Understanding Tiny Personal Firewall

In This Chapter

How Trojans Work

Tiny Personal Firewall 5 Summary

Rules per Process per User

Administrator vs. User Defined Rules

Applications in TPF5

Network Security

System (Windows) Security

Intrusion Detection and Prevention

Admin tool

Activity monitor


How Trojans Work

Today's security challenges are mainly related to preventing Trojans and Worms from infiltrating the computer and causing various damages on it including the theft of data . There are several stages for hackers to exploit your computer.

1. Get to the target computer and inject the malicious code

This is the most difficult part for the hacker. There are few examples of the exploits (with the comments on protection):

  • RPC service buffer overflow (MSBlast) => sending special packets to port 135 forces RPC service to execute some payload (= code) of the packets.

TPF prevents incoming communication on port 135 for interfaces in Dangerous zone by default.

  • Outlook Express & Outlook MIME exploit => sending special html email forces automatically execute attached exe.

Upgrade your MSIE to version 5.5 with service pack 2 or upgrade to MSIE 6.

  • could use other exploits of MS applications bugs (IIS, IE, OE….)
  • VBA macro in MS office documents (requires user to open the document)
  • email attachment (exe, vbs, js… - requires user to open the attachment).

TPF5 protects against to malicious behavior of email attachments by its Windows Security engine. There are few basic advices on TPF settings: Don't put unknown executables into Trusted application group and make sure that your Windows Security rules for all(*) applications prevent the access to your sensitive files. Also make sure that the default registry rules are present. You should not have wscript.exe as a scripting host process in Trusted applications (.vbs and .js scripts runs inside of wscript.exe process boundaries).

  • web page active content (requires user to visit the web page and sometimes also to confirm the active code download).

We recommend to have Internet Explorer outside Trusted applications group. This way Windows Security 'all(*)' rules for the ActiveX-es running inside Internet Explorer process will be applied.

  • modifying content of known binary file such as winword.exe (this is classical old fashioned virus) e.g. on a common network share.

You can prevent write file access to executables in the Program Files directory from unknown applications. Write access prevention to the Windows directory is preset in the default TPF policy.

  • boot sectors of floppy disks or other removable media is old fashioned yet successful approach (the code automatically executes when the drive is mounted).

TPF5 prevents against to insertion of such code by blocking access of the worm to internal media.

2. Let the injected code "install" the trojan itself

Usually the injected code has only one opportunity to execute (email won't be opened again, user will not run the .exe or visit the particular web page again etc.). Therefore the code (worm) must establish a way of how to start again. The worm copies itself into some location, usually within Windows subtree (c:\windows etc.), and creates some unsuspiciously looking name for itself (e.g. Microsoft known program names such as iis.exe or dllhost.exe - the latter one is in different dir to avoid problems in overwriting the original file).

To maintain the future start the worm executes some of the following scenarios:

  • use Run keys to autostart on next logon.

TPF prevents writing to this key by default.

  • installs as a service or (rarely) as a driver (either via API or directly writing into registry).

TPF prevents installation of services/drivers for unknown applications by default.

  • using other keys to autostart in some occasions (e.g. exefile).

TPF prevents writing to such keys (known) by default.

  • copies itself into Start Menu\Programs\Startup folder
  • replaces .jpg (or other) files with xxxx.jpg.exe (the last extension is hidden in explorer by default) thus waiting till user opens some picture.
  • one JScript virus has used ActiveX control with the CLSID "06290BD5-48AA-11D2-8432- 006008C3FBFC" to get control over files.

OLE/COM guard can be used to prevent access to particular ActiveX-es or file rules should be tightened (for Internet Explorer).

3. Fulfill the purpose for which the trojan was created

When the trojan is 'all set' it may start to fulfill the purpose for which it was created. We list some of notoriously known activities:

  • causes SYN flood attack to achieve DoS (denial of services) on particular server

TPF5 is proof to DoS attacks

  • other forms of DoS IP based attack to remote computer
  • delete the files

TPF5 prevents the data loss by protecting the access to the file system

  • destroy the system (via registry access or other means)

TPF5 protects the system resources

  • steal data
  • try to get user password or credentials for further attack to another, more important server in the company. It can do this e.g. by installing hooking dll to monitor keystrokes. useful especially for credit card info and user login names and passwords. The passwords and sensitive information may be retrieved from cached files as well.
  • open backdoor IP port for direct remote control

TPF5 does not allow unauthorized processes to communicate

4. Spread itself further

The most efficient way of spreading itself further is to use Outlook or Outlook Express address book and send email to all entries via SMTP server configured for OE or Outlook. Trojan may retrieve these settings from HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Account Manager\Accounts or display fake error dialog with prompt to user to enter the values. Naturally there are other ways for worm to spread:

  • via email from address book (the emails to new target appears as from the real user - Love Letter), usually spoofing the From: address
    get to network shared drives to possibly attract other users (usually uses some names of known apps to attract users)

TPF5 may block the access to address books for applications other then Outlook or Outlook Express or others

  • modifies settings of KaZaa or IRC (in registry - HKCU\Software\Kazaa\LocalContent) to be available via their file sharing.

TPF5 allows to apply selective protection of registry

The list of possible exploits is endless. The truth is that more complicated the environment is (operating system) more holes may be exploited. At the end the environment was created by humans and humans always fail. Otherwise they would not be humans.

At the end we can see that all computer protection is about is the protection of the resources. And this is where TPF5 excels and where its users have the control in their fingertips.

See Also

Understanding Tiny Personal Firewall

Tiny Personal Firewall 5 Summary

Rules per Process per User

Administrator vs. User Defined Rules

Applications in TPF5

Network Security

System (Windows) Security

Intrusion Detection and Prevention

Admin tool

Activity monitor


Tiny Personal Firewall 5 Summary

Tiny Personal Firewall 5 allows for the total protection of the computer resources including:

  • Network Interface(s)
  • Files and Folders
  • Registry
  • Applications
  • Applications behavior
  • Devices

As such TPF5 is the only firewall fully protecting against to hackers, malicious worms, trojans, email content and other forms of the computer intrusion and data theft.

Protection Guards

In order to protect against to all this threat TPF5 combines several security guards into one compact product. These guards are:

  • Network Protection (stateful packet inspection bi-directional network firewall)
  • Network Intrusion Detection and Prevention (packets and streams scanning and interception)
  • Windows Security - the complete set of guards for the control of:
    • File access
    • Registry access
    • Application start and spawning
    • COM objects (inner program interfaces)
    • Devices access
    • Services
    • VBA macro

This complete set of guards allows for the total protection of personal computer no matter where the computer is and who is logged on. The administrator of the computer may set up rules and then leave the computer to users knowing that the security of the data could not be compromised.

The rules Driven Engine

The computer resources (network communication, files, registry, devices etc.) are protected by TPF5's engine through the set of rules. The rule may be applicable to all applications (or their groups) running under all or specific user accounts or to specific applications (or their groups) running under all or specific user accounts.

Known Applications Repository

In order for application to participate in the rule it must be known to TPF5. TPF5 organizes known applications in the Application Repository. The applications may be grouped into groups.

Only known applications or their groups may be assigned with specific rules. For all unknown applications which do not exist in the application repository will apply rules which were assigned to 'ALL' applications.

