Copyright Notice

Copyright © 1996 -2002 Tiny Software, Inc.
All rights reserved

The software contains proprietary information of Tiny Software, Inc.; it is provided under a license agreement containing restrictions on use and disclosure and is also protected by copyright law. Reverse engineering of the software is prohibited.

Due to continued product development this information may change without notice. The information and intellectual property contained herein is confidential between Tiny Software, Inc.. and the client and remains the exclusive property of Tiny Software, Inc.. If you find any problems in the documentation, please report them to us in writing. Tiny Software, Inc. does not warrant that this document is error-free.

No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, photocopying, recording or otherwise without the prior written permission of Tiny Software, Inc..

Microsoft Word, Microsoft Office, Windows®, Window 95™, Window 98™, Windows NT®and MS-DOS™ are trademarks of the Microsoft Corporation.

Tiny Software, Inc.
3945 Freedom Circle
Suite 1020
Santa Clara, CA 95054
USA
+1 408 919 7360
Internet E-Mail: sales@tinysoftware.com
Website: http://www.tinysoftware.com


Understanding TPF

Tiny Personal Firewall 4.0 (TPF4) is the security software that offers the combined protection against to any combination of network and application (trojans, worms) attacks undertaken through the Internet, LAN/WAN or just by inserting a floppy into the computer.

Tiny Personal Firewall 4.0 combines the protection on NDIS and TDI layers (firewall) and also installs various guards controlling the system calls of the installed applications (sandbox). In conjunction with the firewall feature TPF4 offers true signature based Intrusion Detection System.

Sandbox in General

With TPF4 you can create a closed environment (sandbox) around any application and restrict its access to your computer's resources as well as its ability to communicate to the Internet. Within this closed environment any code can run and access calls of the application to system resources. Drivers, the registry database (all configurations), and the file system are shielded and constantly monitored to protect the privacy and integrity of your system.

When installing TPF4, the program scans the workstation for already installed or known applications. In addition, it sets up a pre-configured default sandboxes around the most common Web browsers, email clients, and a restricted area for unknown. This process may take up several minutes - please be patient during the installation.

Preventing Damage BEFORE it Happens

The significant advantage of the application protection of TPF4 is that it is not signature based. TPF4 checks for the application activities and does not base its security mechanism on a comparison with a database of hostile applet references. It checks all actions and access to resources, but only suspicious or unwanted actions are blocked. Hence, it is a behavior checker, which not only protects against intended hostile attacks, but also against unintentional bugs in applications. Any other application within your user environment can run and access resources without being restricted by TPF. You can view which components are installed and running on your computer, where they came from, monitor what an application does, and which resources it accesses.

TPF4 adds a security perimeter within a Windows workstation, transparently layers it into your operating system, and integrates into existing network security solutions. With this security, TPF protects against flaws and holes within the security mechanisms of the Web browser, the Java virtual machine and the any application in the operating system.

Replacement or the Addition to Your Virus Scan Software?

TPF4 does not replace your virus scan software, it complements it. Imagine virus scan software as a doctor - it removes infected files or their portions once it KNOWS the infection. However, in todays world when the viruses are spread across the internet in a matter of minutes it would be too late most of the times and damage would already happened.

TPF4's sandbox adds the new significant layer of protection since it protects your PC BEFORE the infection is known. The sandbox stops virus or trojan which made it to your computer immediately and instantly. Essentially it buys the time for virus scan companies to identify virus and post the update for virus scan engines so the virus or trojan may be removed later on.

Standard Network Firewall

TPF4 includes bi-directional stateful packet inspection firewall which combines NDIS (network layer) and TDI (application layer) information in order to determine the rights of processes to communicate with the outside world and block all unwanted traffic.

Tiny Personal Firewall 4.0 Components

TPF4 consists of a series of executables, DLLs and kernel drivers to protect the different parts of your system. Each component fulfills a certain task, which builds a bulletproof protective wall around your system.

  • TPF4 Agent

The agent, which displays information to the user, is the interface to the TPF4 security solution. It also monitors restricted access to the system's environment and resources.

  • TPF4 kernel components

The kernel components deliver extended protection against certain low–level accesses, and protect the TPF4 runtime environment.

  • TPF4 Administrator Tool

With the Administrator Tool you can configure TPF 4.0. The Administrator Tool scans your system for installed applications and sets up default settings for the most common Web browsers and e-mail clients.

In This Section

What is Sandbox

What Can Happen Without Sandbox?

See Also

Copyright Notice

Getting Started

Configuration

Reporting


What is Sandbox

Sandbox is the security technology that protects workstations and networks against attacks from any type of active content (ActiveX, Java, VBS and other executable code) received from the Internet, email or by any other means.

What is it and how does it work?

Sandbox wraps around both known and unknown applications, and controls their access to system resources, such as memory, registry, and space on the hard drive. Therefore, unknown or unauthorized applications such as worms or Trojans, are prevented from damaging your data and system files keeping your personal computer free of harmful code.

Wrap Around the Application

With sandboxing technology you can create a closed environment (sandbox) around any application (known or unknown) and restrict its access to your computer's resources. Within this closed environment any code can run and access calls of the application to system resources. Drivers, the registry database (all configurations), and the file system are shielded and constantly monitored to protect the privacy and integrity of your system.

Proactive Security Measures

Sandboxing checks for application activities and does not base its security mechanism on a comparison with a database of hostile applet references. It checks all actions and access to resources, but only suspicious or unwanted actions are blocked. Hence, it is the first commercially available behavior checker, which not only protects against intended hostile attacks, but also against unintentionally buggy applications. You can view which components are installed and running on your computer, where they came from, monitor what an application does, and which resources it accesses.

See Also

Understanding TPF

What Can Happen Without Sandbox?


What Can Happen Without Sandbox?

If the Sandbox Agent does not protect your computer, hostile processes could access all the files and resources that are available on your computer. Your computer would be left wide open for destruction.

Recent studies and surveys have shown that most corporate networks and computers connected to the Internet have been attacked and have reported damages NOT from network based attacks which you can prevent by using traditional personal or network firewall BUT through malicious mobile code (ActiveX, Java, VBscript as well as other executables) which is increasingly being used to issue these attacks.

So - what can happen without the sandbox protection?

Deleting of files - unauthorized file access

A process deletes system or user files in the background while running on your computer. This attack can make your computer/operating system unusable and leads to loss of data and information.

Unauthorized access to services

By changing the configuration of your operating system or applications, your system/service or parts of it can become unusable or even launch the attack.

Execute malicious code or macros

A process can access data and files on your computer/network, copy and send them to any computer (e.g. to your competitors) on the Internet via e-mail or by using unrestricted IP ports.

Change registry configuration

A process can access your registry and change vital information or perhaps cause a crash of your system.

Unauthorized access to devices

A process may access your devices and cause a deletion of backup media - as an example.

Installation of unwanted/hostile application

A process could change your system configuration in order for a hostile application to be started automatically the next time you start your computer. This application could then undertake all its malicious tasks in the background or block access to particular or any resources on your computer.

Manipulation of your connection

A process could filter, manipulate or falsify information sent or received from another source.

Impersonation

A process could impersonate your user ID on the Internet or your local area network and initiate malicious, destructive or unwanted actions. It could therefore, abuse personal or sensitive information collected from your computer (e.g., credit card information).

See Also

Understanding TPF

What is Sandbox


Getting Started

In This Chapter

System Requirements

Installation

Uninstallation

Emergency Uninstallation


System Requirements

Minimum recommended hardware configuration:

  • PC with a Pentium processor
  • 15 MB hard disk space

Operating systems:

  • Windows 98
  • Windows ME
  • Windows NT 4.0 SP 3 or higher
  • Windows NT 2000
  • Windows XP

Note! To install program on Windows NT/2000/XP you need to be logged on with administrator privileges.

See Also

Getting Started

Installation

Uninstallation

Emergency Uninstallation


Installation

To install TPF 4.0 on a workstation with Windows NT/2000/XP you need to be logged in as administrator. If you do not have administrator rights to your computer please contact your network support team or the system administrator for your computer.

Installing via Electronic Software Distribution (ESD)

  • Download the program.
  • Unzip the files in some temporary directory.
  • Run the SETUP.EXE file from the Windows Start menu with the Run command or double click the file in Windows Explorer.

The installation of TPF 4.0 will then automatically unpack all necessary files and start the Setup wizard, which will guide you through the installation. If you later want to change the settings, you can do so in the Administrator Tool. Please see the section entitled Installation, for a more detailed explanation.

License Agreement: Please read the license agreement carefully. If you choose not to accept the license agreement, the installation will be terminated.

