Thoughts of a Little Sinchen

Category: Security

  • App Control for Business → Madness

    App Control for Business (WDAC – Windows Defender Application Control) is an extremely powerful function in Windows 10/11. When set up correctly this pretty much rules out that malware is able to start (or can easily achieve persistence). It can be configured in a way that even a user with local admin privileges becomes unable to change, remove or disable strict rules.

    This powerful kernel-mode feature comes at a price. The price is complexity and a steep learning curve. A steep learning curve has never discouraged me despite my serious concentration issues. Once I got into using Qubes OS I never really looked back. My real problem with WDAC lies in it’s complexity.

    (more…)

  • Invalid Password! [Sinchen Rant]

    One of my long-term goal of maximizing my computer security. Since roughly two years I went from better-than-average settings to seriously trying to harden my operating systems as good as possible.

    As I mentioned previously, my Windows knowledge is pretty much stuck in the XP-era. XP isn’t quite representing the status of current Microsoft operating systems. When reading “Windows 11” many people instinctively think of telemetry, software bloat, Copilot, forced online accounts and all this rubbish. I’m more interested in the things under the hood. For example: Virtualization‑Based Security (VBS), Hypervisor‑Protected Code Integrity (HVCI) and App Control for Business. I needed a pretty recent device offering the hardware Windows 11 expects (TPM 2.0, CPU with IOMMU, Secure Boot using year 2023 certificates) to do experiments… without playing around with my mum’s computer.

    (more…)

  • Windows “Device Encryption” With Automatic Unlock Is Not Secure Enough

    An easy explanation avoiding technical terms (until the box at the very end)

    The Short Version​

    If your PC meets certain criteria Windows encrypts your files automatically. This is good! But the way it’s set up by default has a hidden problem: the computer unlocks itself without asking for a password, and a copy of the unlock key is stored online on Microsoft servers.

    (more…)

  • Windows XP Hardening?

    How about still using Windows XP? Simplicity, lack of bloat, lack of AI, support for old games. I’ve always loved XP. Of course it didn’t feel lightweight in 2002 when installing the first Windows NT version intended for home users. Way bigger than 98SE, more demanding than 2000 Professional and with a nauseating default theme that is as dysfunctional as the (then) newly introduced Start Menu. Over the years I’ve mastered switching off all crap on a fresh XP installation in very few minutes. Still in muscle memory to this day. Using XP gives me a nostalgic feeling just like the boot sound of a PlayStation 1 coming from the powerful speakers of a big CRT TV.

    In this entry I want to explore this classic OS from the perspective of security. This could be very short by saying, “There is no way to truly secure it.” Nevertheless I’ll try my best.

    (more…)