Anti-Executable Enterprise User Guide 2 |

Total Page：16

File Type：pdf, Size：1020Kb

| 1 Anti-Executable Enterprise User Guide 2 | Last modified: January 2021 © 1999–2021 Faronics Corporation. All rights reserved. Faronics, Deep Freeze, Deep Freeze Cloud, Faronics Deploy, Faronics Core Console, Faronics Anti-Executable, Faronics Anti-Virus, Faronics Device Filter, Faronics Data Igloo, Faronics Power Save, Faronics Insight, Faronics System Profiler, and WINSelect are trademarks and/or registered trademarks of Faronics Corporation. All other company and product names are trademarks of their respective owners. Anti-Executable Enterprise User Guide | 3 Contents Preface . 5 Important Information. 6 About Faronics . 6 Product Documentation . 6 Technical Support. 7 Contact Information . 7 Definition of Terms. 8 Introduction . 11 Anti-Executable Overview. 12 About Anti-Executable . 12 Anti-Executable Editions . 12 About Faronics Core Console. 12 System Requirements . 13 Console Requirements . 13 Workstation Requirements. 13 Anti-Executable Licensing. 14 Installing Anti-Executable . 15 Installation Overview . 16 Installing Anti-Executable Loadin . 17 Installing Anti-Executable on a Workstation Manually . 20 Installing or Upgrading Anti-Executable on a Workstation via Faronics Core Console . 23 Accessing Anti-Executable . 25 Overview . 26 Accessing Anti-Executable via Faronics Core Console. 27 Anti-Executable Columns in Faronics Core Console . 27 Executing Anti-Executable Commands via Faronics Core Console (Loadin-menu) . 27 Executing Anti-Executable Commands via Faronics Core Console (Context-menu) . 29 Scheduling Actions . 30 Accessing Anti-Executable Enterprise on a Workstation. 31 Using Anti-Executable . 33 Overview . 34 Create a Central Control List . 35 Anti-Executable Policy . 38 Configuring Anti-Executable . 46 Status Tab. 47 Verifying Product Information . 47 Enabling Anti-Executable Protection . 48 Anti-Executable Maintenance Mode . 48 Retrieving settings from Faronics Core Console. 49 Execution Control List Tab. 50 Users Tab . 51 Anti-Executable Enterprise User Guide 4 | Contents Adding an Anti-Executable Administrator or Trusted User . 51 Removing an Anti-Executable Administrator or Trusted User. 52 Enabling Anti-Executable Passwords. 52 Temporary Execution Mode Tab . 53 Activating or Deactivating Temporary Execution Mode. 54 Setup Tab . 55 Setting Event Logging in Anti-Executable . 55 Monitor DLL Execution. 55 Monitor JAR Execution. ..

Copy Link

Recommended publications

Debugging with GDB
Debugging with GDB The gnu Source-Level Debugger HP Seventeenth Edition, for GDB January 2007 Richard Stallman, Roland Pesch, Stan Shebs, et al. (Send bugs and comments on GDB to [email protected] with copy to [email protected] ) Debugging with GDB TEXinfo 2003-02-03.16 Copyright c 2007 Free Software Foundation, Inc. Published by the Free Software Foundation 59 Temple Place - Suite 330, Boston, MA 02111-1307 USA ISBN 1-882114-77-9 Permission is granted to make and distribute verbatim copies of this manual provided the copyright notice and this permission notice are preserved on all copies. Permission is granted to copy and distribute modiﬁed versions of this manual under the conditions for verbatim copying, provided also that the entire resulting derived work is distributed under the terms of a permission notice identical to this one. Permission is granted to copy and distribute translations of this manual into another lan- guage, under the above conditions for modiﬁed versions. i Table of Contents Summary of GDB............................. 1 Free software ................................................ 1 Contributors to GDB......................................... 1 1 A Sample GDB Session .................... 5 1.1 Loading the Executable .................................. 5 1.2 Setting Display width.................................... 6 1.3 Setting Breakpoints ..................................... 6 1.4 Running the executable under GDB ...................... 6 1.5 Stepping to the next line in the source program............ 6 1.6 Stepping into a subroutine ............................... 6 1.7 Examining the Stack .................................... 7 1.8 Printing Variable Values ................................. 7 1.9 Listing Source Code ..................................... 7 1.10 Setting Variable Values During a Session ................. 8 2 Getting In and Out of GDB ..............