Note: the default settings of TPF5 define that when unknown application would start the user would be getting the prompt - ask user dialog - where he could create the record of such application and assign it to group(s). To disable this prompt go to Options in Windows Security.

Rule Processing Logic

  • Whenever TPF5 finds out about the activity matching any rule it inspects whether the application which caused the event exists in the application repository. If the application exists TPF5 processes the rule including asking user if the activity shall be permitted or not. If the application does not exist TPF5 intercepts the application and asks user for the action: to kill the application, to run it once (including install mode) or to enroll it to application repository so that its behavior could be driven by TPF5's rules.

Tiny Personal Firewall 5 fully supports simultaneous multi-user environment such as Windows XP or Windows 2000 and Windows 2003 Servers. Multiple users may be assigned with different rules for the same applications when logged in simultaneously.

Central Management

The optional central management server allows for distribution of the policies and the collection of the events from/to one central place. The policies may be assigned to users based on various combination of memberships in the security groups.

System Requirements

  • Windows 2000 SP3+ (Pro, Server, Advanced Server, Datacenter)
  • Windows XP Home, Pro
  • Windows 2003 Server, Advanced Server, Web Edition

See Also

Understanding Tiny Personal Firewall

How Trojans Work

Rules per Process per User

Administrator vs. User Defined Rules

Applications in TPF5

Network Security

System (Windows) Security

Intrusion Detection and Prevention

Admin tool

Activity monitor


Rules per Process per User

It is the process against to which TPF5 protects the computer resources. Even the network attack must result in the process activity otherwise there would be no reason to do the attack. Either the network activity invokes the unauthorized behavior of the existing process on the computer or there is a worm to be imported onto the computer to cause a damage or theft.

The exceptions apply though - there are the types of the network attack which do not target the particular computer resources and rather target the infrastructure as such. An example of such attack is a popular Denial of Services attack which aim is to flood the process with so much activity that it would cause its failure.

Accounts

All processes present on the computer are running under some account when active. The best demonstration of this is the task manager. Press Ctrl+Alt+Delete, choose Task Manager and then click on Processes tab. You will see the list of active processes and under which account they are running at that time on your computer.

User Account Processes

Usually these are the applications which were installed to be run by users interactively. MS Word application run by user John is a different process from the very same MS Word executable run by user Mary - at the same time. TPF5 can assign different privileges to MS Word for Mary and John and apply these at the same time.

System Account Processes

Usually these are the applications which were installed to be run as a service. Even though the service may run under user account most of the services are designed to run under system account. File sharing and other key services are run under system account as an example. It is very important to keep in mind that most of the time it is not possible to distinguish which user's physical activity invoked behavior of which system service. Therefore you should be planning the rules for system services as the rules common to all users logged on the particular computer.

The assignment

In the assignment field the rule may be assigned to all or specific users. This assignment has different application based on the type of the rule:

Assignment of System Rule

System rule is a rule where you chose the system application in the application field. You could choose specific or all application running under the system account. The assignment in case of the System Rule will result that the rule will be valid for system processes when the specific user would be logged on the computer.

Assignment of User Rule

User rule is a rule where you have chosen the application(s) running under the user account in the application field. You could choose specific or all applications running under user accounts. The assignment of the User Rule will result that the rule would apply to selected application(s) running under specified Account(s).

Note: The application may be running under certain user account even when such user would not be physically present on the computer. A good example of this is a Switch User option in Windows XP. Another example is that you could right click on the executable and choose 'Run As...' option which would allow you to start the process under account different from the one you are logged on.

See Also

Understanding Tiny Personal Firewall

How Trojans Work

Tiny Personal Firewall 5 Summary

Administrator vs. User Defined Rules

Applications in TPF5

Network Security

System (Windows) Security

Intrusion Detection and Prevention

Admin tool

Activity monitor


Administrator vs. User Defined Rules

TPF 5.0 combines two levels of rules:

  • Administrator defined (Common Rules)
  • User defined (User Rules)

These two layers of configuration run across all components of TPF5 including Application Repository, Network Security and Windows Security. IDS and IPS have the configuration common for all users of the computer.

Administrator can create common rules which would apply to all users on the computer. These rules could either support users or restrict users. High Priority Common Rules always overrules user defined rules. Low Priority Common Rules may be overruled by User defined rules. Users do not have access to Administrator defined rules (Common Rules).

Using this philosophy the administrator has the opportunity to provide more flexibility to users with higher level of trust and restrict users with lower level of trust.

Users always create their rules with medium priority. This gives administrators the opportunity to either support users with the set of basic rules leaving them the final responsibility or restrict users and prevent them from accessing whichever resources the administrators deemed important.

Remember! User cannot change Administrator defined rules!

When operating the firewall users may be presented with the Ask User dialogs which might create the rules interactively. If the user is privileged (he has administrative rights) he could choose to enroll the new rule and application into the Common Rules or Repository. This would result that these rules and application would apply to all users on the computer.


Applications in TPF5

The applications play vital role in the TPF5 design. The known applications are being organized in the Application Repository.

The general idea behind the Application Repository is that only applications which exist in the Application Repository may be assigned with the rules. All other applications which do not exist in the Application Repository are treated as "unknown' applications and only general rules effective for 'All' applications may be applied to them.

Note! Refer to the Assignment topic in the 'Understanding Tiny Personal Firewall' chapter for vital information about the applications in TPF5!

Once the application would be enrolled in the application repository it could be used in the rules.

Note! It is recommended to group applications into the application groups in order to assign them with the group policies thus simplifying the configuration. At the enrollment of the new application the user could avoid many additional dialogs asking whether to permit specific access for the particular application if he would assign the application to group right away

When the unknown application starts it is being recognized as the unknown application and the user is presented with the dialog (this must be enabled in the configuration (Files and Folders -> Options). At this point the user can decide whether he wants to enroll the application into the Application Repository and whether he wants to put the application into some of the Application Groups.

Note! Only the applications which would be run repetitively are recommended to be entered into the application repository. It is recommended to use 'Run Once' option for applications which you don't know whether you will want to run them again or which you do not trust completely.

Default Policy

By default TPF5 comes with one predefined group called TRUSTED. This name of the group is used in rules to set liberal access to the network and computer resources. Most users will do with the default group. For users which need to group the applications more granularly there are following guidelines.

Effective Group Policies

In general the user could do with fairly simple group policy. All trusted applications could be put into Trusted group and the Trusted group could get unlimited access to computer resources either by general rules or by applying the Exceptions on such group.

More advanced users could create more sophisticated group policies thus protecting themselves against to more sophisticated attacks.

Grouping by Type

One view to look at the possible grouping of application is to create one application group for network communication, one for file access, one for application spawning etc. Then, since one application can be the member of multiple groups, it is possible to select one set of applications as trusted for network access, another set of applications trusted to access system files, another set of applications trusted to access important documents, another group being allowed to start other processes etc.

Example:

Kazaa may be member of:
- unrestricted communication group (it is P2P, it's got to communicate on random local ports and all ip addresses)
- very restricted file access group (you don't want Kazaa to send you stuff right? So you will allow Kazaa to touch music files only plus whatever system it needs).

