Hiding malware in Windows: The basics of code injection

Re:Hiding malware in Windows: The basics of code injection by Someone1234 on Friday September 21, 2018 @11:11AM (#18040255)

This might be the wrong venue but with the popularity of randomware and more complex malware attacks, I'm saddened that one of Microsoft's premiere safety technologies, AppLocker, is license restricted.

AppLocker is system-wide whitelisting for those unaware. You can restrict which executables can execute based on a number of criteria of your choosing.

At work I have access to AppLocker thanks to our Enterprise editions. But at home, when I'm setting up relative's PCs (or even my own) I am lacking one of the most powerful tools in my arsenal.

Microsoft should CONSIDER putting AppLocker in retail editions, Enterprise still has a huge number of benefits beyond that[0], and you'd still not be able to centrally manage it. It would make the world better/safer place.

Keep in mind that BitLocker used to be Enterprise edition only too, but Microsoft came around to realizing that it had huge benefits for all users. AppLocker is the same way.

[0] https://en.wikipedia.org/wiki/Windows_10_editions#Comparison...

[ Parent | on HN ]

Re:Hiding malware in Windows: The basics of code injection by rasz on Friday September 21, 2018 @03:14PM (#18041950)

The second best thing you can do is Egress whitelisting. This can be done on stock W10 after disabling dnsmasq (dnsmasq acts as a hole thru windows firewall).

[ Parent | on HN ]

Re:Hiding malware in Windows: The basics of code injection by atesti on Saturday September 22, 2018 @08:16AM (#18045701)

Do you have more information about this dnsmasq? Is it really a part of windows?

[ Parent | on HN ]

Re:Hiding malware in Windows: The basics of code injection by rasz on Saturday September 22, 2018 @02:15PM (#18047181)

eh, I meant dnscache service.

[ Parent | on HN ]

Re:Hiding malware in Windows: The basics of code injection by ConceptJunkie on Friday September 21, 2018 @12:24PM (#18040789)

Do you mean "whitelisting" or is a term I've never heard of?

[ Parent | on HN ]

Re:Hiding malware in Windows: The basics of code injection by Someone1234 on Friday September 21, 2018 @12:47PM (#18040954)

Thanks, typo fixed.

[ Parent | on HN ]

Re:Hiding malware in Windows: The basics of code injection by eat_veggies on Friday September 21, 2018 @11:46AM (#18040543)

Doesn't BitLocker only come with the more expensive pro release?

[ Parent | on HN ]