[Show full text]
Portable Executable File Format
Chapter 11 Portable Executable File Format IN THIS CHAPTER + Understanding the structure of a PE file + Talking in terms of RVAs + Detailing the PE format + The importance of indices in the data directory + How the loader interprets a PE file MICROSOFT INTRODUCED A NEW executable file format with Windows NT. This for- mat is called the Portable Executable (PE) format because it is supposed to be portable across all 32-bit operating systems by Microsoft. The same PE format exe- cutable can be executed on any version of Windows NT, Windows 95, and Win32s. Also, the same format is used for executables for Windows NT running on proces- sors other than Intel x86, such as MIPS, Alpha, and Power PC. The 32-bit DLLs and Windows NT device drivers also follow the same PE format. It is helpful to understand the PE file format because PE files are almost identi- cal on disk and in RAM. Learning about the PE format is also helpful for under- standing many operating system concepts. For example, how operating system loader works to support dynamic linking of DLL functions, the data structures in- volved in dynamic linking such as import table, export table, and so on. The PE format is not really undocumented. The WINNT.H file has several struc- ture definitions representing the PE format. The Microsoft Developer's Network (MSDN) CD-ROMs contain several descriptions of the PE format. However, these descriptions are in bits and pieces, and are by no means complete. In this chapter, we try to give you a comprehensive picture of the PE format.
[Show full text]
IBM AIX Version 6.1 Differences Guide
Front cover IBM AIX Version 6.1 Differences Guide AIX - The industrial strength UNIX operating system AIX Version 6.1 enhancements explained An expert’s guide to the new release Roman Aleksic Ismael "Numi" Castillo Rosa Fernandez Armin Röll Nobuhiko Watanabe ibm.com/redbooks International Technical Support Organization IBM AIX Version 6.1 Differences Guide March 2008 SG24-7559-00 Note: Before using this information and the product it supports, read the information in “Notices” on page xvii. First Edition (March 2008) This edition applies to AIX Version 6.1, program number 5765-G62. © Copyright International Business Machines Corporation 2007, 2008. All rights reserved. Note to U.S. Government Users Restricted Rights -- Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp. Contents Figures . xi Tables . xiii Notices . xvii Trademarks . xviii Preface . xix The team that wrote this book . xix Become a published author . xxi Comments welcome. xxi Chapter 1. Application development and system debug. 1 1.1 Transport independent RPC library. 2 1.2 AIX tracing facilities review . 3 1.3 POSIX threads tracing. 5 1.3.1 POSIX tracing overview . 6 1.3.2 Trace event definition . 8 1.3.3 Trace stream definition . 13 1.3.4 AIX implementation overview . 20 1.4 ProbeVue . 21 1.4.1 ProbeVue terminology. 23 1.4.2 Vue programming language . 24 1.4.3 The probevue command . 25 1.4.4 The probevctrl command . 25 1.4.5 Vue: an overview. 25 1.4.6 ProbeVue dynamic tracing example . 31 Chapter 2. File systems and storage. 35 2.1 Disabling JFS2 logging .
