able to run have digital signatures or something to that effect or possibly something else that allow you to determine if it is malware or not ?

[E1uSiV3]

Dont exe's or any other file types that are able to run have digital signatures or something to that effect or possibly something else that allow you to determine if it is malware or not ?

 

In theory, yes, but its voluntary and no bugger uses is apart from microsoft and a few other people.

 

The whole windows patching issue can be avoided by adding a rule for the whole windows directory as it should be read only anyway for joe public

[_Bob_]

Indeed. The trouble is you get naff educational software that insists on having write access to .ini files it installs in the windows folder, despite the fact that it only ever reads settings from them.

[mac_shinobi]

Asked a Q on EE , here is the URL :

 

http://www.experts-exchange.com/Programming/Q_21700066.html

 

Registration is free ( at least there should be an option to register for free )

 

If not let me know and I can post back with the info.

[RobC]

Unfortunately, you do have to pay to access Expert's Exchange (unless there really is a free subscription hidden deep in the bowels of the site...).

[mac_shinobi]

OK I did a copy and paste , if you want I can just save the page and zip it and upload it here if thats any better ?

 

'---------------------------------

 

Title: Determine if running processes are valid or not ?

asked by gecko_au2003 on 01/17/2006 09:08PM GMT

This question is worth 500 Points

 

 

What is the best way of listing all currently running processes and looping though each process to determine if it is a valid process or not ie not a virus , trojan or malware etc ??

 

As per here :

 

http://edugeek.net/index.php?name=Forums&file=viewtopic&p=14754#14754

 

Send to a Friend Printer Friendly

 

 

Comment from cookre

Date: 01/17/2006 09:52PM GMT

Comment Accept

 

It's really not all that difficult, at least, what was described in the link.

 

It's fairly simple to enumerate processes and identify their original filenames for comparison against a white-list. Indeed, that's one feature of a package I'm currently developing, with the addition of optional version checking.

 

Now, identifying WHAT the rejected program is is a completely different problem.

 

Comment from gecko_au2003

Date: 01/17/2006 09:56PM GMT

Your Comment

 

Surely using file names isnt a good way of doing it, isnt there a digital signature or something that would be more full proof ?

 

Also any chance of getting a finished app with source code cookre ? ( long shot I know lol )

 

Comment from gecko_au2003

Date: 01/17/2006 10:09PM GMT

Your Comment

 

Had a better idea

 

Post it on that thread in that forum ( Which I am apart of ) If that is ok with you and that way you will get credit from all of them.

 

Must admit would be nice to get a reference from you to say that I pointed ya there lol he he but as always cookre all the help is VERY much appreicated !!

 

Thanks a bunch !!

 

Comment from cookre

Date: 01/17/2006 11:00PM GMT

Comment Accept

 

That gets into the area of efficacy versus useability. Once you step beyond just a filename (with full path), maintenance becomes a bit of a pain. Just imagine all the hassles when upgrading a popular app.

 

Also, consider the sequence of events after an OS service pack is applied. Upon reboot, many upgraded dlls have to be allowed even before anyone can logon.

 

It'll be a day or two before I post it - I want to sanitize it first. Also, I'll post it here, and you can provide the folks there a link.

 

Comment from gecko_au2003

Date: 01/17/2006 11:04PM GMT

Your Comment

 

ok thanks cookre ( I will obviously give you full credit ) since you are defintly due the credit !!

 

Comment from cookre

Date: 01/18/2006 02:00AM GMT

Comment Accept

 

Well, in .NET it's rather anti-climactic:

 

Process [] p=Process.GetProcesses();

for (int i=0; i

{

try {MessageBox.Show(p.MainModule.FileName);}

catch (Exception excp) {}

}

 

The try/catch is there since some system process modules can't be enumerated.

 

This can be taken a step farther by using p.Modules to enumerate all loads made by the process.

 

 

Comment from cookre

Date: 01/18/2006 02:10AM GMT

Comment Accept

 

Since MS has taken a lot of pizazz out of coding with .NET, we offer the old-fashioned API call approach:

 

#include "stdafx.h"

#include

#include

#include

#include

#include

 

#define ExcessiveValue 4096

 

DWORD ProcList[ExcessiveValue];

HMODULE hMods[ExcessiveValue];

 

DWORD Needed;

BOOL bRC;

DWORD NumProc;

HANDLE hProc;

DWORD i,j;

char ModName[MAX_PATH];

 

 

int main(int argc, char* argv[])

{

if (!EnumProcesses(ProcList,ExcessiveValue*sizeof(DWORD),&Needed))

{

printf("EnumProcesses failure %d\n",GetLastError());

return 1;

}

NumProc=Needed/sizeof(DWORD);

for (i=0; i

{

hProc=OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ,false,ProcList);

if (hProc==NULL) continue;

printf("PID: %ld\n",ProcList);

if (EnumProcessModules(hProc,hMods,sizeof(hMods),&Needed))

{

for (j=0; j<(Needed/sizeof(HMODULE)); j++)

{

if (GetModuleFileNameEx(hProc,hMods[j],ModName,sizeof(ModName)))

{

printf(" %s\n",ModName);

}

}

}

CloseHandle(hProc);

}

return 0;

}

 

 

 

Being a lazy SOB, I'll take c#.

 

'------------------------

 

Hope that helps

[mac_shinobi]

With regards to free registration for Experts Exchange go here :

 

http://www.experts-exchange.com/registerFree2.jsp