Denying Hacking Programs by Name

On my network I can write a policy that will deny the user the ability to run exe programs by name. Provided they can just rename the program msword.exe but I'm betting that most people won't be worrying about renaming it.

So I'm asking if you all can help me out and provide me a list of hacking tools that might be used against a windows 2000 server, that also runs a web server. All I need is the program name and a breif description of what the program does. I don't need to know where to get it or anything like that cause I really don't care lol. If you all could help me out that would be great.

Thanks

I will begin constructing a list, but know that it is in the hundreds of thousands. There are quite literally that many programs out there that have been written for continual destructive use and thus you are in for a lot of name typing. On a side note, couldn't they also change the file name?

But I am glad you are still striving to circumvent it, as program kiddies and scripties annoy us all, I'm sure.

Quote:

---

On my network I can write a policy that will deny the user the ability to run exe programs by name. Provided they can just rename the program msword.exe but I'm betting that most people won't be worrying about renaming it.

---

That's a pretty scary bet. I'd actually bet otherwise. It's the activity of the program that is important, not necessarily the name. I'd suggest visiting CERT, look at all the vulnerabilities for Win2K and the webserver in question (IIS or Apache?) and then visit a site like Packet Storm Security and seeing what "exploits/programs" exist.

This method that you are proposing will really only deal with the script kiddies and won't deal with those with a lot more finesse. A better course of action would be to secure the server, have a firewall in front of the web server and an IDS behind it to detect any intrusions.

Why don't you reverse he policy and make it such that the user can only run programs on the list you define. Then only those programs will run rather than try to guess at the myriad combination of names hacktools either have or can be named.

Thanks, just as soon as possible would be great

WEll I would just reverse the list but than I have the problem of trying to find out every exe that programs such as msword and turbo tax, and other run. That is really alot. lol

Quote:

---

This method that you are proposing will really only deal with the script kiddies and won't deal with those with a lot more finesse. A better course of action would be to secure the server, have a firewall in front of the web server and an IDS behind it to detect any intrusions.

---

I agree 100%, as this not only being a faster method but a much more secure one. I've also noticed that the McAfee virus scanner when running in the background constant mode detects a majority of script kiddie applications based upon the hashes(terminology correct?) that makes up the file, rather than the name. Port scanners, crackers, etc etc... I've seen that virus scanner pick up the most amazing things, and in the process save quite a few networks while firing a few employees.

It's a lot less than the other way. Is this machine also used for regular usage (regular user with applications and games?)

the server is IIS

Why do you only want the ones that hack a 2000 web server, wouldnt you rather have no exploits running on your network?

I would have to agree with tigershark and make a list of ok progs. This list will probably be a lot smaller than a list of all known exploits and it will prevent the possibilty of new 0 dayz being run

well to be honest, thats what I suggested to my boss, but he didn't agree for some strange reason. so here I am.

JB

You really have to talk this strategy through with your boss, as he seems to be stuck on a tactical (short-term) approach at the moment.

OK, so you identify 1000 hacking programs and block them by "name" and I re-name them all?

Then I write 1001

It just does not make any sense?

Please take the advice of the very experienced contributors to this thread, and your own instincts.......it won't work.

Perhaps you need to brush up on your persuasive techniques here?

Good Luck Mate!

Alright thats what I do, can anyone please help me find out what sub programs ms office apps call????

Hey JB,

Cut us a bit of slack............

Which version of office? (4.X, 95,97,2000, XP/2002)

Standard, Professional, Developer?

Which modules (Word, Excel, Access, Powerpoint)?

That is a pretty tall order you have placed :) If you have a corporate licence, why not ask Microsoft Technical Support?

Cheers

BTW............It might help us if you said what you were trying to ACHIEVE?......I have a nasty suspicion that you might be going about it the long/wrong way?

We run our own programed software on windows 2000 servers(web based software) that allow users to log into our servers using items like citrix or Remote desktop / terminal services and use the computer/network just like it was there desktop at there office. We want to avoid users downloading applications from the web and running them against the server. I know some applications require admin access but not all do. So we want to deny the users access to run any exe but the ones we specifiy. First by denying any other hacking program running, but now(hopfully) by allowing them to run only the programs we specify.

Do you all know how to do it a simpler way?????

Office 2000 Professional

Microsoft tech support won't give out the information as it "compromises there software" blah blah blah.

Any help?????

Another problem would be, due to our various clients, Office is not the only program we have running. I mean we have everything from accounting software to grammer tools, talk and type tools.

So its a very very very large/hard problem.... and those options above are so far the only ones we have come up with so far. So its like a lose lose situation.. Any other ideas???

Have you looked into the SCE (Security Configuration Editor). Microsoft and the NSA both provide guides that might help you with this:

Microsoft's Security Hardening Guide

NSA CSE Templates

Hi jbclarkman,

I haven't uset the Citrix metaserver for a couple of years now, but you should be safe with that? AFAIK it just lets you use standard applications that you set up for the user in Citrix.......they should not be able to upload anything else, other than macros?......I am still trying to visualise your system............where is the data held?, hopefully on separate fileservers?...and there should not be any executables on those?

Also, you must use the Windows 2000 security features to their full extent. For the other stuff, the User should only be allowed to run programs, not add software? The answer has to lie in letting them access applications, but not access your OS?

You might like to consider creating you own "Citrix Like" environment, so they log into a screen full of icons that just pull up what they are entitled to on the applications server? A few lines of code in their logon script would do this.

I will need to go and think about this a bit more, but the scenario is familiar.

Please try to provide a bit more info about your architecture.........you can attach diagrams so long as they are not more than 1Mb and have a valid extension.........please see bottom left of reply screen.

Cheers

If you want a list of exe's that you do want to be able to execute, start by doing a search for all EXE's on the box..

(Start -> Search -> Files and Folders) *.exe

that would be a good start ;)

Well we have already developed are own "Citrix Like" enviornment. It loads almost like citrix but they can run the programs on there desktop and in start menu and such. They do not have access to a command prompt or anything of that matter. We are concerned with the fact that they might be able to download(sense they have internet access) and run some .exe programs that might compromise our server. So that is the main concern. We can't take away download/internet privlages because all of our clients pretty much depend on us for there high speed access. and I'm not exactly sure how to restrcit what users download... any ideas??

Hi

Your access mechanism (Citrix/Citrix clone) sound pretty secure to me.

I think that the rest is pretty much impossible :(

This is typical of a "thin client" implementation? you are allowing the users onto your system with the rights to run applications, so you are restricted to the security provided by those applications.

You browsers support java and activeX?

Microsoft office supports VBS?

Even if you identify all valid executables, I just rename my malware as a valid executable and run it? I can even write malware in Office modules :)

Your best bet is a good AV/Firewall/Intrusion Detection combination

Also have a look at these:

http://www.diamondcs.com.au "trojan Defence Suite" and others
http://www.analogx.com "Script Defender"
http://www.mobiusware.com "MoOutlooksecurity"

Good Luck

What firewall do you have?

The higher end firewalls will block content by type so you could tell it no exe, com, etc files are allowed through.