Re: Windows Software Restriction Policy Protection Bypass

["Dinis Cruz" <dinis.cruz () googlemail com>]

This MS answer speaks volumes to their approach to security (I had
similar made to me in the past)

> 09.06.06 - Vendor response
>
> "Software  Restriction  Policy  and  Group  Policy  are  not meant to be
> complete  security features...For full security, we recommend using ACLs
> to protect the appropriate resources in your environment..."

Maybe they should update some of their docs:

> From http://www.microsoft.com/technet/prodtechnol/winxppro/maintain/rstrplcy.mspx

"...Software restriction policies are a new feature in Microsoft(r)
Windows(r) XP and Windows Server 2003. This important feature provides
administrators with a policy-driven mechanism for identifying software
programs running on computers in a domain, and controls the ability of
those programs to execute. Software restriction policies can improve
system integrity and manageability—which ultimately lowers the cost of
owning a computer..."

"...Software restriction policies are a part of Microsoft's security
and management strategy to assist enterprises in increasing the
reliability, integrity, and manageability of their computers. Software
restriction policies are one of many new management features in
Windows XP and Windows Server 2003.

This article provides an in-depth look at how software restriction
policies can be used to: Fight viruses,Regulate which ActiveX controls
can be downloaded,Run only digitally signed scripts,,Enforce that only
approved software is installed on system computers,Lockdown a
machine..."

> From http://www.microsoft.com/technet/security/prodtech/windowsxp/secwinxp/xpsgch06.mspx

"...Software restriction policy provides administrators with a way to
identify software and control its ability to run on local computers.
This tool can help protect computers that run Microsoft(r) Windows(r)
XP Professional against known conflicts and safeguard them against
malicious software such as viruses and Trojan horse programs. Software
restriction policy integrates fully with the Active Directory(r)
directory service and Group Policy. You can also use it on stand-alone
computers...."

Dinis Cruz
Owasp .Net Project

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/