[Show full text]
CPE 323 Introduction to Software Reverse Engineering in Embedded Computer Systems
CPE 323 Introduction to Software Reverse Engineering in Embedded Computer Systems Aleksandar Milenković Email: [email protected] Web: http://www.ece.uah.edu/~milenka Objective: Introduce tools and methods for software reverse engineering in embedded systems Contents Contents ...................................................................................................................................... 1 1 Introduction ............................................................................................................................. 2 2 Format of Executable Files ...................................................................................................... 2 3 GNU Utilities ............................................................................................................................ 6 4 Deconstructing Executable Files: An Example ....................................................................... 10 5 Working with HEX Files and MSP430Flasher Utility .............................................................. 25 6 To Learn More ....................................................................................................................... 29 CPE 323: Software Reverse Engineering © A. Milenković 1 1 Introduction In this section we will introduce basic concepts, tools, and techniques for software reverse engineering with a special emphasis on embedded computer systems. Reverse engineering in general is a process of deconstructing man-made artifacts with a goal to reveal their designs and architecture
[Show full text]
Archive and Compressed [Edit]
Archive and compressed [edit] Main article: List of archive formats • .?Q? – files compressed by the SQ program • 7z – 7-Zip compressed file • AAC – Advanced Audio Coding • ace – ACE compressed file • ALZ – ALZip compressed file • APK – Applications installable on Android • AT3 – Sony's UMD Data compression • .bke – BackupEarth.com Data compression • ARC • ARJ – ARJ compressed file • BA – Scifer Archive (.ba), Scifer External Archive Type • big – Special file compression format used by Electronic Arts for compressing the data for many of EA's games • BIK (.bik) – Bink Video file. A video compression system developed by RAD Game Tools • BKF (.bkf) – Microsoft backup created by NTBACKUP.EXE • bzip2 – (.bz2) • bld - Skyscraper Simulator Building • c4 – JEDMICS image files, a DOD system • cab – Microsoft Cabinet • cals – JEDMICS image files, a DOD system • cpt/sea – Compact Pro (Macintosh) • DAA – Closed-format, Windows-only compressed disk image • deb – Debian Linux install package • DMG – an Apple compressed/encrypted format • DDZ – a file which can only be used by the "daydreamer engine" created by "fever-dreamer", a program similar to RAGS, it's mainly used to make somewhat short games. • DPE – Package of AVE documents made with Aquafadas digital publishing tools. • EEA – An encrypted CAB, ostensibly for protecting email attachments • .egg – Alzip Egg Edition compressed file • EGT (.egt) – EGT Universal Document also used to create compressed cabinet files replaces .ecab • ECAB (.ECAB, .ezip) – EGT Compressed Folder used in advanced systems to compress entire system folders, replaced by EGT Universal Document • ESS (.ess) – EGT SmartSense File, detects files compressed using the EGT compression system. • GHO (.gho, .ghs) – Norton Ghost • gzip (.gz) – Compressed file • IPG (.ipg) – Format in which Apple Inc.
[Show full text]
Anti-Executable Standard User Guide 2 |
| 1 Anti-Executable Standard User Guide 2 | Last modified: October, 2015 © 1999 - 2015 Faronics Corporation. All rights reserved. Faronics, Deep Freeze, Faronics Core Console, Faronics Anti-Executable, Faronics Device Filter, Faronics Power Save, Faronics Insight, Faronics System Profiler, and WINSelect are trademarks and/or registered trademarks of Faronics Corporation. All other company and product names are trademarks of their respective owners. Anti-Executable Standard User Guide | 3 Contents Preface . 5 Important Information. 6 About Faronics . 6 Product Documentation . 6 Technical Support . 7 Contact Information. 7 Definition of Terms . 8 Introduction . 10 Anti-Executable Overview . 11 About Anti-Executable . 11 Anti-Executable Editions. 11 System Requirements . 12 Anti-Executable Licensing . 13 Installing Anti-Executable . 15 Installation Overview. 16 Installing Anti-Executable Standard. 17 Accessing Anti-Executable Standard . 20 Using Anti-Executable . 21 Overview . 22 Configuring Anti-Executable . 23 Status Tab . 24 Verifying Product Information . 24 Enabling Anti-Executable Protection. 24 Anti-Executable Maintenance Mode . 25 Execution Control List Tab . 26 Users Tab. 27 Adding an Anti-Executable Administrator or Trusted User . 27 Removing an Anti-Executable Administrator or Trusted User . 28 Enabling Anti-Executable Passwords . 29 Temporary Execution Mode Tab. 30 Activating or Deactivating Temporary Execution Mode . 30 Setup Tab . 32 Setting Event Logging in Anti-Executable . 32 Monitor DLL Execution . 32 Monitor JAR Execution . 32 Anti-Executable Stealth Functionality . 33 Compatibility Options. 33 Customizing Alerts. 34 Report Tab . 35 Uninstalling Anti-Executable . 37 Uninstalling Anti-Executable Standard . 38 Anti-Executable Standard User Guide 4 | Contents Anti-Executable Standard User Guide |5 Preface Faronics Anti-Executable is a solution that ensures endpoint security by only permitting approved executables to run on a workstation or server.