Now - when you say - OK, I trust Kazaa, I move it do different group with less restricted file access you don't want to deal with its network configuration, right?

You can imagine that "application group" would be rather called "resource group". Then you assign applications to groups 'access to Docs and Settings', 'run as a server on ports less then 1000', 'access to Run keys' etc. It would be up to the complexity of your environment to create higher or lower number of groups.


Network Security

TPF5's network firewall is a combination of stateful filtering on NDIS and TDI layers - in simple terms the firewall ties specific network activity to specific applications.

The all new TPF5's technology allows to create the rules for specific applications running under specific accounts and apply them simultaneously on the Windows 2000, Windows 2000 Server, Windows XP Home and Pro and Windows 2003 Server computers.

TPF5's firewall allows to differentiate between the network traffic coming through specific network interfaces and apply different rules based on which interface is used.

TPF5 can make the computer completely stealthed and invisible from the Internet.


System (Windows) Security

The Windows Security engine protects the computer resources against unwanted and suspicious accesses and changes using following guards:

File Access Guard

By accessing the file system, a hostile process could gains access to all your data and files. TPF can restrict access of various applications running under different user accounts to the file system. Imagine a non-privileged user running his instance of MS Word with limited access while administrator user on the same computer running the same MS Word at the same time would have unrestricted access to it.

Registry Guard

The windows operating system saves the system and application configurations within the registry database. If a hostile process changes settings within the registry database, it might leave applications or your entire system unusable or create a security hole at least. By changing the registry database, a hostile application can also gain unwanted access to resources on your computer.

Process Spawning Guard

With Process Spawning Guard you could define whether particular process could be started by some other process or by the user only. You could also define whether the new application would run in the security context of the parent application or its own. This can prevent misuse of trusted applications by a hostile code.

Services Control Guard

TPF monitors all access to system services issued from restricted applications. By changing the settings of particular services (stopping or accessing certain services), a hostile process can make your computer unusable or gain unwanted access to resources and data.

Device Access Guard

Manages which system devices could be accessed by specified or unspecified processes. Imagine offering access to floppy drive only to certain applications for backup purposes.

OLE/COM Guard

Certain functional interfaces of the system or applications installed on the computer are intended for the internal use only or for special applications use only. There is no reason for these resources to be used by the third applications under normal circumstances. OLE/COM guard protects these vital resources and experienced administrators have very detailed opportunity to configure it.

VBA Macro Guard

Malicious code may be executed during the opening of the MS Office document using the Automatic Macro. TPF5 protects against to such threat by controlling the automatic macro procedures.

Check for unknown processes

All processes starting on the computer are inspected by TPF5's Windows Security engine and compared with the records of known applications in the Application Repository. If the process does not have the record in the application repository the user may be shown the dialog with the choices to run application once, enroll it permanently into Application Repository or terminate it. Thus user is having complete control over the processes running on his computer.

See Also

Understanding Tiny Personal Firewall

How Trojans Work

Tiny Personal Firewall 5 Summary

Rules per Process per User

Administrator vs. User Defined Rules

Applications in TPF5

Network Security

Intrusion Detection and Prevention

Admin tool

Activity monitor


Intrusion Detection and Prevention

TPF5 offers two ways of dealing with vulnerabilities embedded into the network communication packets:

  • Intrusion Detection (Monitoring - IDS)
  • Intrusion Prevention (IPS)

IPS (Intrusion Prevention System) and IDS (Intrusion Detection System) are vital for advanced grade information about the potential network threats and attacks.

See Also

Understanding Tiny Personal Firewall

How Trojans Work

Tiny Personal Firewall 5 Summary

Rules per Process per User

Administrator vs. User Defined Rules

Applications in TPF5

Network Security

System (Windows) Security

Admin tool

Activity monitor


Admin tool

Admin tool allows to manage TPF and view its logs. You can edit default rules, rules created as a results of Ask user dialogs or create your own rules. You can set up more or less restricted security policy for your computer.

Admin Tool is a separate application fully independent on the firewall engine. You could choose not to install Admin Tool when using TPF5 with the central management.

Common Admin Tool parts:

  1. Tiny Personal Firewall logo – click on it opens up www.tinysoftware.com (http://www.tinysoftware.com/forum) in the default browser.
  2. Build number – shows important information about build number. Always mention the build number when contacting technical support .
  3. Save changes button – always press this button after the changes in admintool (e.g. changing a rule).
  4. User combo displays the list of users. Selecting All option will show all rules. Selecting the user would filter the rules and display rules only valid for particular user.
  5. View combo further filters out the rules to be displayed:

    All objects –     shows both objects from User and Common database, as well as Learning mode Objects.
    Client Objects –     shows objects from User database (Client rules) only.
    Common     Object – shows Common Objects (High and Low Priority) only.
    High Priority Common     Objects
    Low Priority Common     Objects
    Learning Mode Objects –     shows rules created in Learning mode only.

See Also

Understanding Tiny Personal Firewall

How Trojans Work

Tiny Personal Firewall 5 Summary

Rules per Process per User

Administrator vs. User Defined Rules

Applications in TPF5

Network Security

System (Windows) Security

Intrusion Detection and Prevention

Activity monitor


Activity monitor

Activity Monitor displays important information based on TPF5's engine activity. It includes three panels - Activity, Connections and Processes.

Activity Panel

Activity Panel displays the information - records the events - which actually happened and - based on the settings - should have been monitored. Each event has time stamp and the information which process caused it.

During the active session the TPF activity panel displays the following information:

  • The actions undertaken by TPF
  • The application which is requesting the accesses
  • Module
  • The type of access
  • The object accessed (if applicable)
  • The time of the access

A right-click in the Activity panel would display a pop-up menu with the "Copy Rule" and the "Clear Window" option. This will remove all monitored events from the Activity Window. "Copy Rule" will copy selected rule in the text format.

There are three types of actions:

Monitored

Prevented

System information

Connection Panel

Connections panel shows the live connections including the information which process started the connection (inbound/outbound). Firewall panel also shows processes listening on specific ports, i.e. ready for the communication.

Processes panel shows the processes running on the computer, their membership in the security groups and the information what security guards were applied to them.

Columns description:

Process – which process started the communication

Protocol – usually TCP or UDP

Local port – port on your computer

Status

Listening - port is open and waits for communication

Closed - communication on the port finished

Inbound - connection was started from remote computer (the row is red)

Outbound - connection was started from your computer (the row is blue)

Remote IP address

Remote port

Interface – which interface (e.g. Ethernet card, Wi-Fi card) is used for the communication

Time

Activity Monitor Window Options

Click the Preferences button to open Activity Monitor preferences.

History - maximum number of lines (events) featured. If this value is exceeded all events are cleared

Merge back lookup

Merge threshold - time limit for counting of same events. If this limit is exceeded next event is showed on new line.

Launch Activity Monitor Automatically – Activity Monitor window starts automatically.

To find the record

Click the Find button to open find dialog. You can use ctrl + f shortcut as well. This will find a rule matching the query.

Columns Preferences

Click the Columns button to open Activity Monitor columns preferences.

Choose the columns you want to make visible and choose column order.