Customer Information: Your name and organization should be automatically displayed in the fields. If they are not, please add them in the appropriate fields. Please enter the serial number. If you would not enter serial number TPF4 would install in the trial mode which lasts for 30 days.

Destination Folder: The Wizard asks you to choose a directory to which TPF should be installed. If you want to use another directory than the one proposed, click Change and change it.

Setup Type: You can choose Typical or Custom setup type. If you choose the Custom, the following screen is displayed. Choose the modules you want to install.

Restart: Its necessary to restart Windows to finish the installation

See Also

Getting Started

System Requirements

Uninstallation

Emergency Uninstallation


Uninstallation

To uninstall TPF 4.0 on a computer running Windows NT/2000/XP workstation you have to be logged on as administrator:

  • Open the Windows Control Panel.
  • Click on the Add/Remove Programs symbol to open the dialogue on Windows NT/2000/XP (it is similar on other operating systems).
  • Select TPF from the list of installed programs in the dialog and click the Change or Remove button.

If you choose Remove, the TPF will be removed immediately; otherwise the Setup wizard appears.

@

Program Maintenance. With this feature you can add/remove components, repair, or remove the program. Click Remove for removing and then Next. The uninstall program will then start and will then remove all TPF files and registry entries from your system. After the uninstall program is finished, please restart the computer.

Don't forget to close other applications and Activity Monitor before uninstall

See Also

Getting Started

System Requirements

Installation

Emergency Uninstallation


Emergency Uninstallation

Whenever you would get into troubles (for whichever reason) and should you not be able to uninstall TPF4 using standard procedures here is the emergency step-by-step procedure how to "get rid of it".

In This Section

Windows 98/ME

Windows NT/2000/XP

See Also

Getting Started

System Requirements

Installation

Uninstallation


Windows 98/ME

Delete all files in the directories "\Program Files\Tiny Personal Firewall" and "\Program Files\Common Files\PFWShared".

Note! Some dll or exe files are COM modules, so the correct procedure is uninstalling them by "regsvr32 /U some.dll" before deleting.

If you cannot delete some files, please stop DSE Agent and DSE Config Interpreter Services (Control Panel->Administration tools->Services). DSE stands for Desktop Security Engine.

Delete registry key "HKLM\Software\Tiny Software\Tiny Personal Firewall" (Start -> regedit.exe) Delete registry key :

  • "HKLM\System\CurrentControlSet\Services\VxD\KmxAgent"
  • "HKLM\System\CurrentControlSet\Services\VxD\KmxFw"
  • "HKLM\System\CurrentControlSet\Services\VxD\KmxCfg"
  • "HKLM\System\CurrentControlSet\Services\VxD\KmxIds"
  • "HKLM\System\CurrentControlSet\Services\VxD\KmxSbx"

and delete files

"KmxAgent.VxD", KmxFw.VxD, KmxCfg.VxD, KmxIds.VxD and "KmxSbx.VxD" in "Windows\System" folder.

Note! Changes will be reflected until after a reboot.

Delete umx*.dll and from directory "Windows\System".

See Also

Emergency Uninstallation

Windows NT/2000/XP


Windows NT/2000/XP

Delete all files in the directories "\Program Files\Tiny Personal Firewall" and "\Program Files\Common Files\PFWShared".

Note! Some dll or exe files are COM modules, so the correct procedure is uninstalling them by "regsvr32 /U some.dll" before deleting.

If you cannot delete some files, please stop DSE Agent and DSE Config Interpreter Services (Control Panel->Administration tools->Services). DSE stands for Desktop Security Engine.

Delete registry key "HKLM\Software\Tiny Software\Tiny Personal Firewall" (Start -> regedit.exe)

Delete registry key:

  • "HKLM\System\CurrentControlSet\Services\KmxAgent"
  • "HKLM\System\CurrentControlSet\Services\KmxFw"
  • "HKLM\System\CurrentControlSet\Services\KmxCfg"
  • "HKLM\System\CurrentControlSet\Services\KmxIds"

"HKLM\System\CurrentControlSet\Services\KmxSbx"

Delete "umxexw.dll" from registry value "AppInit_DLLs" under "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows".

Note! It is possible to delete umxexw.dll only after the reboot.

Use the utility "srvinstw.exe" from Windows Resource Kit to uninstall TPF Agent service ( and drivers Umx* and Kmx* (it is needed to check the option "Include device drivers").

Note! The reboot is required to take the effect of Uninstallation.

Delete umx*.dll from the directory "Windows\System32".

Remove all remained parts from installation by MSI Cleaner utility (msicu.exe for Windows 9x/ME, msicuu.exe for NT/2000/XP).

Note! Msi installation was copied under UID name to directory "Windows\installer" by an installation.

See Also

Emergency Uninstallation

Windows 98/ME


Configuration

In This Chapter

Simple Configuration

Configuration for Advanced users


Simple Configuration

In This Section

Sandbox Settings in Easy Mode

Firewall

See Also

Configuration

Configuration for Advanced users


Sandbox Settings in Easy Mode

In This Chapter

When Do You Want To Use Easy Mode

Easy Mode - Registry

Easy Mode - Services

Easy Mode - VBA macros

Easy Mode - Miscellaneous

Easy Mode - Spawning

Easy Mode - OLE & COM


When Do You Want To Use Easy Mode

Easy Mode settings provide more simple yet effective way of setting up the Application and System security (sandbox). Unlike Advanced Settings Easy Mode settings are more broad and general. If enabled the selected application group will prefer Easy Mode settings whenever different from Advanced Mode settings. This means that you can still build Advanced Mode settings and their settings would remain in effect as long as they would not collide with Easy Mode settings.

You may decide about using Easy Mode based on following:

Pros:

  • Simplicity
  • Fast changes
  • … yet effective

Cons:

  • Less granularity
  • Certain policies unavailable

See Also

Sandbox Settings in Easy Mode

Easy Mode - Registry

Easy Mode - Services

Easy Mode - VBA macros

Easy Mode - Miscellaneous

Easy Mode - Spawning

Easy Mode - OLE & COM


Easy Mode - Registry

Microsoft Windows and most of Windows applications store their settings and configuration in Registry. Obviously, altering some portions of the registry could affect stability of the system and the applications. Certain Trojans use registry to bypass virus scan engines making the virus protection ineffective. In addition overwriting some registry settings may cause serious security vulnerability.

Protect Run Keys

Protection to overwrite Run Keys is very effective weapon against to most aggressive viruses. Run Keys are special Registry keys. In Windows 98/ME they may be misused (by viruses and Trojans) to auto start any application on or even before user's logon. In Windows NT/2000/XP aggressive virus may cause that the executable would be granted with unlimited access rights to your computer on next Administrator logon. The consequences of this may be disastrous. It is recommended to have this protection always on.

Protect Windows Settings Key

The Windows Settings Key protection eliminates the possible attack to capture user name and password during logon as well as the protection of some other important system settings (refer to reference manual for details). It is recommended to have this protection always on.

Protect Extension Association Keys

If allowed the virus or Trojan could create the association where each time you would execute .exe, .txt, .doc or any other extension based file the virus or Trojan would execute. The Extension Association Keys Protection protects exactly against to this. It is recommended to have this protection always on.

Protect Services Key

Driver or Service have unlimited access to your computer. If virus or Trojan would be allowed to add a subkey into Services Key then it could install new service or driver and severely harm the data or compromise the computer security. It is recommended to have this protection always on.

Protect Tiny Personal Firewall Key

All keys except of the keys defined in Registry section are unprotected in Easy Mode. Therefore in order to ensure that Tiny Personal Firewall Security will not be affected it is recommended to protect Tiny Personal Firewall Keys. The protection of other keys may be defined in Advanced Mode.

See Also

Sandbox Settings in Easy Mode

When Do You Want To Use Easy Mode

Easy Mode - Services

Easy Mode - VBA macros

Easy Mode - Miscellaneous

Easy Mode - Spawning

Easy Mode - OLE & COM


Easy Mode - Services

Services settings determine the protection of the computer against to hostile programs that can register themselves as a system service or stop or delete other services.

Prevent Service Installation/Removal

The Service Installation/Removal Prevention protects the computer from viruses and Trojans that would take over the system by registering as a system service.

Prevent Service Stop/Control

Standard applications should not have the need to stop or control a service. Stopping or controlling of system services could have undesirable influence on running Microsoft Windows and may significantly affect the system security. Unless there is a specific reason this setting should be always on. This setting still allow Service Start and Query actions since these are not major security threat and certain applications could require to start other services during their activity. Start/Query Service restrictions may be set in Advanced Mode.

