AppLocker - Security Problems

Security
Published Aug 7, 2012 Updated Aug 6, 2012

This article is part of my small series about AppLocker, a technology built into Windows that enables administrators to audit and optionally block application execution.

AppLocker Security

There is no perfect security, every product has its vulnerabilities and AppLocker is no exception. These are the problems I am aware of.

Windows\Temp

AppLocker’s default rules allow the execution of all code from the Windows directory. This is generally considered safe, since standard users do not have permissions to write to C:\Windows and its subdirectories. However, there is one exception: users have write and execute permissions in C:\Windows\Temp by default as the following screenshot from SetACL Studio shows:

Permissions on C-Windows-Temp

To close this loophole modify the default AppLocker rule so that it contains an exception for C:\Windows\Temp.

VBA and SANDBOX_INERT

A non-blocked process can start arbitrary executables circumventing AppLocker’s rules by calling the API function CreateRestrictedToken with the parameter SANDBOX_INERT. This is a problem because Microsoft Office will not be blocked in most if not all enterprises, and Office’s scripting language Visual Basic for Applications is well capable of calling API functions.

More information and a test program is available in Didier Steven’s blog.

Comments

Comments are powered by Giscus. Please enable JavaScript to view them, or view discussions directly on GitHub.

Related Posts

Citrix CVAD: Network Connection Target Hosts

Citrix CVAD: Network Connection Target Hosts

This post lists the internet communication targets of Citrix Virtual Apps and Desktops (formerly XenApp/XenDesktop). This post is a part of my application network connection monitoring series, a group of articles that explain how to analyze the network traffic of any Windows or macOS app.

Checking Windows Hello Key Storage: TPM or Software?

Checking Windows Hello Key Storage: TPM or Software?

Windows Hello for Business (WHfB) stores a cryptographic key on the device. The preferred storage location is a hardware TPM module. However, if a TPM is not available, the key may be stored in the filesystem instead. It’s surprisingly hard to determine the storage location for existing Windows Hello for Business keys. This article presents a simple solution.

Windows OS, Services & Apps: Network Connection Target Hosts

Windows OS, Services & Apps: Network Connection Target Hosts

This post lists the internet communication targets of the Microsoft Windows operating system, including its various services and UWP apps. This post is a part of my application network connection monitoring series, a group of articles that explain how to analyze the network traffic of any Windows or macOS app.

AppLocker - Solutions to Common Problems

AppLocker - Solutions to Common Problems

This article is part of my small series about AppLocker, a technology built into Windows that enables administrators to audit and optionally block application execution. AppLocker and UAC One of the default rules allows unrestricted application execution for administrators. That is only sensible. After all, someone needs to be able to troubleshoot and perform maintenance. However, if UAC is enabled, that rule is not very useful. Remember: UAC filters the SID for the group Administrators from the access token during normal operation. With the Administrators’ SID gone, AppLocker is active for administrators in the same way it is for all other users. Administrators wishing to bypass AppLocker need to start executables from an elevated command prompt (or right-click and select run as administrator), which is often impractical.

Latest Posts

Beautiful Slide Decks from Markdown: Presenting with Slidev

Beautiful Slide Decks from Markdown: Presenting with Slidev

Would you like to get away from PowerPoint and author slide decks in Markdown? Then Slidev may be just what you’re looking for. It’s a web app for presentations. The fact that it’s geared towards developers shouldn’t put you off. After all, who isn’t a developer these days, with AI? Slidev comes with the beautiful Tahta themes and supports features like syntax highlighting and animations. Export options to PDF and PPTX allow for easy sharing. This article shows how to get started.

Sambee 1.0: Secure, Browser-Based File Management for PCs, Phones & Tablets

Sambee 1.0: Secure, Browser-Based File Management for PCs, Phones & Tablets

Sambee 1.0 is now available! This milestone marks the end of the beta and pre-release phases. What Is Sambee? Sambee turns your existing storage into a modern workspace - no migration, syncing, or cloud required.

Filebrowser to Be Archived. Migrate to a Modern Alternative: Sambee

Filebrowser to Be Archived. Migrate to a Modern Alternative: Sambee

Filebrowser is being archived. As the author writes, the codebase dates back to when he was but 15 years old. Having created such a popular file management tool is a more than impressive achievement for anyone, let alone a teenager. However, when it comes to security and reliability, Filebrowser seems to be built on a less than ideal foundation, so much so that the author states:

Home Automation, Networking & Self-Hosting

Auditing Samba File & Directory Changes With Elasticsearch

Auditing Samba File & Directory Changes With Elasticsearch

This article explains how to set up an auditing (change-tracking) system for Samba file shares that shows who created, deleted, or changed a file or directory and when. The solution is optimized for security, high performance, and low maintenance.

Home Automation, Networking & Self-Hosting