Setting Up Tiny Personal Firewall

In This Chapter

Application repository

Network Security

Intrusion Detection and Prevention

Windows Security


Application repository

In This Chapter

Known Applications

Enrolling the Application - Interactive Enrollment

Enrolling the Application - Manual Enrollment

Enrolling the Application - for Integrity Check


Known Applications

You can view the known applications under the Application panel. The panel displays both Applications and their groups.

There are two basic categories of the application groups:

  • System groups (group applications running under the system account).
  • User Groups (group applications running under the user account).

Several rules apply:

  1. One application may be member of several groups at the same time. The same application may be enrolled in both System and User groups.
  2. All unknown applications running under SYSTEM account are automatically put into $KnownSystemApps group.

$KnownSystemApps group has unlimited access to all the system resources by default. You can guard them only if you enable Guard system processes checkbox in Windows Security options tab and ticked the appropriate guards in Exception panel. You cannot delete $KnownSystemApps group.

Trusted group has inbound/outbound TCP/UDP access for/from all the IP addresses and ports allowed and can spawn everything. You can delete Trusted groups.

Application(s) has been enrolled; let's go back to the main panel by pressing Back to the list of Applications button.

Editing application entries

1. Click on the entry you want to change

2. Click Edit button, new panel will appear.

3. Make changes

4. Press Save & exit button

Removing application entries

1. Click on entry you want to delete

2. Press Remove button, confirmation dialog will appear

Filter

You can select what should be displayed in Known applications tab in order to match certain criteria by means of Filter dialog window.

1. Click on Filter button, dialog will appear:

2. Select the parameters (name, group etc.), press OK 3. Only matching entries are displayed in Known Applications panel now.

4. To disable the filter, click on filter button again and check "Any …" checkboxes or fill in '*' for all the parameters and press OK.

Example:
Let us say that we're looking for all the applications from $KnownSystemApps group, identified by path, located in %systemroot%\system32 folder (%systemroot% is usually c:\windows). So set your filter as displayed below and press OK:

Generating applications

Generating applications is useful for mass enrollment of the application from one folder with possible adding those enrolled applications into a group. Applications are in this case always identified by checksum.

1. Click on Generate button, dialog will appear:

2. Press "…" button, browse for folder containing binaries. If you want to add only one file, tick the radio button "Specify a single file"

3. Select Common or User repository for newly created entries.

4. Select a group for enrolling or create new one.

5. Press Finish

Right mouse context menus

Groups:

Delete will delete chosen group. Multi select is allowed.

Add will add new group.

Entries:

Remove application(s) – confirmation dialog appears, entries will be removed

Copy to group(s) – a dialog window let you select to which group(s) you want to copy the selected entries

Remove from group(s) - a dialog window let you select from which group(s) you want to remove the selected entries

See Also

Application repository

Enrolling the Application - Interactive Enrollment

Enrolling the Application - Manual Enrollment

Enrolling the Application - for Integrity Check


Enrolling the Application - Interactive Enrollment

The applications may be enrolled into the application repository interactively during 'Ask User' dialog session. The application may be enrolled as standalone process and it can be assigned to the Group(s) (recommended!). When enrolled to group the application would enjoy group policies immediately which could eliminate unnecessary 'Ask User' dialogs when accessing computer resources.

Note: In order to receive the dialogs about the unknown application you must have the option Guard system processes in Windows Security options tab enabled.

See Also

Application repository

Known Applications

Enrolling the Application - Manual Enrollment

Enrolling the Application - for Integrity Check


Enrolling the Application - Manual Enrollment

Remember! The recommended and the most convenient way of enrolling the applications is to let TPF5 to enroll the unknown processes interactively using Unknown Application dialog. This dialog pops up automatically whenever unknown process executes.

If you need to prepare the configuration of TPF5 for other users you may want to enroll the applications to application repository. There are several ways of enrolling the application to Application Repository. First click on Enroll button which would display new panel:

Select the type of identification in "Application is identified by its…"

Identification by Checksum

Checksum is a unique digital signature of the file. Each file has unique checksum (e.g. C1380D4D08FA8D1B03D2EF812E2331F9) based on its size and contents.

To add a checksum:

Click appropriate Add.. button. You can choose whether you want to add a single file(s) or the content of an entire folder(s). Using the standard Browse dialog which pops up select the target you want to enroll.

You may associate one application name with the multiple entries. For example: create a record 'Office' and associate it with all executables checksums in the Program Files\Office folder. Then you could create the rules applying to all such executables using this one Application Repository entry. Sometimes you may find the benefits of using this approach instead of using one name for specific application and grouping them into groups. The disadvantage of this approach is the inability to auto update the application's signature when the application would be updated.

Identification by Path

Applications may be identified by their location in file system – path.

Click on '…' button on the right side of the Path text box and Choose file dialog appears

Identification by File Name

Applications may be identified by their File name.

Write the file name of the application into File name text box.

When done with the identification continue in following steps:

  1. Use Assign to application group dialog at the bottom of the panel to assign the new application to group(s). If you selected None you might choose the database (common or user) you want to enroll the application to. Otherwise the application would enroll to the database where the selected group resides.
  2. Add the Application name (near the top of the panel). You must name the enrolled entries since their names are used in the rules. Applications enrolled automatically using Unknown Application dialog would get the name automatically generated as the name of their .exe file. If such name would already exist they would get the name appended by a number ('application(1).exe').
  3. Application Description – optionally you may describe your application. Applications enrolled automatically would get their description from their name.
  4. Click on Save&Exit or Save&New button

See Also

Application repository

Known Applications

Enrolling the Application - Interactive Enrollment

Enrolling the Application - for Integrity Check


Enrolling the Application - for Integrity Check

Using Checksum and Path simultaneously allows to control the integrity of the specific executable against to changes instantly. When the executable would get changed you would get immediately notified whether to allow or deny such change.

Remember: Integrity check may be resource intensive. Enroll only such applications where the integrity check is mission critical.

You may inspect the integrity of the executable based on:

  • Checksum and Path
  • Checksum and File Name

Setting up the integrity check for the application:

  1. Enroll the application as described in 'Manual Enrollment' topic. Choose the identification as mentioned above
  2. Select the type of the Integrity Check:
    • No integrity check – application will be run without an attempt to check its integrity. For example, the virus with the same name could be run instead of the original binary if only path or
    • Monitor integrity corruption – Corrupted application will be executed and its execution monitored as an event.
    • Integrity check – ask user – the user will be asked whether to run corrupted executable
    • Integrity corruption protection – the execution of corrupted binaries is automatically prevented.

See Also

Application repository

Known Applications

Enrolling the Application - Interactive Enrollment

Enrolling the Application - Manual Enrollment


Network Security

In This Chapter

Sorting Network Security Rules

Security Zones

Stealthing System Ports and the Computer

Handling ICMP Protocol

Closed Port Access

Internet Connection Sharing (ICS) Settings

Creating Network Security Rules

Network Security Options

Testing your security

Outgoing/Incoming Connection Alert


Sorting Network Security Rules

Sorting Network Security Rules

TPF5 sorts the rules within the Low Priority Common rules, User rules or High Priority Common rules categories on its own. The benefit is that no matter where you enter the rule you would always know that TPF5 would sort the rules for you correctly.