See Also

Sandbox Settings in Easy Mode

When Do You Want To Use Easy Mode

Easy Mode - Registry

Easy Mode - VBA macros

Easy Mode - Miscellaneous

Easy Mode - Spawning

Easy Mode - OLE & COM


Easy Mode - VBA macros

MS Office documents (e.g. *.doc, *.xls) may contain some VBA macros which are often misused by various viruses received typically by email. If unprotected just by running *.doc attachment these macros could replace or delete the important files. In respect to Advanced Settings it brings no benefit to enable this protection for other applications then these dealing with MS Office since these macros can be executed only in the environment which supports them (MS Office applications).

Prevent

Running of VBA macro will be prevented

Run in Special Sandbox

VBA macro will be run is a special predefined sandbox (it will not cross predefined boundaries).

Run Without Protection

Macros will be allowed to run without the protection.

See Also

Sandbox Settings in Easy Mode

When Do You Want To Use Easy Mode

Easy Mode - Registry

Easy Mode - Services

Easy Mode - Miscellaneous

Easy Mode - Spawning

Easy Mode - OLE & COM


Easy Mode - Miscellaneous

The security policies listed in this category do not belong to other categories.

Prevent Dangerous Device Access

This setting prevents the system devices and drivers from the application of various dangerous commands such as formatting hard drive. It is recommended to have this protection always on.

Full list of protected actions:

  • Dismount volume
  • Lock volume
  • Set compression
  • Unlock volume
  • Disk eject media
  • Disk format tracks
  • Disk load media
  • Disk media removal
  • Disk reassign blocks
  • Disk set drive layout
  • Disk set partition info
  • Disk verify
  • Serial lsrmst insert

Prevent Low Level API (PLLAPI)

Each Windows application interfaces with the operating system through an Application Programming Interface (Win32 API). Some portions of this API are intended for use by operating system only and not by regular applications. Prevent Low Level API function protects these portions of API:

If PLLAPI is enabled following functions are blocked:

  • AdjustTokenPrivileges
  • SetFileSecurity
  • SetKernelObjectSecurity
  • SetServiceObjectSecurity
  • SetSecurityInfo
  • SetNamedSecurityInfo
  • SetUserObjectSecurity
  • CreateProcessAsUser
  • CreateProcessWithLogonW
  • SHCreateProcessAsUserW

If PLLAPI is enabled System low-level access is prevented and the function wants

to work in other process than in the caller process

  • WriteProcessMemory
  • CreateRemoteThread
  • VirtualAllocEx
  • VirtualProtectEx

See Also

Sandbox Settings in Easy Mode

When Do You Want To Use Easy Mode

Easy Mode - Registry

Easy Mode - Services

Easy Mode - VBA macros

Easy Mode - Spawning

Easy Mode - OLE & COM


Easy Mode - Spawning

Malicious Trojan or virus may misuse known and trusted applications to damage the data or make the computer vulnerable to the attack. As an example through the command line instruction a Trojan may instruct command interpreter (cmd.exe) to delete certain or all files. However some applications require spawning (engage other processes to run) in order to run.

Prevent Application Spawning

If selected it prevents applications from selected application group from running based on spawning request.

See Also

Sandbox Settings in Easy Mode

When Do You Want To Use Easy Mode

Easy Mode - Registry

Easy Mode - Services

Easy Mode - VBA macros

Easy Mode - Miscellaneous

Easy Mode - OLE & COM


Easy Mode - OLE & COM

The applications often communicate together via OLE/COM interface. Even an application on the remote computer may be started and controlled using OLE/COM. You can prevent selected application group from being controlled by OLE/COM here. ActiveX or other in-process COM usage will not be affected by this rule. Since ActiveX is running in the same process boundaries as the application it would use the application's sandbox.

Prevent Activation of out-of-process COM Servers

If enabled the selected application group will not allow remote control of itself by external application through COM.

See Also

Sandbox Settings in Easy Mode

When Do You Want To Use Easy Mode

Easy Mode - Registry

Easy Mode - Services

Easy Mode - VBA macros

Easy Mode - Miscellaneous

Easy Mode - Spawning


Firewall

In general there are not many occasions when it would be necessary to build the custom rules. After the installation of Tiny Personal Firewall all applications are treated as unknown and their first activity will pop up Ask User dialog where you can specify whether the application will be allowed to communicate or not.

TPF4 brings along the list of the most common applications including the system applications which are preconfigured.

In This Section

Firewall FAQs

See Also

Simple Configuration

Sandbox Settings in Easy Mode


Firewall FAQs

How to limit access on certain port for all applications?

  • Create the profile called "common".
  • Put there the rules as desired
  • Assign this profile to each application group.

Then, whenever you would change the rule in the "common" profile it would be automatically applied to all groups and applications.

What is 'Closed' or 'Unopened' port?

There may be a network communication coming to your computer on a specific port, which is not served by any running application on your computer at that point. That's when TPF4 reports the communication on closed port. You can set up how to handle such network communication in System Applications profile.

TPF4 is dropping packets coming on closed port by default. A very good example of the management of communication on closed port is ICS (Internet Connection Sharing).

Note! You can delete all predefined profiles except of System Application Profile!

How to handle ICS?

ICS (Internet Connection Sharing) may be very well secured using TPF4. When using ICS you need to set up the rules allowing the communication on 'Closed Port' since the packets are passing TPF4 computer to other destinations and therefore they are not destined to any application in your computer.

When ICS is in place TPF4 experiences the network communication coming to it but it does not see any application listening (ready to receive) such communication. Normally TPF4 would drop such communication but it would not do any good to ICS. In order for TPF4 not to drop such communication you need to set up the rule allowing the communication on closed port for all protocols.

In order to do that go to the System Applications Profile, edit all incoming rules and change the value for 'Closed' port from prevent to allow.

What is the security impact of 'Closed' port?

You do not have to worry about the security issue since you allowed communication on 'closed' ports only. Network communication on 'opened' ports (ports served by running applications) is secured by other rules in place. The effect of allowing the communication on 'closed' port may be expressed by say "there is nothing answering if there is nothing listening". Therefore the potentials hacker would have no luck even when you allow the communication on these 'closed' ports.

How to build custom rules?

  • You need to create the firewall object or use existing predefined object
  • Create the profile using new rules or edit/add rules in existing profile
  • Make sure you assign the profile to correct application group

Note! One profile may be assigned to multiple application groups!

See Also

Firewall


Configuration for Advanced users

In This Section

General Guidelines

Sandbox Settings in Advanced Mode

Firewall Policies

IDS Policies

Using CFGPUSH.EXE utility

See Also

Configuration

Simple Configuration


General Guidelines

How to create generic definitions (applications, files, folders)

In This Section

Application groups

Resolved and Unresolved Format

Symbolic path definitions

See Also

Configuration for Advanced users

Sandbox Settings in Advanced Mode

Firewall Policies

IDS Policies

Using CFGPUSH.EXE utility


Application groups

All security profiles are applied towards the application groups. The application group must include at least one process - application.

You can define the applications within the application group by absolute or relative paths. The relative path is used only when you define UNRESOLVED configuration database using the Configuration Editor. In all other cases the applications should be defined using absolute paths.

One application may be a member of several groups simultaneously. The rules are applied in the order defined. If there is an application activity it would be processed through defined application groups from top to bottom.

One application group may have multiple profiles assigned. In general the rules in upper profile take precedence over the rules in a lower profile.

See Also

General Guidelines

Resolved and Unresolved Format

Symbolic path definitions


Resolved and Unresolved Format

Note! You need to read this part only if you are using paths to define the applications. If you are using MD5 definitions only you can skip this part

Files and Folders objects may be defined using absolute path or the relative path to desired files locations. Furthermore, once relative path definition would be used it could be stored on a local computer in resolved format of in unresolved format.

Resolved Format

Resolved format means that after the profile (rule) is delivered to the computer the relative paths would be resolved to absolute paths and the firewall on a local computer would further use the definition using absolute path.

Unresolved Format

To keep the definitions in unresolved format means that after the profile (rule) would be delivered to the computer the relative paths would be resolved everytime the rule would be in place to reflect the actual environment. This has its positive and negative implications.

Pros:

- if you have defined network application using network shares and the application would be moved you do not have to modify the rule

- if you dynamically add application and have summary definition as "all applications in Program Files folder" you do not have to update rules everytime you would add new application

Cons:

- slight performance penalty in case that you would have 'hundreds' of applications defined in one symbolic definition. Definition like "all apps on C:\ drive" is not recommended

- if you would have trusted applications defined as "everything in C:\trusted" and somehow (even though unlikely) some malicious process would be copied to it then it would be considered as trusted and potentially cause harm

Keep Resolved or Keep Unresolved? (Applications only)

When defining applications you can specify should the application definition be stored in resolved format or should it be kept in unresolved format. Once you define that the application definition should be resolved during the profile implementation then the profile would become resolved and you cannot simply take it out of one computer and put to another without careful consideration. The since the applications may be installed in different folders!

