2

I am facilitating an management system project in intranet environment(but with internet access for many domain users) for printing barcode labels from a web interface.

1. The current method our vendor employed is to launch a local bar code designing solution from IE and print barcode from there. The software checks license on startup, the webpage passes in a temporary license when invoking it. It will quit with error if launched directly. Their webpage use WSH FSO to launch this exe, we have to enable insecured ActiveX content in IE setting for this to work.

2. Our company deployed policy blocks all writing operations by regular users to C:\Program Files folder, and nothing outside of Program Files folder is executable by user other than administrators. Effectively rendering all executables read-only, writable files in-executable. But this barcode software needs to write to a lic file in its program folder. So here is the second dilemma. If placed outside of Program Files it will not execute, if placed inside, it will crash on error, due to a unwritable lic file. It was suggested to assign the user to administrator group. Adding together, it sounds a security nightmare.

My current solution to Issue1 to add this intranet address to trusted sites list and allow trusted zone to run insecure activex content. For Issue2, since there are multiple ways from different layers to prevent program from running (ACL,group policy,etc), I locally added Full control permission of the lic file to current domain user, so that the program can write its lic.

Though I still not feel comfortable with the vendor's way of label printing. I think the current workaround I proposed have minimum negative impact on current system security. But I am open to different opinions.

Another thing, if we move on to Window10, will win10 still support the scripting objects?

  • 2
    This might be a dumb comment but I figured it should be said: Is there anyway to configure the location of the lic file in the application? Maybe a configuration.ini or something exists with the path in it and it is not hardcoded? – Wealot May 16 '17 at 10:00
  • At the root of this lies the horrible, kludgy way in which the "local bar code designing software solution" is invoked. addressing the problems described in 2 just digs you deeper into a hole. While I don't know what this software does, my experience of designing barcode labels is that its easy and there are lots of tools for the job. I suggest fixing problem 1 , then problem 2 just goes away. – symcbean Aug 15 '17 at 16:01
  • You are right, we moved away to NiceLabel server side Automation Manager. I have also tried wkhtml2pdf to design html+css template and print via pdf. it worked well for generalizing most product using the same label paper into one template regarless of their content size. but our label designer is infamiliar with css they ask for WYSIWYG. For now Nicelabel2017 seems to be working well to our expectation. – Ben Aug 16 '17 at 0:18
0

It's just an idea - haven't tried it: Could you create a symbolic link to the actual .lic file in a different folder?

To do so, go to a command line window, and type:

mklink /H Link Target

With "Link" being the full path to the file where your application 'thinks' that it is, and "Target" being the full path to the actual file (outside of your 'Program Files' directory).

Here's a great guide if you like to read up more about symbolic links:

https://www.howtogeek.com/howto/16226/complete-guide-to-symbolic-links-symlinks-on-windows-or-linux/

I would rather write a comment than an "answer", but I don't have enough reputation, I'm sorry.

  • Hi, thank you for the answer. I have no problem setting +W in ACL for users so that the program can run. But its the direct launching behavior troubling me. Later it turned out the program is .net Reactor obfuscated and not digitally signed. Within a week all copies are delete by Falcon probes. It was a disaster. We abandoned this solution. – Ben Jun 10 '17 at 2:17
  • I doubt this will work: a symlink is, effectively, a new pointer to the same file: the application will really run from the program's folder and try to write its license file there. – Stephane Sep 14 '17 at 15:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.