Today there is no need to sort the rules manually. All rules should be assigned to the applications or their groups. It would have to be bad design of rules in order for them to create the conflict. Unassigned rules must have the lowest priority. If you have the need to put certain unassigned rule on top of the others (e.g. Block Everything) you can use high and low priority rules logic.

Sort Order

TPF5 sorts the rules similar to how the Excel would sort the table. TPF5 sorts all rules by Column A, then B, then C etc. In the network security module these columns and their order are:

  1. Application - Any(*) has the lowest priority
  2. Object (protocol definition) - Any(*) has the lowest priority
  3. IP address - in this order - Single, Subnet, Any
  4. Access - in this order - Ask User, Alow, Deny
  5. Time - Any has the lowest priority
  6. Security Zone - in this order - Safe, Dangerous, Any
  7. Users - All(*) has the lowest priority

See Also

Network Security

Security Zones

Stealthing System Ports and the Computer

Handling ICMP Protocol

Closed Port Access

Internet Connection Sharing (ICS) Settings

Creating Network Security Rules

Network Security Options

Testing your security

Outgoing/Incoming Connection Alert


Security Zones

TPF5 incorporates security zones Safe Zone and Dangerous Zone. The network interfaces may be assigned to these zones. The zones may be assigned to the particular rules. Such rules would apply only when network communication would be going through the assigned network interface.

As an example you could protect your file sharing ports (UDP 137-138, TCP 139) and apply this protection only for dangerous zone. When at your home or corporate LAN you could move your network interface into the Safe Zone which would result the ability to share your files. When at the airport wireless LAN simply move the interface to Dangerous Zone and all restrictions will be applied to such traffic.

Note! Identifying networks by their IP addresses which is often used by other firewall vendors is dangerous and may compromise your security. For example your interfaces may be assigned with the same 192.168.1.5 address whether you are on your home LAN, corporate LAN or at the airport!

See Also

Network Security

Sorting Network Security Rules

Stealthing System Ports and the Computer

Handling ICMP Protocol

Closed Port Access

Internet Connection Sharing (ICS) Settings

Creating Network Security Rules

Network Security Options

Testing your security

Outgoing/Incoming Connection Alert


Stealthing System Ports and the Computer

135, 139, 445 etc, are vital for Microsoft Networking eg. File Sharing, Computer Browsing etc. The activity on such ports is performed by Windows System processes. Therefore all rules that would close these ports must be assigned to the applications running under System account in the assignment. You could either choose particular application or rather 'All System' assignment (recommended).

To stealth these ports you need to check:

  1. What is the zone of the Interface you want to block?
  2. Is there a rule with particular zone and ports assigned?
  3. Is the application(s) assigned to this rule System?

Hint: You may want to stealth these ports when you are outside and leave them opened when you are at your LAN. Use Security Zones to achieve this. When on LAN move your active network interface to Safe Zone (which would have the sharing allowed). When outside of LAN move your active network interface to dangerous zone.

Internet Sharing and Stealth Mode

To stealth the computer in general and shield the application running under user accounts go to Options dialog 'Prevent Closed Port Access' which has three choices:

Don't Hide Closed Ports - leave all unused live ports visible from the Internet

Filter Incoming Requests - all ports unoccupied by a live application will be stealthed and packets dropped before they would reach them. This is complete stealth mode resulting that ICS would not work.

Filter Outgoing Responses (ICS setting) - this option will result stealthing of all ports not used by ICS.

To stealth the computer use second option 'Filter Incoming Requests'. Note, ICS enabled computers should use third option.

See Also

Network Security

Sorting Network Security Rules

Security Zones

Handling ICMP Protocol

Closed Port Access

Internet Connection Sharing (ICS) Settings

Creating Network Security Rules

Network Security Options

Testing your security

Outgoing/Incoming Connection Alert


Handling ICMP Protocol

ICMP is a specific protocol. In order to create the rule for ICMP protocol pre-define or 'Direct Specify' the firewall object, choose ICMP protocol and select from variety of ICMP commands.

DO NOT FORGET TO ASSIGN THIS RULE TO SYSTEM APPLICATIONS! ICMP protocol is handled by Windows system processes.

You can configure ICMP only for all apps (*) (choose System apps!) and as a system rule.

See Also

Network Security

Sorting Network Security Rules

Security Zones

Stealthing System Ports and the Computer

Closed Port Access

Internet Connection Sharing (ICS) Settings

Creating Network Security Rules

Network Security Options

Testing your security

Outgoing/Incoming Connection Alert


Closed Port Access

Closed Port Access means that there is an attacker coming from the Internet trying to establish/probe the connection on a port, which is not used by a specific application. TPF5 names such port as 'Closed Port'. The existence of ports may reveal the attacker information that the computer exists at a given location and is a potential target.

See Also

Network Security

Sorting Network Security Rules

Security Zones

Stealthing System Ports and the Computer

Handling ICMP Protocol

Internet Connection Sharing (ICS) Settings

Creating Network Security Rules

Network Security Options

Testing your security

Outgoing/Incoming Connection Alert


Internet Connection Sharing (ICS) Settings

Running ICS has certain specific requirements towards the firewall configuration. TPF5 simplifies the settings necessary to run ICS into one simple step.

In Options dialog 'Prevent Closed Port Access' has three choices:

Don't Hide Closed Ports - leave all unused live ports visible from the Internet

Filter Incoming Requests - all ports unoccupied by a live application will be stealthed and packets dropped before they would reach them. This is complete stealth mode resulting that ICS would not work.

Filter Outgoing Responses (ICS setting) - this option will result stealthing of all ports not used by ICS.

On ICS enabled computer you must use the last option. TPF5 will keep the computer secure yet ICS will be fully functional.

See Also

Network Security

Sorting Network Security Rules

Security Zones

Stealthing System Ports and the Computer

Handling ICMP Protocol

Closed Port Access

Creating Network Security Rules

Network Security Options

Testing your security

Outgoing/Incoming Connection Alert


Creating Network Security Rules

In order to add new rule click anywhere within the rule group (Hi Common, User, Low Common). The row will turn a bit darker. Click Add new rule and new rule will be created above existing rule you clicked on.

You can also use the right mouse button and choose Add… from the context menu or press "INSERT" key to create new rule. Don't forget to press CTRL + S or click on "Save changes" button in upper right corner of Admin tool to save changes!

The new rule will be created using generic description. To adjust the rule according to your needs proceed in following steps:

Step1 - define communication protocol

If you wish to adjust Protocols and Ports definition click on "Protocols&ports" field. Click again and choose one of the objects from the combo:

Note: Inbound ICMP rules can be assigned for system processes only, because applications can't work directly with Inbound ICMP packets.

"Direct specify" option will bring up the "Direct specify Object" dialog:

Here you can define the communication protocol yourself. Choose the protocol, entire local port (or port range e.g. ports between 21 – 500), remote port and direction of the traffic.

Step 2 - define target

Click on the next field to select "IP address". Another click will bring up the combo box:

"Direct specify" shows "IP address" dialog, where you can write chosen IP address. Another combo box allows you to select whether you want single IP, IP range (e.g. 192.168.0.1 - 192.168.0.10) or net mask. You can also use new Ipv6 format.

"Add global object" will create new IP address object, which can be found in "Predefined IP addresses " tab in Network security.