Note! The file and folders definitions always stay in unresolved format. Only application definitions have the selector to choose whether they should be stored in resolved format or not.

See Also

General Guidelines

Application groups

Symbolic path definitions


Symbolic path definitions

You can define symbolic paths leading to files, folders or applications using following guidelines:

There are a lot of variables, which can be used to specify local or network discs, system directory or the temp directory. Please look into table below for more information about the path variables.

There are two very useful variables to handle the application assignment to a group. Instead of adding an explicit specified executable (e.g. myapp.exe) you can use two variables:

  • %AllExecutablesInDir% - finds all executables in the directory
  • %AllExecutablesInSubTree%. - finds all executables in the directory and all subdirectories

Examples of their use include:

\\someserver\PublicApplications\%AllExecutablesInSubTree%
C:\SomeApp\%AllExecutablesInDir%

%SystemRoot%\%AllExecutablesInDir%.

The table of used special commands / characters:

Name | Description | Note
%CdRoms% | CD ROM drive |
%RemovableDrives% | Floppy disks |
%Temp% | Directory recognized by OS as Temp directory. Typically C:\Temp |
%SystemRoot% | C:\WinNT or C:\Windows or whichever windows installation directory used on target machine |
%SystemDrive% | System drive, disk drive which contains the Window’s directory |
%FixedDrives% | Local hard discs letters |
%LanDisks% | All mapped network drives |
%RecycleBin% | Recycle Bin |
%PathFromShortcut% | Get path to file from its shortcut | Internally
%FreeAccessible% | Path to TPF free accessible folder. | Not used
%Confidential% | Path to TPF confidential folder. | Not used
%UserSpecific% | Path taken from the registry | Internally
%DirOnKeyValue% %DirOnSubKeyValue% %DirOnKeyEnumValue% | These variables are automatically used in a dialog window. Used for getting path from registry | Internally
%Root% | Used to cutting the last n sub folders | Internally
%AllExecutablesInDir% %AllExecutablesInSubTree% | Add executable files in chosen directory or in directory and all its subdirectories |

Note: You can combine %DirOnSubKeyValue% with other relative paths leading to folders on target computer.

"\\" - is used everytime when you use relative reference to the value in given folder/destination (in other words - "give me whatever is there").

"\\\" - is used when you define absolute value - typically using the registry or relative paths (as defined above) you get the location of the folder and within this folder you specify using "\\\" the absolute value of consequent subfolders and/or the name of the file.

Example 1:

%DirOnSubKeyValue%\CURRENT_USER\Identities\\Software\Microsoft\Outlook Express\5.0\\Store Root

How to read Example 1:

The object is the value of 'Store Root' located in key 'Software\Microsoft\Outlook Express\5.0' which is located in unnamed subkey of 'HKEY_CURRENT_USER\Identities'.

Example 2:

%UserSpecific%\Application Data\\\Microsoft\Internet Explorer

How to read Example 2:

The object is the folder 'Internet Explorer', which is defined as subfolder of the folder 'Microsoft' which is located in the folder 'C:\Documents and Settings\<user logged on>\Application Data'

See Also

General Guidelines

Application groups

Resolved and Unresolved Format


Sandbox Settings in Advanced Mode

In This Chapter

Configuration philosophy

Sanbox Objects

Sandbox Profiles

Assigning Sandbox Profiles to Application Groups


Configuration philosophy

No matter how difficult the Advanced Sandbox Configuration may seem you may find it simple and versatile at the end. The Advanced Sandbox Configuration recognizes three steps:

  1. Sandbox Object Definition

    Sandbox object is the basic building block of the Advanced Sandbox Configuration. The sandbox object may be File(s) or Folder(s), Registry entry, Service definition, Device definition, OLE/COM object, VBA macro, Process spawning rule or some miscellaneous object.

    Example: Define the object TEST as the folder c:\test.
  2. Create the profile
    Name the profile and select which guards shall be active within this particular profile (read more about guards). Apart from active guards, the profile is defined by the set of rules applied on a various object types that represent particular security setting (sandbox or part of the sandbox). Each rule consists of sandbox object and relevant access rights. Use predefined Sandbox Object(s), assign it with the access rights and create the rule(s).

    Example: Specify that there is NO access to folder c:\test. Name this profile as NO_TEST
  3. Assign the profile to the Application Group

    Example: Windows Explorer group (which includes application explorer.exe) will be assigned with NO_TEST profile created above. The result - c:\test folder will disappear from Windows Explorer because this process will not have the access rights to it.

See Also

Sandbox Settings in Advanced Mode

Sanbox Objects

Sandbox Profiles

Assigning Sandbox Profiles to Application Groups


Sanbox Objects

Sandbox Objects are the basic "building blocks" of sandbox profiles. Sandbox Object is the description of the elementary unit of the computer environment. Our Sandbox technology recognizes 8 types of sandbox objects:

  • Files
  • Registry
  • Services
  • Devices
  • OLE/COM
  • VBA macros
  • Process Spawning
  • Miscellaneous

Each sandbox object type has its specific purpose. Click on each Object type in Configuration Editor to get the list of available objects and to define the new objects within the category.

To edit existing object double click on selected object or click the icon "Edit".

To add the new object click on the icon for adding new objects "Add".

To delete existing object click on the icon "Delete".

When adding or editing sandbox objects you will see 'Object Details' screen. The screen has the same look for all types of sandbox objects. Within the dialog you define following values:

Object name - may be any combination of characters

Object description - short description

Platform - you can define object applicable to only selected operating system. Rule using such object will be applied only when target machine operating system would match this selection.

Object Definition - depends on the type of defined sandbox object:

In This Section

Files and Folders

Registry

Services

Devices

OLE/COM

VBA macros

Process Spawning

Miscellaneous

See Also

Sandbox Settings in Advanced Mode

Configuration philosophy

Sandbox Profiles

Assigning Sandbox Profiles to Application Groups


Files and Folders

Whenever you create a security profile which shall be used on different computers you should prefer to use generic definitions with symbolic pointers to the locations of desired applications.

Use following guidelines to define the application using symbolic definition:

Example:

You can define MS Word as:

%DirOnSubKeyValue%\MACHINE\Software\Microsoft\Office\\Common\InstallRoot\\Path\\\winword.exe

Read it as: winword.exe located in the value of Path located in the subkey Common\InstallRoot which is the subkey of HKEY_LOCAL_MACHINE\Software\Microsoft\Office

See Also

Sanbox Objects

Registry

Services

Devices

OLE/COM

VBA macros

Process Spawning

Miscellaneous


Registry

Registry objects are defined by their absolute path in the registry. By setting up Registry objects and determining the access rights of specific processes to them you may further increase the security inside of your computer. Monitoring of registry access by certain processes may bring you information important for follow up analysis.

To add Registry object click on the "Add new" icon and enter appropriate details. Refer to Sandbox Objects chapter for more information about general and common values.

To enter the registry path use following name syntax:

CONFIG = HKEY_CURRENT_CONFIG

CURRENT_USER = HKEY_CURRENT_USERS

CLASSES_ROOT = HKEY_CLASSES_ROOT

MACHINE = HKEY_LOCAL_MACHINE

USERS = HKEY_USERS

Use following examples when defining the registry objects:

Example 1 - Trust Providers\SW Publ key for user currently logged in

CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing

Example 2 - definition of application path of Internet Explorer

MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\IEXPLORE.EXE

See Also

Sanbox Objects

Files and Folders

Services

Devices

OLE/COM

VBA macros

Process Spawning

Miscellaneous


Services

Services provide the important tasks of operating system. Therefore the ordinary applications shall have limited and controlled access to them, particularly if the applications are not authorized or recognized by sandbox engine.

Even though you can define service object for particular service using its name, in general it is usually sufficient to allow/prevent access to them using general object (all services). That means the application group either has or has not the right to access the services as a whole.

You can define access rights of specific applications to services through Services objects. When you define the Services object you may use it when building the rules and determine the access of application groups to it.

The Services objects may define several levels of access:

The seven service access alternatives are:

  • Query service status
  • Start service
  • Stop service
  • Remove service
  • Open service
  • Install service
  • Control service

It is very important to control access to all levels, especially install service, in order to prevent trojans to install unwanted processes. Recent Klez worm was a very good example of the service controlling trojan horse. Klez worm installed a system service that was unstoppable from regular Services Control Applet. Therefore the only way how to remove Klez was to reboot in safe mode and use Virus removal tool to clean up infected executables.

