Comments on: Preventing Applications From Starting (Malicious) Applications http://blog.didierstevens.com/2009/10/05/preventing-applications-from-starting-malicious-applications/ (blog 'DidierStevens) Sat, 11 Feb 2012 16:16:49 +0000 hourly 1 http://wordpress.com/ By: Geraldine http://blog.didierstevens.com/2009/10/05/preventing-applications-from-starting-malicious-applications/#comment-48750 Wed, 21 Dec 2011 15:53:44 +0000 http://blog.didierstevens.com/?p=1786#comment-48750 Thanks for that! It\’s just the answer I neeedd.

]]> By: Triflex Enterprise | PDFs Exploitable?!? I’m shocked… http://blog.didierstevens.com/2009/10/05/preventing-applications-from-starting-malicious-applications/#comment-38329 Thu, 22 Apr 2010 05:20:42 +0000 http://blog.didierstevens.com/?p=1786#comment-38329 [...] PDF readers could disable the functionality completely (perhaps using Didier Stevens’ developed method) or bide their time, waiting on [...]

]]> By: Hacker finds a way to exploit PDF files | The PC Report http://blog.didierstevens.com/2009/10/05/preventing-applications-from-starting-malicious-applications/#comment-38026 Thu, 01 Apr 2010 03:35:06 +0000 http://blog.didierstevens.com/?p=1786#comment-38026 [...] should they consider that the protection offered by the warning dialog is not sufficient. BTW, preventing Adobe Reader from creating new processes blocks this [...]

]]> By: Escape from PDF http://blog.didierstevens.com/2009/10/05/preventing-applications-from-starting-malicious-applications/#comment-38007 Wed, 31 Mar 2010 19:53:22 +0000 http://blog.didierstevens.com/?p=1786#comment-38007 [...] should they consider that the protection offered by the warning dialog is not sufficient. BTW, preventing Adobe Reader from creating new processes blocks this [...]

]]> By: Didier Stevens http://blog.didierstevens.com/2009/10/05/preventing-applications-from-starting-malicious-applications/#comment-37972 Wed, 31 Mar 2010 11:19:01 +0000 http://blog.didierstevens.com/?p=1786#comment-37972 @Reader because that will not help you exploits that download and execute malware.

]]> By: Reader http://blog.didierstevens.com/2009/10/05/preventing-applications-from-starting-malicious-applications/#comment-37970 Wed, 31 Mar 2010 11:11:36 +0000 http://blog.didierstevens.com/?p=1786#comment-37970 Why not just disable non-PDF file attachments in Trust Manager settings of Adobe Reader?

Prefs -> Trust Manader -> PDF File Attachments -> [ ] Allow opening…

]]> By: Escape From PDF (hack exposed) | Cell-Systems http://blog.didierstevens.com/2009/10/05/preventing-applications-from-starting-malicious-applications/#comment-37937 Tue, 30 Mar 2010 17:21:55 +0000 http://blog.didierstevens.com/?p=1786#comment-37937 [...] should they consider that the protection offered by the warning dialog is not sufficient. BTW, preventing Adobe Reader from creating new processes blocks this [...]

]]> By: Escape From PDF « Didier Stevens http://blog.didierstevens.com/2009/10/05/preventing-applications-from-starting-malicious-applications/#comment-37892 Mon, 29 Mar 2010 19:46:50 +0000 http://blog.didierstevens.com/?p=1786#comment-37892 [...] should they consider that the protection offered by the warning dialog is not sufficient. BTW, preventing Adobe Reader from creating new processes blocks this [...]

]]> By: Didier Stevens http://blog.didierstevens.com/2009/10/05/preventing-applications-from-starting-malicious-applications/#comment-35901 Mon, 12 Oct 2009 21:50:25 +0000 http://blog.didierstevens.com/?p=1786#comment-35901 > Otherwise, it’s only ’secure’ as far as the ‘attackers’ don’t bother to work around it.
That’s always the case. If I have local admin rights, I can also work around the protection you set up in the kernel. To avoid that, you need a TPM and a chain of trust. Until someone breaks the weakest link in that chain…
It’s an arms race.

And another way to bypass this altogether is just not to create a new process…
Use shellcode: http://blog.didierstevens.com/2008/10/23/excel-exercises-in-style/
Or a DLL: http://blog.didierstevens.com/2008/06/05/bpmtk-how-about-srp-whitelists/

]]> By: Anonymous http://blog.didierstevens.com/2009/10/05/preventing-applications-from-starting-malicious-applications/#comment-35899 Mon, 12 Oct 2009 21:35:42 +0000 http://blog.didierstevens.com/?p=1786#comment-35899 Process creation disabling should be done by the kernel in order to be really secure. Usermode could do something like disabling a token, but I don’t think that hooking can provide real security.
The point in blocking this is that it is going to run insecure, malicious, untrusted code. Thus, we should consider that the author knows the way we’re going to block its code. The protection should still work even on this case. Otherwise, it’s only ‘secure’ as far as the ‘attackers’ don’t bother to work around it.

]]>