Step 3 - define the "Application"

Click on the next field to select the Application. Another click will bring up the combo box:

Here you can select All (*), which means, "The rule will be applied to every group and every application", or you can choose some group or application from the rest of the combo box.

Note: System processes (processes running under system accounts) are listed separately from processes running under user accounts. You can inspect which process are running under which account from Activity Monitor.

Step 4 - define Access

Allow – the rule will allow communication for specified objects
Prevent – the rule will prevent communication
Ask User – a pop-up will appear asking you what you want to do (Allow/Prevent)

"Ask User" could be used in Client rules only!

Step 5 - define Audit level

Ignore – the activity matching the rule would not be displayed in Activity monitor
Monitor – the activity matching the rule would be displayed in Activity monitor
Alert – warning window pops up when the activity matches the rule

Step 5 - define Day & Time

Allow us to specify when the rule is enabled (e.g. only between 6:00 and 8:00 AM)

All – rule is enabled permanently
Direct specify – dialog box called "Specify time of the day" will appear. You can specify times when the rule will be enabled. Multiple select is allowed.
Custom items – the list of objects predefined through "Time Intervals" tab

Step 6 - define Security Zone

TPF5 incorporates security zones. The network interfaces may be assigned to Safe Zone or Dangerous Zone. The zones may be assigned to the particular rules.

As a result the rule would apply only in case that the network communication would be passing through the network interface assigned to selected zone.

As an example you can protect your file sharing ports (UDP 137-138, TCP 139) and apply this protection only for dangerous zone. When you are at your home or corporate LAN you move your network interface into Safe Zone and you will be able to share your files. When you run your laptop at the airport wireless LAN you simply move the interface to Dangerous Zone.

Safe Zone – rule is applied only to interfaces connected to Safe Zone (your Ethernet card connected to LAN)
Dangerous Zone - rule is applied only to interfaces connected to Dangerous Zone (modem connected to Internet)
All - rule is applied to both interfaces

Step 7 - assign the rule to specific User Account or to System Account

This column governs for which user the rule would be applied. (E.g. rule is enabled only for Joe) When you click on this column, a dialog window would appear.

Note: Users & System condition is disabled in single server version of TPF5!

Deleting rules

Delete Rule button would remove the selected rule(s). A confirmation dialog would appear. Multiple rules selection is allowed using Ctrl or Shift buttons.

You can also delete selected rule by right clicking on it or by pressing "DELETE" key.

Filter the Rules - Show Filter

Only the matching rules will be displayed after clicking the "Activate Filter" link. By clicking "Deactivate filter" all rules will be displayed again. In the text box " Application" you can search for rules valid for one Application or the Group. You can also search for rules matching Local Port, Remote Port, Protocol or Direction. When you search for rules matching entire IP address, you must fill in the address in its numerical format (e.g. 10.0.0.1). You can hide the filter by clicking on "Hide filter" tab, which replaced previous "Show filter" after displaying the search field.

Save changes using CTRL + S or clicking "Save changes" button in upper right corner of Admin tool!

In This Section

Predefined IP addresses

Predefined Protocols and Ports

See Also

Network Security

Sorting Network Security Rules

Security Zones

Stealthing System Ports and the Computer

Handling ICMP Protocol

Closed Port Access

Internet Connection Sharing (ICS) Settings

Network Security Options

Testing your security

Outgoing/Incoming Connection Alert


Predefined IP addresses

Predefined IP Addresses dialog allows to add custom defined IP address objects. These objects may be re-used at the rule definitions.

Adding an IP object

After clicking Add button the dialog window appears:

  • name the IP address object
  • choose the IP address format (IPv4 or Ipv6)
  • choose
    • Single IP – one IP address only
    • Range – IP address range, the second text box will turn grayed
    • Mask - defines IP address range using mask
  • click on Add
  • click on OK to create the new IP address object

To remove or edit IP address (range, mask) added to the IP address object select the object and click on remove or edit button.

When you double-click on the row containing entire rule, you can rename the rule (Label column) or Edit the rule (Content column) directly.

Filter

Using filter helps to identify all objects which would include defined IP address:

1. write the IP address to the IP address field (note that you have to write the entire address to get matching results)

2. clicking on Activate filter would display matching objects

3. clicking on the "Deactivate filter" would display all objects

See Also

Creating Network Security Rules

Predefined Protocols and Ports


Predefined Protocols and Ports

In this part of network security tab you can add and edit custom defined Protocols and Ports objects

Adding a global Object

  1. click on Add button to display the dialog

  2. fill in Transport object name
  3. select protocol
  4. select direction
  5. select local port or port range
  6. select remote port or port range
  7. click on OK

Deleting a global object

  1. click on the rule you want to delete
  2. press delete button and confirm the confirmation dialog

Filter

Filter allows to find the custom objects matching the search criteria

1. fill in the search criteria

2. click on Activate filter to display matching rules

3. click on the "Deactivate filter" to view the list of all rules

See Also

Creating Network Security Rules

Predefined IP addresses


Network Security Options

This tab contains several settings that affect the firewall module behavior.

Change security audit level

Not implemented.

Prevent closed port access

Don't hide closed port - leave all unopened ports visible from the Internet (not recommended, your machine isn't invisible and answers to port-scan attacks)

Filter Incoming Requests - all unopened ports will be stealth and the packets will be dropped before they would reach TCP/IP layer. This is complete stealth mode resulting that ICS would not work. This is preferred mode for standalone computers not running ICS.

Filter Outgoing Responses (ICS setting) – responses from unopened ports are traced and filtered in dependence on preceding requests. This is recommended setting for computers running Internet Connection Sharing.

Closed port access

Ignore – Access on closed port won't appear in Activity window

Monitor - Access on closed port will be monitored in Activity window

Alert – Not implemented.

See Also

Network Security

Sorting Network Security Rules

Security Zones

Stealthing System Ports and the Computer

Handling ICMP Protocol

Closed Port Access

Internet Connection Sharing (ICS) Settings

Creating Network Security Rules

Testing your security

Outgoing/Incoming Connection Alert


Testing your security

There are several methods of testing your firewall settings. For example you can visit www.grc.com (http://www.grc.com/) and test the security of TPF5 firewall using the "Shields UP" tests. The computer must be connected directly to Internet in order to get the best results. If your computer would be located behind router or other computer providing Internet Sharing functionality the results of GRC's test would refer to such router/computer.

Your network interface should be in Dangerous Zone in Network security-> Zone settings tab or you should modify the rules for the Safe Zone accordingly.

Scanning the ports

1. Open your favorite browser, go to http://grc.com/default.htm (http://www.grc.com/), and find "Shields UP". Link under "Hot Spots" rubric or go directly to https://grc.com/x/ne.dll?bh0bkyd2 (https://grc.com/x/ne.dll?bh0bkyd2)

2. Find this part of the page:

there are couples of tests on the silver bars in this table.

File Sharing – you can test your file sharing vulnerability. The result should be stealth. In case that you failed, make sure that the network interface you use is in the Dangerous Zone or adjust your rules accordingly.

Common Ports - This Internet Common Ports Probe attempts to establish standard TCP Internet connections with a collection of standard, well-known, and often vulnerable or troublesome Internet ports on your computer.