[Show full text]
Elfbac: Using the Loader Format for Intent-Level Semantics and Fine-Grained Protection
ELFbac: Using the Loader Format for Intent-Level Semantics and Fine-Grained Protection Julian Bangert, Sergey Bratus, Rebecca Shapiro, Michael E. Locasto,∗ Jason Reeves, Sean W. Smith, Anna Shubina Computer Science Technical Report TR2013-727 Dartmouth College June 14, 2013 Abstract Adversaries get software to do bad things by rewriting memory and changing control flow. Current approaches to protecting against these attacks leave many exposures; for example, OS-level filesystem protection and OS/architecture support of the userspace/kernelspace distinction fail to protect corrupted userspace code from changing userspace data. In this paper we present a new approach: using the ELF/ABI sections already produced by the standard binary toolchain to define, specify, and enforce fine-grained policy within an application's address space. We experimentally show that enforcement of such policies would stop a large body of current attacks and discuss ways we could extend existing architecture to more efficiently provide such enforcement. Our approach is designed to work with existing ELF executables and the GNU build chain, but it can be extended into the compiler toolchains to support code annotations that take advantage of ELFbac enforcement|while maintaining full compatibility with the existing ELF ABI. 1 Introduction This paper presents the design and implementation of ELFbac (ELF behavior access control), a mechanism that separates different components of a program's memory space at runtime and polices their interactions to enforce the intended pattern of these interactions at the granularity compatible with the program's ABI format units such as ELF sections. Modern programs are primarily built by composing libraries, modules, classes, and objects into some cohesive whole.
[Show full text]
James Moscola Dept. of Engineering & Computer Science York College
ECE260: Fundamentals of Computer Engineering Translation of High-Level Languages James Moscola Dept. of Engineering & Computer Science York College of Pennsylvania ECE260: Fundamentals of Computer Engineering Based on Computer Organization and Design, 5th Edition by Patterson & Hennessy Translation of High-Level Languages • Writing code in assembly is time consuming and can be challenging • A single line of C code may require many lines of assembly • Example: D[4 + i] = A[5 * j] + 6; • Must manage limited register set and stack • High-level languages exist to make programming computers easier • Abstract away many of the complexities of the underlying hardware • Increase programmer productivity • Compilers exist to automate translation from a high-level language into assembly • Typically integrated with an assembler and a linker to produce executable code ECE260: Fundamentals of Computer Engineering 2 Translation and Startup of a Program • Translation and startup of a program includes the following steps: • Programmer writes some code • Compiler translates code into assembly • Assembly is converted into an object file • Linker “stitches” together object files to produce an executable file • At a later time, when the executable file is executed • A loader loads the executable instructions and data into memory ECE260: Fundamentals of Computer Engineering 3 Compiling Code • Programmer may write code in multiple files Compiler Input and Output Files INPUT FILES OUTPUT FILES • Program written in C may include many main.c ➔ main.asm prog1.c ➔ prog1.asm
[Show full text]
DESIGN and Implementanon of a WORLD WIDE
DESIGN AND IMPLEMENTAnON OF A WORLD WIDE WEB BASED DISTRIBUTED COMPUTING MODEL By WENXIAPENG Master ofArts Peking University Beijing, China 1995 Bachelor of Arts East China Normal University Shanghai, China 1988 Submitted to the Faculty ofthe Graduate College ofthe Oklahoma State University in partial fulfillment of the requirements for the Degree of MASTER OF SCIENCE December, 2000 DESIGN AND IMPLEMENTAnON OF A WORLD WIDE WEB BASED DISTRIBUTED COMPUTING MODEL Thesis Approved: --~----- _--E-..&-~~,---._ De~Graduate ~ ii ACKNOWLEDGMENTS I would like to express my sincere appreciation to my major advisor Dr. K. M. George for his intelligent supervision, constructive guidance, and encouragement through my M. S. thesis work. My sincere appreciation extends to my thesis committee members, Dr. G. E. Hedrick and Dr. Nohpill Park for their valuable assistance and encouragement. I wish to give my special appreciation to my husband, Qing Li, for his love, encouragement, and precious assistance in my study and life. I also wish to express my gratitude to my mother-in-law, Guohua Liu, for her significant support and understanding throughout the whole process. Finally, I would like to give my thanks to my darling baby girl, Grace Jiayun Li, and my precious newborn boy, Benjamin Jiayi Li, sinc they brighten my life. III TABLE OF CONTE TS Chapter Pag I. INTRODUCTION " I 1.1 Distributed Computing and Implementation Model 1 1.2 A ew Model , 3 1.3 Objectives ofThis Thesis 4 1.4 Outline ofThesis 5 II. REVIEW OF LITERATURE AND RELATED WORK 6 2.1 Review ofDistributed Systems and Distributed Computing 6 2.1.1 CORBA 8 2.1.2 Java RMI.