See Also

Sanbox Objects

Files and Folders

Registry

Devices

OLE/COM

VBA macros

Process Spawning

Miscellaneous


Devices

Similar to services access as defined in Services Object chapter you can manage the access of specific applications and processes to system devices.

This setting prevents the system devices and drivers from the executing of various dangerous commands such as formatting hard drive.

Full list of protected actions:

  • Dismount volume
  • Lock volume
  • Set compression
  • Unlock volume
  • Disk eject media
  • Disk format tracks
  • Disk load media
  • Disk media removal
  • Disk reassign blocks
  • Disk set drive layout
  • Disk set partition info
  • Disk verify
  • Serial lsrmst insert

Prevent Low Level API (PLLAPI)

Each Windows application interfaces with the operating system through an Application Programming Interface (Win32 API). Some portions of this API are intended for use by operating system only and not by regular applications. Prevent Low Level API function protects these portions of API:

If PLLAPI is enabled following functions are blocked:

  • AdjustTokenPrivileges
  • SetFileSecurity
  • SetKernelObjectSecurity
  • SetServiceObjectSecurity
  • SetSecurityInfo
  • SetNamedSecurityInfo
  • SetUserObjectSecurity
  • CreateProcessAsUser
  • CreateProcessWithLogonW
  • SHCreateProcessAsUserW

If PLLAPI is enabled System low-level access is prevented and the function wants

to work in other process than in the caller process

  • WriteProcessMemory
  • CreateRemoteThread
  • VirtualAllocEx
  • VirtualProtectEx

See Also

Sanbox Objects

Files and Folders

Registry

Services

OLE/COM

VBA macros

Process Spawning

Miscellaneous


OLE/COM

OLE (object linking and embedding), formerly developed for cooperation of applications when creating documents, has later on been extended to a complete system - COM. The Component Object Model (COM) is a technology that combines the benefits of object-oriented programming with binary reuse, language independence, version-ability, self-registration, and ease of licensing. However, since the COM technology covers such topics as ActiveX, inter process communications and distributed COM, it could also be very dangerous if misused. Sandbox can control the COM usage by a particular application with the following access rights:

  • COM Initialization
  • Create in-process servers
  • Create local servers
  • Create remote servers

See Also

Sanbox Objects

Files and Folders

Registry

Services

Devices

VBA macros

Process Spawning

Miscellaneous


VBA macros

The Visual Basic VBA5 and VBA6 macro security is provided.

Choose the application group and set some options.

You can select if run, do not run or ask user about permission for VBA macros.

For a higher level of protection, you can force the VB and JS sandbox to be used while the macro is running. Otherwise the original sandbox (e.g. MS Office) will be used.

Note! The information about switching an application to another sandbox can be seen in the activity window

Automatic macros, used in the background are invisible for a user. For example by creating or opening a new document some hidden macro can be run. These VBA macros are very dangerous and thus you can treat them separately.

Note! The MS Office 97 and MS Office 2000 are supported. Macro protection for the MS Office 95 and MS Access is not supported.

See Also

Sanbox Objects

Files and Folders

Registry

Services

Devices

OLE/COM

Process Spawning

Miscellaneous


Process Spawning

Spawning means that the spawned application inherits the security environment of the application that invokes the spawned application. For Example: In Outlook (the spawning app), you may receive an email with a word document. If you choose to open the attachment file, the outlook will call the Microsoft Word program and send it the attachment document. The Microsoft Word is then spawned application.

For every application group you can specify the spawning mode (allow, monitor, ask user and prevent – see Access possibilities (on page )) and the sandbox type (parent or own). If you choose parent sandbox, the spawned application will inherit the security environment of the parent process. The own sandbox results in using the application's own security settings. The later is similar to a situation where the application is started by a user and not from another process. You can change the status by a right-click on the group name and select your four alternatives in the pop up menu. For every application group you can specify the spawning mode.

Default process means other application groups than these included in the list (e.g. application groups added in the future).

Note! By default, some groups have disabled the changing of spawning properties. You can permit it in the Execution Settings (on page ) but recommend keeping the default setting. Changes to the access rights can lead to potential problems with the applications you are restricting. An application will not run if it is too restricted!

See Also

Sanbox Objects

Files and Folders

Registry

Services

Devices

OLE/COM

VBA macros

Miscellaneous


Miscellaneous

The miscellaneous access rights are set up in a similar manner to the access rights for services. Select Miscellaneous in the middle pane for the Administrator Tool to display the selected application group's access rights in the pane on the right.

Seven access types are available for the selected application groups. To change a setting for an access type, right click and select the required action on the pop-up menu. When the access type is displayed in gray it is turned off and cannot be altered. To turn it on please go to the Execution Settings (on page ) in the Edit Menu and switch the appropriate feature on.

Action | Activity
Allow | All access will be granted
Monitor | All access requested of this type will be monitored
Ask User | The user will be asked before granting or blocking access
Prevent | All access requests will be automatically blocked and monitored.

In addition to the six access types you can also set a memory and a Windows number limit.

System shutdown

When this option is set, no system shutdown requests will be allowed to the selected application

System low level access

When this option is set, a number of unusual application requests are not allowed from the selected application.

The following functions are blocked every time, if system low level access is prevented:

  • AdjustTokenPrivileges
  • SetFileSecurity
  • SetKernelObjectSecurity
  • SetServiceObjectSecurity
  • SetSecurityInfo
  • SetNamedSecurityInfo
  • SetUserObjectSecurity
  • CreateProcessAsUser
  • CreateProcessWithLogonW
  • SHCreateProcessAsUserW

The following function calls are blocked should they target different then current process:

  • WriteProcessMemory
  • CreateRemoteThread
  • VirtualAllocEx
  • VirtualProtectEx

Dangerous device access

When this option is set, access rights requests, (e.g. reformat hard drive) are not allowed from the selected application.

Following device accesses are blocked:

  • Dismount volume
  • Lock volume
  • Set compression
  • Unlock volume
  • Disk eject media
  • Disk format tracks
  • Disk load media
  • Disk media removal
  • Disk reassign blocks
  • Disk set drive layout
  • Disk set partition info
  • Disk verify
  • Serial lsrmst insert

Clipboard access

This option can prevent an application to copy data into or paste from the clipboard

Simulate Keystrokes

This option can prevent an application from simulating keystrokes, and thereby causing destructive actions on the computer.

Forced process / thread termination

With this option is enabled all thread and process manipulation of the selected application group is restricted in accordance with the set policy.

Memory limit

With this number you can limit the amount of memory the selected application can allocate for its use. The number you enter here is the number of bytes that the particular application will be allowed to allocate before TPF will reject further requests for memory allocation from the program in question.

Limiting the amount of memory an application is allowed to use can protect against various denial of service attacks.

Window number limit

With this security option, you can limit the number of windows the selected application can open. The number you enter is the number of windows or controls, which the application will be allowed to open before TPF will reject further requests to open new windows from the program.

Limiting the number of windows an application is allowed to open will protect a program against various denials of service attacks.

Activating of changes / settings

Memory and Windows quotas become active after the application in question is restarted.

See Also

Sanbox Objects

Files and Folders

Registry

Services

Devices

OLE/COM

VBA macros

Process Spawning


Sandbox Profiles

You can build sandbox rules and group them into profiles in Sandbox Profiles view. Each application group may be assigned with different combination of sandbox rules.

Sandbox Profiles dialog has two major parts:

  • Profile list
  • Rule list

Profile list

In Profile List you can define the names of profiles. When you will create new profile you will see eight different sandbox settings available to define:

  • Files
  • Registry
  • Services
  • Devices
  • OLE/COM
  • VBA macros
  • Process spawning
  • Miscellaneous

Rule list

For each selected sandbox setting type you will see the list of defined rules and you will be able to create the new rules. All rules are sorted by their importance from top to bottom. You can change their position by clicking the arrow in the Rules list tool bar.

In This Section

Guards

File Rules

Registry Rules

Services Rules

Devices Rules

OLE/COM Rules

VBA Macros Rules

Process Spawning Rules

Miscellaneous Settings Rules

See Also

Sandbox Settings in Advanced Mode

Configuration philosophy

Sanbox Objects

Assigning Sandbox Profiles to Application Groups


Guards

Sandbox guards are essential sandbox security building blocks. Each guard manages access to certain resources for each defined application group.

For each application group, it is possible to enable guards or leave guards disabled (e.g for performance reasons).