All Service Ports - Determine the status of your system's first 1056 ports. Slower, but much more complex test.

User Specified Custom Ports Probe - This Internet port probe attempts to establish standard TCP Internet connections with any set of up to 64 ports specified by the user.

3. Run all tests.

When you find open port try to figure out what is the port used for. GRC has good documentation about it. If you think that there's Trojan installed on your system (strange open port was detected), delete all applications from Application Repository that you are not 100% sure about. TPF5 will enroll all application once again giving you the chance to check them out. You may need to leave some open ports accessible, e.g. SMTP server, web server etc. Otherwise the external clients would not be able to connect.

Improve the firewall rules so that all the ports (except the ports you really need to leave accessible) will be stealth.

See Also

Network Security

Sorting Network Security Rules

Security Zones

Stealthing System Ports and the Computer

Handling ICMP Protocol

Closed Port Access

Internet Connection Sharing (ICS) Settings

Creating Network Security Rules

Network Security Options

Outgoing/Incoming Connection Alert


Outgoing/Incoming Connection Alert

The Outgoing/Incoming Connection Alert dialogs appear everytime there is a network activity matching any rule with 'Ask User' option set.

Typically you may want to define few default rules which would specify that all traffic would display the dialog in case it would not be permitted or prevented by other rules. Such default rule would have the lowest priority if you would use general object definitions such as 'All aplications', 'All protocols', 'All IPs'.

When the Connection Alert dialog pops up:

Apply permanently checkbox will create new Firewall rule for the connection. When you tick it, more options will be available:

Add rule to Common configuration checkbox - rule will be added to the High Priority Common rules in the Network Security rules tab.

Only to this connection – application can connect only to detected IP address (e.g. 64.12.161.185) on detected port (e.g. port 5190).

To all communication – this option creates a rule allowing/preventing all connections to all IP addresses and all ports in given direction (outbound or inbound) for the application which invoked the dialog.

To modified communication – >click on modify here to edit the dialog with the options for the new rule

Apply until Application ends – the application will be allowed to communicate of a specific port and IP address temporarily until terminated. This option is available only with Apply permanently option checked and Add rule to Common configuration option unchecked.

Allow/Deny buttons – the communication will be allowed or denied. If Apply Permanently option is checked then pressing the button would create the rule for this connection with Allow/Deny access result.

What We Would Recommend!

You can tick the Add to group checkbox. Instead of creating the rule for the application you can add the application to group which would make the application subject to all rules defined for selected group.

If you would like to start the new group just type in the group name you intend to use. Remember - you must define the rules for such group!

See Also

Network Security

Sorting Network Security Rules

Security Zones

Stealthing System Ports and the Computer

Handling ICMP Protocol

Closed Port Access

Internet Connection Sharing (ICS) Settings

Creating Network Security Rules

Network Security Options

Testing your security


Intrusion Detection and Prevention

In This Chapter

IDS/IPS Rules

Adding and Testing IDS/IPS Rule

Predefined IP Addresses


IDS/IPS Rules

Both IDS and IPS work in conjunction with Network Security engine. IDS passively monitors the incoming connections while IPS intercepts these connections in a real time.

Both IDS and IPS engines analyzes single packets as well as the streams.

IPS scans the network traffic in the real time.It is recommended to build the number of IPS rules with caution.

You can move rules between IDS and IPS by right-clicking the rule and selecting the appropriate choice.

IDS/IPS rules were created in order to analyze the network traffic for matches against a user defined or predefined rule set. IDS/IPS modules could perform several actions like displaying Network intrusion report in Activity monitor, logging the suspicious attempts or prevent the communication (Intrusion Prevention).

Rules are divided into groups. Each group contains similar rules e.g. backdoor.rules, virus.rules, porn.rules etc.

See Also

Intrusion Detection and Prevention

Adding and Testing IDS/IPS Rule

Predefined IP Addresses


Adding and Testing IDS/IPS Rule

Adding new rules - simple example

Let's say that we do not want to let any content with the key word "dog" pass to our computer. Such content may be included in received email or web pages etc.

We will test our rule on www.dog.com (http://www.dog.com/) and www.petsmart.com (http://www.sausage.com/) domains.

  1. Click on Add Group button – a grayed group called "My new group1" will appear at the bottom of the group list.
  2. Click on Name and fill in Animals. Press Enter
  3. Click on Add Rule button – "My new rule" will appear.

    Name     – change the name to "Dog" or whichever you like
    Enabled –     true (rule is used)
    Protocol –     TCP
    Remote IP Address –     IP_ALL means all IP addresses
    Direction -     Inbound. We are looking for the content in pages coming from the server to our computer
    Local Port –     select all ports
    Remote     Port – we can let port range 0-65535, although 80 will do for web pages.
  4. Click on Add Token button, select Content in the dialog box, new row will appear:
  5. Double click on "Content" or on the "…" button, the dialog window appears:

  6. Click on the right side of the dialog's text box, fill in "dog". You can see the letters converted to hexadecimal format on the left side. Tick 'No case sensitive search' checkbox, because we want to watch for Dog, DOG, dOg etc.
  7. Press ctrl + s or click on "save changes" button to save changes

Note: The content definition is being stored in its hexadecimal form. Bear this in mind when editing ids.xml manually.

Testing the "Dog" rule

  1. Open Activity Monitor window
  2. Open favorite browser (e.g. Microsoft Internet Explorer), fill in www.dog.com (http://www.dog.com/)
  3. Look to the Activity Monitor, you should see something like this:

This rather primitive example showed how to create the IDS/IPS rule in TPF5 using Admin Tool. IDS/IPS rules may be created editing ids.xml manually if desired. Keep in mind that the content must be defined in hexadecimal format and that you must restart the FW configuration service for the new configuration to take place.

See Also

Intrusion Detection and Prevention

IDS/IPS Rules

Predefined IP Addresses


Predefined IP Addresses

IDS/IPS rules database is completely separate from the network security database and it uses separate set of predefined IP address objects.

To define IP address objects click on the link in IDS/IPS submenu. You will be able to use IP address objects in "Remote IP Address" row in IDS/IPS rule specification.

Adding an IP address object

1. Click on Add

2. IP Address object definition dialog appears

3. Fill in desired IP address (range, mask)

4. Click Add button

5. Click OK

See Also

Intrusion Detection and Prevention

IDS/IPS Rules

Adding and Testing IDS/IPS Rule


Windows Security

In This Chapter

Unknown Application

Exceptions

Files and Folders Protection

Registry Protection

Applications Spawning

Access to OLE and COM interfaces

Services

Predefined Time Intervals

Windows Security Options

Miscellaneous


Unknown Application

The Unknown Application dialog appears when TPF5's Windows Security module detects that the inspected application does not exist in the Application repository yet. The dialog offers several choices:

Terminate Application – application will terminate. Useful choice for unknown or unwanted applications such as msblast.exe.

Run Once – application will be allowed to run only once, the same dialog will appear next time you run it. This is a favorite choice when you don't know the inspected process well enough to enroll it permanently into Application Repository

Run in install mode – Application will be automatically added to the Installation Applications user group. Everything will be allowed for this application and all child processes it would spawn. No ask user dialogs will be shown. Application will be deleted from application repository when finished. Useful choice when installing new software.