[Show full text]
Stealth Secrets of the Malware Ninjas
Stealth Secrets of the Malware Ninjas By Nick Harbour Overview Intro Background Info • Malware • Forensics and Incident Response • Anti-Forensics • Executables Stealth Techniques • Live System Anti-Forensics Process Camouflage Process Injection Executing Code from Memory • Offline Anti-Forensics File Hiding Trojanizing Anti-Reverse Engineering There will be something for the “Good Guys” near the end • A brand new malware scanning tool 2 Introduction This presentation will cover a variety of stealth techniques currently used by malware in the field. Many of the techniques are based on malware studied during MANDIANT’s incident experiences. 3 Introduction The purpose of this talk is to discuss malware stealth techniques other than Rootkits. The majority of the material is designed to teach the “Bad Guys” some practical real world techniques to fly beneath the radar. For the “Good Guys”, learning these malicious techniques will help prepare you to identify and counter malware threats. 4 Prerequisites There’s something for everyone! The material we will cover the range from basic computing concepts to machine code. We will primarily be discussing techniques for Windows, but Linux will also discussed at an advanced level. 5 Background Information Malware In intrusion incidents, malware is frequently found in several inter-related families of tools. Often found in redundant layers for failover or bootstrapping. Command and Control Data Collection Data Transfer Cracking/Exploitation 7 Malware In practice, stealth techniques are most often employed to protect an intruder’s command and control mechanism These often require persistence which poses a risk of discovery Command and Control is the keys to the intruder’s newly acquired kingdom 8 Forensics and Incident Response Traditional Computer Forensics involves examining the contents of computer media for evidence of a crime.
[Show full text]
Effective File Format Fuzzing
Effective file format fuzzing Thoughts, techniques and results Mateusz “j00ru” Jurczyk Black Hat Europe 2016, London PS> whoami • Project Zero @ Google • Part time developer and frequent user of the fuzzing infrastructure. • Dragon Sector CTF team vice captain. • Low-level security researcher with interest in all sorts of vulnerability research and software exploitation. • http://j00ru.vexillium.org/ • @j00ru Agenda • What constitutes real-life offensive fuzzing (techniques and mindset). • How each of the stages is typically implemented and how to improve them for maximized effectiveness. • Tips & tricks on the examples of software I’ve fuzzed during the past few years: Adobe Reader, Adobe Flash, Windows Kernel, Oracle Java, Hex-Rays IDA Pro, FreeType2, FFmpeg, pdfium, Wireshark, … Fuzzing Fuzz testing or fuzzing is a software testing technique, often automated or semi-automated, that involves providing invalid, unexpected, or random data to the inputs of a computer program. http://en.wikipedia.org/wiki/Fuzz_testing In my (and this talk’s) case • Software = commonly used programs and libraries, both open and closed-source, written in native languages (C/C++ etc.), which may be used as targets for memory corruption-style 0-day attacks. • Inputs = files of different (un)documented formats processed by the target software (e.g. websites, applets, images, videos, documents etc.). On a scheme START choose input mutate input feed to target yes no target save input crashed Easy to learn, hard to master. Key questions • How do we choose the fuzzing
[Show full text]
Ios Hacking Guide.Pdf
Hacking iOS Applications a detailed testing guide Prepared by: Dinesh Shetty, Sr. Manager - Information Security @Din3zh 2 Table of Contents 1. Setting Up iOS Pentest Lab ................................................................................................. 5 1.1 Get an iOS Device ................................................................................................................................ 5 1.2 Jailbreaking an iOS Device................................................................................................................... 7 1.3 Installing Required Software and Utilities ........................................................................................ 10 2. Acquiring iOS Binaries ...................................................................................................... 13 3. Generating iOS Binary (.IPA file) from Xcode Source Code: ............................................... 15 3.1 Method I – With A Valid Paid Developer Account. ........................................................................... 15 3.2 Method II - Without a Valid Paid Developer Account ....................................................................... 18 4. Installing iOS Binaries on Physical Devices ........................................................................ 23 4.1 Method I - Using iTunes .................................................................................................................... 23 4.2 Method II - Using Cydia Impactor ....................................................................................................
[Show full text]