There are several types of guards:

  • Registry guard – guards access to registry information
  • File guard - guards access to file system
  • Process spawning guard – guards the application spawned (called) by other application
  • TCP/IP guard – guards the TCP/IP ports and IP addresses.
  • Dangerous device access guard – guards the items below written
    • Dismount volume
    • Lock volume
    • Set compression
    • Unlock volume
    • Disk eject media
    • Disk format tracks
    • Disk load media
    • Disk media removal
    • Disk reassign blocks
    • Disk set drive layout
    • Disk set partition info
    • Disk verify
    • Serial lsrmst insert
  • Checksum guard – protects executables from replacement. The replaced file can have the same name, but TPF will still recognize that it is not the original one. If you have this feature turned on (by default it is disabled), please be aware that it will enforce some restrictions – e.g. TPF may block the installation of a service pack or update of some software. If you update the guarded file, please recalculate the checksum (see section Applications Groups (on page )). Otherwise the application will be treated as unknown and therefore high-restricted and an alert message will be displayed.
  • VBA macro guard
  • OLE/COM guard
  • Services guard
  • System low level guard
  • Shutdown guard
  • Windows messages guard
  • Clipboard guard
  • Window limit guard
  • Memory limit guard
  • SMB guard
  • Net Special guard
  • Cookie guard
  • ActiveX and Java guard
  • E-mail content filtering guard
  • Process termination guard

See Also

Sandbox Profiles

File Rules

Registry Rules

Services Rules

Devices Rules

OLE/COM Rules

VBA Macros Rules

Process Spawning Rules

Miscellaneous Settings Rules


File Rules

To add Files rule to selected profile select Files in the available list of sandbox rules, then click the "Add Rule" button and fill in the following dialog:

  1. Sandbox Object - click on Change button and select from predefined sandbox objects the object that you want to use.
  2. In Access description portion of the dialog specify actions / accesses that the selected application group will be allowed to do. You can also select the reporting level related to these activities. For File access you can grant selected application group with following privileges:
    • Append data - appending data to file or adding a file into directory
    • Delete
    • Delete child - delete subdirectory
    • Execute
    • File execute - if sandbox object is a file this is self descriptive, if the sandbox object is a directory File Execute means the ability to execute files in such directory
    • Full access
    • Read
    • Read Attributes
    • Read control
    • Read extended attributes
    • Read file data - if the sandbox object is a directory Read File Data means the ability to list the directory
    • Read only access
    • Synchronize - harmless, allows access for synchronization objects (e.g. for opening the files twice for reading)
    • Write
    • Write attributes
    • Write DAC
    • Write extended attributes
    • Write file data - essential for creating directory or rewriting file data
    • Write owner

      • For each available access option you can select access/deny and also appropriate level of reporting.

See Also

Sandbox Profiles

Guards

Registry Rules

Services Rules

Devices Rules

OLE/COM Rules

VBA Macros Rules

Process Spawning Rules

Miscellaneous Settings Rules


Registry Rules

To add Registry rule to selected profile select Registry in the list of available sandbox rules, then click on "Add New Rule" button and fill in the following dialog:

Sandbox Object

Click on Change button and select from predefined Registry objects the object that you want to use.

Access description

Define what activities / actions will be allowed to be performed with this object. The available actions are:

  • Create link
  • Create Subkey
  • Delete
  • Enumerate subkey
  • Full access
  • Notify - enable sending notifications about changes of key data
  • Query value
  • Read
  • Read control
  • Read - only access
  • Set value
  • Write
  • Write DAC
  • Write owner

You can define several activities to be applied for one object. For each activity you can set up custom level of reporting.

See Also

Sandbox Profiles

Guards

File Rules

Services Rules

Devices Rules

OLE/COM Rules

VBA Macros Rules

Process Spawning Rules

Miscellaneous Settings Rules


Services Rules

To add Services rule to selected profile select Services in the list of available sandbox rules, then click on "Add New Rule" button and fill in the following dialog:

Sandbox Object

Click on Change button and select from predefined Services objects the object that you want to use.

Access description

Specify what activities / actions will be allowed to be performed with this object. The available actions are:

  • Control service => control messages could be sent to service
  • Full Access
  • Install service => also valid for drivers installation/removal
  • Open service => handle to service can be opened
  • Query Service Status => service can be queried for status
  • Read only access
  • Remove service => also valid for drivers installation/removal
  • Start service => service can be started
  • Stop service

See Also

Sandbox Profiles

Guards

File Rules

Registry Rules

Devices Rules

OLE/COM Rules

VBA Macros Rules

Process Spawning Rules

Miscellaneous Settings Rules


Devices Rules

To add Devices rule to selected profile select Devices in the list of available sandbox rules, then click on "Add New Rule" button and fill in the following dialog:

Sandbox Object

Click on Change button and select from predefined Devices objects the object that you want to use.

Access description

Specify what activities / actions will be allowed to be performed with this object. The available actions are:

  • Open device

See Also

Sandbox Profiles

Guards

File Rules

Registry Rules

Services Rules

OLE/COM Rules

VBA Macros Rules

Process Spawning Rules

Miscellaneous Settings Rules


OLE/COM Rules

To add COM/OLE rule to selected profile select Services in the list of available sandbox rules, then click on "Add New Rule" button and fill in the following dialog:

Sandbox Object

Click on Change button and select from predefined OLE/COM objects the object that you want to use.

Access description

Define what activities / actions will be allowed to be performed with this object. The available actions are:

  • COM Initialization => cannot use ActiveX and other COM objects (automation, etc.) at all
  • Create in-process servers => COM objects can be created only in the process boundaries (e.g. ActiveX), thus process security applies on them
  • Create local servers => separate COM executables can be started or accessed from an application
  • Create remote servers => the same as local servers but in addition on remote computers
  • Full Access

See Also

Sandbox Profiles

Guards

File Rules

Registry Rules

Services Rules

Devices Rules

VBA Macros Rules

Process Spawning Rules

Miscellaneous Settings Rules


VBA Macros Rules

To add VBA macros rule to selected profile select VBA macros in the list of available sandbox rules, then click on "Add New Rule" button and fill in the following dialog:

Sandbox Object

Click on Change button and select from predefined VBA macros objects the object that you want to use.

Access description

Define what activities / actions will be allowed to be performed with this object. The available actions are:

  • Run standard macros in alternative sandbox
  • Run automatic macros in alternative sandbox
  • Run standard macros in original sandbox
  • Run automatic macros in original sandbox

See Also

Sandbox Profiles

Guards

File Rules

Registry Rules

Services Rules

Devices Rules

OLE/COM Rules

Process Spawning Rules

Miscellaneous Settings Rules


Process Spawning Rules

To add Process spawning rule to selected profile select Process spawning in the list of available sandbox rules, then click on "Add New Rule" button and fill in the following dialog:

Sandbox Object

Click on Change button and select from predefined Process spawning objects the object that you want to use.

Access description

Define what activities / actions will be allowed to be performed with this object. The available actions are:

  • Process spawning
  • Force process/thread termination
  • Use own sandbox

Note! Currently it is not possible to create your own Process spawning Sandbox objects. You must use Process spawning Sandbox objects which already predefined.

See Also

Sandbox Profiles

Guards

File Rules

Registry Rules

Services Rules

Devices Rules

OLE/COM Rules

VBA Macros Rules

Miscellaneous Settings Rules


Miscellaneous Settings Rules

See Also

Sandbox Profiles

Guards

File Rules

Registry Rules

Services Rules

Devices Rules

OLE/COM Rules

VBA Macros Rules

Process Spawning Rules


Assigning Sandbox Profiles to Application Groups

After you define Sandbox objects and create Sandbox profiles you can assign them to various Application Groups. Application Group is the basic building block in terms of the Profile assignment and it must include at least one application - process.

In order to assign the rule to the application group you must switch the view to 'Application Groups' in your Configuration Editor:

Application groups view has three major panes:

Application groups

In this pane you can define the the names of the application groups. There are no restrictions on the names.

Application list

When you define the name for the application group you must assign the application(s) to it. One application group must include one or more applications.

See 'Application Groups' topic for the guidelines on how to create the application groups.

Profile Assignment

Once the Application Group is defined and once it has actual applications defined you can assign this Application Group with the profile. When you click on Add New icon you will see the list of available predefined profiles to select from.

See Also

Sandbox Settings in Advanced Mode

Configuration philosophy

Sanbox Objects

Sandbox Profiles


Firewall Policies

Firewall policies determine the communication rights of the processes inside of the computer. At present the Firewall policies manage the communication over TCP/IP.

The basic philosophy behind the Firewall in CMDS is that all processes are denied the communication rights unless explicitly allowed. Also it is not possible to create generic rules allowing the access to unknown processes on specific ports - all rules must be assigned to specific processes or applications.

