1

In Windows 10 group policy editor you can restrict and allow only certain programs to run.

I'm wondering if that protects against malware? I can think of following cases:

1) If you start a program that's trusted, but the program downloads a malicious file and executes it.

2) If malware injects itself into a running process on the machine.

  • You're right that there's weaknesses in application whitelisting - it's not a silver bullet. Nothing is. Defense in depth is a valid and effective strategy, however. Preventing everything except known, trusted software from running will prevent a large amount of malware, even if it's not good enough on its own. – Adonalsium Feb 4 at 20:56
2

Generally, using an application whitelist will not only restrict what apps the user can directly launch, but also what apps the whitelisted apps can launch (after all, explorer.exe - the Windows graphical shell, which hosts the desktop, Start menu, taskbar, file browser, and so on - is itself just a process that launches other processes when told to do so). Also, hopefully you wouldn't allow a process to launch other processes if it could be used to launch arbitrary other processes (the way a shell can).

Also, application whitelisting is frequently combined with library whitelisting. After all, libraries also contain executable code. This makes it a lot harder - though not impossible - to inject malicious code into another process (since the usual way to do that is to dump a malicious library on the disk and get the process to load it).

If the attacker can compromise some process (like a browser or document reader) and get arbitrary code execution within it, they can do anything the process can do. Even if the process isn't allowed to launch arbitrary apps (because of whitelisting) it can probably use the debug APIs to take over running ones and achieve persistence (until you log off / reboot) that way. They can also read your files and transmit them to the attacker's computer, or launch network attacks against servers inside your firewall, or so on. If the attacker has code execution in one process, they don't need to launch another one (though it's usually more convenient to do so).

One solution to this is sandboxing, where you restrict what an at-risk process can do. Most desktop web browsers, Adobe Reader, and a growing suite of other software (including most things in the Windows or Mac App Stores) use sandboxing these days. A compromise is still bad - if somebody compromises your browser, for example, they can see what you're doing with that browser, and possibly steal information or hijack sessions that way - but they can't do things like attack other processes.

0

The best bet to avoid malware would be to assign the user a standard user privileges rather than using the administrator account. malware tend to take the privileges assigned to the user, hence a standard user right would restrict malware from obtaining admin privileges.

Also, malware other than worms usually require to be executed, without which they will sit dormant on your system. So, if you have a pop up on your system that asks you to install an updated version of a software (and the source is unknown), you could simply cancel the installation, and you would be free of the infection.

To be free of ,Worms will require you to update your OS as and when the updates are released. Windows 10 usually does this on it's own. If it is not done, you can always do this at the automatic updates in the control panel.

Always keep your OS updated and run your system on standard user privileges. This is the best remedy for malware.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.