The logic in creating Firewall policies follows up the logic in creating the Sandbox Policies. There are three basic building blocks:

  • Firewall Objects - define the protocol, ports, direction
  • Firewall Profiles - assign Firewall Objects with specific IP addresses and reporting level
  • Firewall Profiles Assignment - assign Firewall Profiles to Application Groups

In This Section

Firewall Configuration Philosophy

Firewall Objects

Firewall Profiles

Assigning Firewall Profiles to Application Groups

See Also

Configuration for Advanced users

General Guidelines

Sandbox Settings in Advanced Mode

IDS Policies

Using CFGPUSH.EXE utility


Firewall Configuration Philosophy

Firewall follows the logic in the creating firewall rules similar to what Sandbox Module has. Firewall configuration recognizes three steps:

  1. Object definition

    Define protocol, direction and port. This will save you the time when you would need to reuse the same definition again.

    Example: TCP protocol, incoming direction, local port any, remote port 80. This definition will suit any browser. Name it as MY WEB SERVER
  2. Create profile

    Create the profile name. Use predefined Firewall Objects, assign them with the access rights (IP address, time interval, reporting level) and group them together into the profile.

    Example: Use MY WEB SERVER object and specify that it should allow the access from your LAN. Name the profile as ON MY LAN.
  3. Assign the profile to the application group

    Example: Assign the application group WEB SERVER (which includes application iis.exe) with the profile ON MY LAN. The result - only users from your LAN will be able to access your web server.

See Also

Firewall Policies

Firewall Objects

Firewall Profiles

Assigning Firewall Profiles to Application Groups


Firewall Objects

Firewall Objects are the basic building blocks of Firewall Rules.There are two types of Firewall Objects:

  • Protocols and Ports
  • IP addresses and their groups

See Also

Firewall Policies

Firewall Configuration Philosophy

Firewall Profiles

Assigning Firewall Profiles to Application Groups


Firewall Profiles

Once Firewall Objects were defined you can build Firewall Rules and group them into Firewall Policies.

Firewall Policies dialog has two major parts:

  • List of Profiles
  • List of Rules (within the selected profile)

The execution settings pane only shows whether the firewall policy shall be enabled or disabled. To follow up the logic of Sandbox Rules (various guards) the firewall component in DSE has name TCP/IP guard.

The 'Rule list' pane shows the list of available rules within selected Firewall Policy. Besides each rule you can see its short summary. Following symbols are used in short summary:

NA - Network Access

0 - Audit Level Ignore

1 - Audit Level Monitor

2 - Audit Level Alert

NAOCP - Network Access on Closed Port

"+" - Access Allowed

"?" - Access Ask User

"-" - Access Prevented

To build the new rule click on "Add New" button and fill in the dialog:

Internet object

When you click the Change button you will be able to select the Firewall (Internet) object from the list of predefined Firewall objects. The lower part of this section will display its summary.

IP addresses

You can define all IP addresses as the part of this rule set or choose from pre-defined firewall IP addresses objects.

Access Description

Network Access - This choice will determine if the packet meeting the criteria should be passed through the firewall or denied.

Network Access on Closed port - This choice will appear only within the rules for System Applications. This option tells the system what to do if there is a packet arriving on a local port where is no listening application awaiting the packets.

Audit Level

There are three levels of reporting - no reporting, monitoring and alert. Alert would pop-up a warning message on a user's workstation.

See Also

Firewall Policies

Firewall Configuration Philosophy

Firewall Objects

Assigning Firewall Profiles to Application Groups


Assigning Firewall Profiles to Application Groups

After you define Firewall objects and create Firewall Policies you can assign them to various Application Groups. Application Group is the basic building block in terms of the Profile assignment and it must include at least one application. Currently the monitored applications are executables.

In order to assign the rule to the application group you must switch the view to 'Application Groups' in your Configuration Editor:

Application groups view has three major panes:

Application groups

In this pane you can define the the names of the application groups. There are no restrictions on the names.

Application list

When you define the name for the application group you must assign the application(s) to it. One application group must include one or more applications.

You can define the applications within the application group by absolute or relative paths. The relative path uses the syntax similar to the syntax used in the Files Sandbox Objects definitions.

Example:

You can define MS Word as:

%DirOnSubKeyValue%\MACHINE\Software\Microsoft\Office\\Common\InstallRoot\\Path\\\winword.exe

Read it as: winword.exe located in the value of Path located in the subkey Common\InstallRoot which is the subkey of HKEY_LOCAL_MACHINE\Software\Microsoft\Office

Profile Assignment

Once the Application Group is defined and once it has actual applications defined you can assign this Application Group with the profile. When you click on Add New icon you will see the list of available predefined profiles to select from.

Note! At present it is possible to assign only one profile at a time.

See Also

Firewall Policies

Firewall Configuration Philosophy

Firewall Objects

Firewall Profiles


IDS Policies

The firewall's IDS driver and engine supports the SNORT based format of Intrusion Detection Rules. SNORT is an open standard intrusion detection technology. For more information about SNORT please visit www.snort.org.

The firewall's IDS engine is signature based - it process the content of the packets coming through the firewall engine and if there is a rule matching the packet content or behavior it reports an event.

You can create Intrusion Detection Profiles using provided IDS builder tool. You must meet following requirements:

  • Configuration Editor or TPF4 installed
  • IDSdb folder present - includes empty IDS profile database
  • Import folder present - includes the IDS configuration builder utility (snortimp.exe)
  • Snort folder present - includes Snort rules and definition files

The folders mentioned above are the part of the download or distribution files.

In This Section

Building IDS Rules

Building IDS Policies

Applying IDS Policy

See Also

Configuration for Advanced users

General Guidelines

Sandbox Settings in Advanced Mode

Firewall Policies

Using CFGPUSH.EXE utility


Building IDS Rules

Setting Network Variables

You must change the following variables to reflect your local network. You can specify it explicitly as: var HOME_NET 10.1.1.0/24 or use “any”.You can specify lists of IP addresses for HOME_NET by separating the IPs with commas like this: var HOME_NET [10.1.1.0/24,192.168.1.0/24].

MAKE SURE YOU DON'T PLACE ANY SPACES IN YOUR LIST!

The default value for HOME_NET is:

var HOME_NET any

Set up the external network addresses as well. A good start may be "any"

var EXTERNAL_NET any

Set up your SMTP, web, sql and DNS servers, or simply configure them to HOME_NET:

var SMTP $HOME_NET
var HTTP_SERVERS $HOME_NET
var SQL_SERVERS $HOME_NET
var DNS_SERVERS $HOME_NET

You need not to use SMTP, web, sql and DNS server rules if there aren’t appropriate servers installed on client computers, since these rules are targeted for attacks to them and are meaningful only for IDS implementations on an internet gateway.

Customize your rule set

Up to date snort rules are available at http://www.snort.org. The snort web site has documentation about how to write your own custom snort rules.

The rules included with default IDS blackbox generate alerts based on suspicious activity. Depending on your network environment, your security policies, and what you consider to be suspicious, some of these rules may either generate false positives ore may be detecting activity you consider to be acceptable; therefore, you are encouraged to comment out rules that are not applicable in your environment.

Note that using all of the rules at the same time may lead to performance decrease on slower machines.

Shell code, policy, info, backdoor, and virus rule sets should be disabled by default. These require tuning and maintenance. For example, the shell code rules require detailed inspection of each packet thus increasing the requirements for the computer computing power.

The following rule set files are included by default:

bad-traffic.rules
exploit.rules
scan.rules
finger.rules
ftp.rules
telnet.rules
smtp.rules
rpc.rules
rservices.rules
dos.rules
ddos.rules
dns.rules
tftp.rules
web-cgi.rules
web-coldfusion.rules
web-iis.rules
web-frontpage.rules
web-misc.rules
web-attacks.rules
sql.rules
x11.rules
icmp.rules
netbios.rules
misc.rules
attack-responses.rules
backdoor.rules
shell code.rules
policy.rules
porn.rules
info.rules
icmp-info.rules
virus.rules
local.rules

We recommend to comment out (using #) all unnecessary rule sets at the end of snort.conf file before building the SNORT configuration blackbox to avoid false positives and increase performance. Please see appropriate *.rules file for further detailed description about particular rule set.

Creating or Modifying Single SNORT Rules

Example:

alert tcp $HOME_NET 23 -> $EXTERNAL_NET any (msg:"TELNET root login"; content:"login\: root"; flags: A+; class type:suspicious-login; sid:719; rev:2;)

The above rule issues monitoring (here named alert) of any attempt that telnet application on DSE client computer (local port 23) sends packet with TCP ack bit set (flags:A+) and there is the string "login\: root" contained in the packet. “sid” is the unique id of this IDS rule – you must take care about that in your own rules, otherwise an error during building IDS blackbox will be issued. "TELNET root login" will be the message to be seen in the event reporting. “classtype” and “rev” fields are ignored. Please see for further details how to write single SNORT rules.

Rule Options Details

1) COMMENTS
syntax:
#comment to end of line

2) PREPROCESSOR
syntax:
preprocessor name[:options]

- defines plug-in running between packet decoding and detection engine
- ignored!

3) INCLUDE

syntax:
include [path\]file_name

- includes given file

4) VARIABLES
syntax:
var name value

- defines variable "name" and sets it to given value

$name, $(name) replaces with the variable content
$(name:-default) if variable is undefined replaces with "default"
$(name:?message) if variable is undefined prints out the "message" and exits

5) CONFIG
syntax:
config directive[:value]

- ignored, but "classification" directive temporarily

6) RULETYPE
syntax:
ruletype action { ... }

- defines user action
- ignored!

7) RULES
syntax:
action protocol Src_Address Src_Port -> Dst_Address Dst_Port [options]
action protocol Dst_Address Dst_Port <- Src_Address Src_Port [options]
action protocol Address_1 Port_1 <> Address_2 Port_2 [options]

actions:

alert, log, pass ignored!
activate alerts and turns on given dynamic rules
dynamic alerts only if was activated by activate rule

protocol:

ip, tcp, udp, icmp IP protocols
gre, ipx, arp, igrp, etc. temporaly ignored!
ospf, rip, etc. ignored!

addresses:

any all IP addresses
192.168.1.0/24 IP address with mask 255.255.255.0
!192.168.1.0/24 all IP addresses excluding 192.168.1.0/24
[192.168.1.0/24,10.1.1.0/24] list of IP addresses
![192.168.1.0/24,10.1.1.0/24] all IP address excluding given list

port numbers:

any all port numbers
5190 port number 5190
!5190 all port numbers excluding 5190
:5190 all port numbers equal to or less than 5190
!:5190 all port numbers greather than 5190
5190: all port numbers equal to or greater than 5190
!5190: all port numbers less than 5190
5180:5190 all port numbers from given range 5180...5190
!5180:5190 all port numbers excluding given range

8) RULE OPTIONS
syntax:
(opt_1[:val_1];opt_2[:val_2]; ... opt_N[:val_N];)

sid:number

- SNORT rule id
- throw warning if not present

msg:"message"

- prints given message in case of alert

ttl:[>|<]number

- checks IP time-to-live value

tos:[>|<]number

- checks IP type-of-service value

id:[>|<]number

- checks IP id field

ipopts:ipopt
ipoption:ipopt

- checks presence of given IP option in packet
- ipopt can be one of:

rr record route
eol end of list
nop no operation
ts time stamp
sec security option
lsrr loose source routing
ssrr strict source routing
satid stream id

fragbits:[!][R][D][M][+|*]

- checks fragmentation control bits in IP packet

! negation
R "reserved" bit is set
D "don't fragment" bit is set
M "more fragments" bit is set
+ all specified bits must be set
* any of the specified bits must be set

ip_proto:[!]name|number

- checks protocol number in IP packet

sameip

- checks if source IP is equal to the destination IP

dsize:[>|<]number

- checks packet payload size

content:[!]"content_string"
uricontent:[!]"content_string"

- finds given string in payload or URI portion of request
- rule can content multiple "content" options

! negation

- special characters in content_string:
: ???
| assigns begins and ends of hexadecimal coded parts of string

offset:number

- modifies starting content search position from the beginning of packet payload

depth:number

- modifies length of the scanned payload region

nocase

- deactivates case-sensitivity in a content rule

regex

- turns on wildcards resolving in content string
* any number of characters
? any single character

flags:[!]<[F][S][R][P][A][U][2][1]>|0[+|*]

- checks TCP packet flags

! negation
F fin bit is set
S syn bit is set
R rst bit is set
P push bit is set
A ack bit is set
U urgent bit is set
1 reserved bit 1 bit is set
2 reserved bit 2 bit is set
0 no flags are set
+ all specified bits must be set
* any of the specified bits must be set

seq:[>|<]number

- checks TCP sequence number

ack:[>|<]number

- checks TCP acknowledge number

itype:[>|<]number

- checks ICMP type number

icode:[>|<]number

- checks ICMP code number

icmp_id:[>|<]number

- checks ICMP ECHO identifier

icmp_seq:[>|<]number

- checks ICMP ECHO sequence number

rpc:[>|<]app_num,[proc_num|*],[ver_num|*]

- looks at RPC requests, decodes and checks the application, procedure and program version
* wildcard

temporaly ignored options:

content-list:[!]"file_name"
classtype:name
priority:number

ignored options:

logto:"file_name"
session:[printable|all]
resp:resp_1[,resp_2 ...]
react:react_1[,react_2 ...]
reference:id_system,id
rev:number
tag:type,count,metric[,direction]
stateless

See Also

IDS Policies

Building IDS Policies

Applying IDS Policy


Building IDS Policies

In order to use IDS builder you have the following folders available:

IDSdb - includes empty IDS profile database

Import - includes the IDS configuration builder utility (snortimp.exe)

Snort - includes Snort rules and definition files

How to build IDS profiles.

1. Select IDS rules

In snort.conf (Snort builder) define which rules will be included in your profiles. You may edit rules in files as you wish - provided you do not change their format. Some basic description of the SNORT rules syntax and its support in CMDS/DSE you can find in the SNORT.txt file

2. Run IDS builder

Go to Import folder and run IDS builder tool. The Configuration Editor must be installed on the computer to successfully run the IDS builder tool. You must specify:

i. The location of snort.conf

ii. The location of IDS profile database file - select the "db-main-ids.xml" file from IDSdb folder. You must have in the same directory as db-main-ids.xml also db-def-ids.xml,db-des-ids.xml, db-res-ids.xml and db-rul-ids.xml files.

NOTE! IDS builder does not clean up UNUSED rules. For now we recommend to clean up .xml files using the clean.bat utility in IDSdb directory before creating new .cab profile.

Proceed with import. You must read the snort.conf for further understanding about values used.

3. Output

Once ready, the XML database will be updated in the IDSdb folder. This XML db will be used in the future for a further GUI IDS editing. However - at present - please use a side product of the import - file "ids_cfg.dat" as a configuration file to put into the CMDS as an IDS profile and assign it to a particular policy.

See Also

IDS Policies

Building IDS Rules

Applying IDS Policy


Applying IDS Policy

Once you create IDS policy you must apply it to TPF4 firewall engine using provided cfgpush.exe utility.

  1. In command prompt get in the the folder with cfgpush.exe
  2. type in cfgpush [full_path]ids_cfg.dat 16

where number 16 is an ID of the IDS module.

You can get cfgpush.exe utility from www.tinysoftware.com.

See Also

IDS Policies

Building IDS Rules

Building IDS Policies


Using CFGPUSH.EXE utility

CFGPUSH.EXE utility allows for the update of the configuration database of the firewall engine. To use it you should get into the directory with cfgpush.exe and type in:

cfgpush [full_path]file_name [ID_of_firewall_module]

where:

Module | File Name | ID
Sandbox | *.cab | 1
Firewall | *.cab | 2
Virus Scan | *.dat | 4
IDS | *.dat | 16

See Also

Configuration for Advanced users

General Guidelines

Sandbox Settings in Advanced Mode

Firewall Policies

IDS Policies


Reporting

In This Chapter

Activity Monitor

Log Analyser


Activity Monitor

Activity Monitor displays important information based on TPF4's engine activity. It includes two panes - Activity and Connections.

Activity pane displays the information - records the events - that actually happened and - based on the settings - should have been monitored. Each event has time stamp and the information which process caused it.

Connections pane shows the live connections including the information (in case of TCP) which process started the connection (inbound/outbound). Firewall pane also shows processes listening on a specific ports, i.e. ready for the communication.

More about Activity pane

During the active session the TPF activity pane displays the following information:

  • The actions undertaken by TPF
  • The application which is requesting the accesses
  • The type of access
  • The object accessed (if applicable)
  • The time of the access

A right-click in the Activity panel would displays a pop-up menu with the "Clear Window" option. This will remove all monitored events from the Activity Window.

There are four types of actions:

Label | Action
Monitored | Action occurred
Prevented | Action was blocked
System information | Program Information
Interactive – granted | Action was permitted by user

Window options

Click the Preferences button to open Activity Monitor preferences.

  • History: maximum number of lines (events) featured. If this value is exceeded all events are cleared
  • Merge back lookup

Merge threshold: time limit for counting of same events. If this limit is exceeded next event is showed on new line.

See Also

Reporting

Log Analyser


Log Analyser

Every event matching the criteria is recorded and stored in XML log file. You can access the log information using provided Log Analyzer utility accessible through your web browser. Log Analyser is accessible through the shortcut in your TPF4 program group.

See Also

Reporting

Activity Monitor