Note: Trojans and Spyware are frequently part of the installation process of many legitimate applications (screensavers, various tools) downloaded from various legitimate sources such as download.com etc. Therefore such trojans and spyware will always make it to your computer. In order to protect against to these spywares and trojans TPF5 allows to check the Installation log (to uncover programs that may not look like as the part of the installation package) and also TPF5 requires you to classify new started processes before they would be entered into the Application repository.

Add this checksum to the application – you can have installed applications e.g. with the same name but different checksums. This checkbox allows you to assign new checksum to the already enrolled application. Works only for applications identified by checksum.

Create a new record for this application – application will be enrolled to the Application Repository.

Use Common repository checkbox– application will be enrolled to the Common repository (common for all users of tpf). When unchecked, application will be enrolled to the User repository. This option is available only for administrators.

Add to group checkbox– select group you want the application enroll to.

New button – allows you to create new group in Application repository.

Advanced button will show Advanced Enrollment Settings dialog:

Identify by radio buttons – you can choose the way that will be the application identified.
Assign name – you can change the application name shown in Application repository.
Let binary guard check integrity of this application – this option allows you to select the way that integrity guard will deal with integrity corruption of the application.

Monitor integrity corruption – integrity corruption will be only monitored.
Ask user – in case of corruption dialog appears, asking user what to do (prevent or allow).
Integrity corruption protection – execution of corrupted binaries is automatically prevented

Press OK button to close the Unknown Application dialog.

See Also

Windows Security

Exceptions

Files and Folders Protection

Registry Protection

Applications Spawning

Access to OLE and COM interfaces

Services

Predefined Time Intervals

Windows Security Options

Miscellaneous


Exceptions

The Exceptions enable and disable various security guards for particular applications or groups of applications running under particular user account.

The main use of Exceptions is when you find out that the application would be incompatible otherwise or when you want to release the security restrictions for Administrator yet keep the restrictions for regular users.

You may also find out that the application would be 'using' particular guards too extensively without any security impact - then you might want to disable the particular guard for such application.

Note! By disabling particular guard for particular application running under particular user account you may expose your computer to security risks.

The Windows Security engine protects the computer resources against unwanted and suspicious accesses and changes using following guards:

File Access Guard

By accessing the file system, a hostile process could gains access to all your data and files. TPF can restrict access of various applications running under different user accounts to the file system. Imagine a non-privileged user running his instance of MS Word with limited access while administrator user on the same computer running the same MS Word at the same time would have unrestricted access to it.

Services Control Guard

TPF monitors all access to system services issued from restricted applications. By changing the settings of particular services (stopping or accessing certain services), a hostile process can make your computer unusable or gain unwanted access to resources and data. It is good idea to guard installing services, because e.g. many trojans tries to install themselves as regular services.

Registry Guard

The windows operating system saves the system and application configurations within the registry database. If a hostile process changes settings within the registry database, it might leave applications or your entire system unusable or create a security hole at least. By changing the registry database, a hostile application can also gain unwanted access to resources on your computer.

Process Spawning Guard

With Process Spawning Guard you could define whether particular process could be started by some other process or by the user only. You could also define whether the new application would run in the security context of the parent application or its own. This can prevent misuse of trusted applications by a hostile code.

Device Access Guard

Manages which system devices could be accessed by specified or unspecified processes.

VBA Macro Guard

MS Office documents (e.g. *.doc, *.xls) may contain some VBA macros, which are often misused by various viruses and trojans. Without VBA Macro guard these macros could replace or delete the important files just by running *.doc attachment. It doesn't make a sense to turn on this guard for other applications than MS Office ones.
VBA macros and JScrips are interpreted by wscript.exe or cscript.exe. OLE/COM Guard

Certain functional interfaces of the system or applications installed on the computer are intended for the internal use only or for special applications use only. There is no reason for these resources to be used by the third applications under regular circumstances. OLE/COM guard protects these vital resources and experienced administrators have detailed opportunity to configure it.

System Privileges Guard

Each Windows application interfaces with the operating system through the Application Programming Interface (Win32 API). Some portions of this API are intended for use by operating system only and not by regular applications. System Privileges Guard control System low-level access, allowing you to prevent e.g. running entire process as another user.

Device privileges Guard

Manages which system devices could be accessed by specified application. Access rights requests, (e.g. reformat hard drive, eject cdrom) can be controlled by this guard.

Setting guards for the entire application group:

  1. Click on Insert Application/Group button
  2. New row appears, select the group or application in the combo box
  3. Set active guards for the group/application by ticking them in checkboxes
  4. Set assignment for the user(s).
  5. Press ctrl + s to save changes

Deleting a row in Exception panel

Click on Delete button on the right side of the row, confirmation dialog appears, click on Yes.

See Also

Windows Security

Unknown Application

Files and Folders Protection

Registry Protection

Applications Spawning

Access to OLE and COM interfaces

Services

Predefined Time Intervals

Windows Security Options

Miscellaneous


Files and Folders Protection

Files and folders rules allow to set application's access to files and folders on your computer.

Unknown applications should never try to overwrite the system binaries located in %systemroot% (windows directory). The attempt to do so indicates that such application may be a virus or trojan..

Unknown applications should never try to write executable files into %systemroot% (windows directory). But it is common behaviour for most of the trojans... (Some applications use to write their *.ini (configuration files) there, e.g. Total Commander, which is harmless.)

Rule processing priority:

High priority common rules have higher priority than User rules, which have higher priority than Low priority Common rules.

Inside each group(High, User, Low) the Applications are sorted alphabetically(!) and have higher priority than Groups, which are alphabetically sorted as well. All application sign '(*)' has the lowest priority.

The order of rules you create them does not matter since their priority is set by the position of the object in the tree. Therefore the object deeper in the tree (e.g. c:\documents\mydocuments will inherit the settings tied to the object higher in the tree (c:\documents). That said means that the settings for the object deeper in the tree will have higher priority then the settings for the object higher in the tree. As an example the allow access to c:\documents\mydocuments directory will prevail over the deny access set to c:\documents.

Creating New Rules

  1. Click on the list of rules, a row will turn gray.
  2. Either click on "Insert after" button or right click on the row and select "Add new" from context menu or press "INSERT" key.
  3. New rule will appear
  4. Click on "Object" column:

    Select the object you want use for the rule. Any (*) means that rule will be valid for any object (e.g. every file, every folder)
    Fixed drives     refers to all the files and folders located on your hard disk(s).
    CD-ROM files –     files and folders on CD-ROM(s)
    Removable drives –     files and folders on e.g. floppy(s)
    Direct specify -     allows to set the path to the object directly. The use of path to the shared network folders, e.g.: \\machine\sharedFolder is allowed. The use of mapped drives is currently not allowed.
  5. Click on the Application column and select the application or group which will be affected by the rule:

  6. Set the access result of the rule on the permission table:

    NOTE: AskUser choice may be used in User and Low Priority Common rules only!
  7. Set Day & Time when the rule should be enabled (e.g. only between 6:00 and 8:00 AM)|
  8. Assign the rule to Users
    This column governs for which user is the rule applied. (E.g. rule is enabled only for Joe), when you double click on this column, a dialog window will appear:

User assignment is disabled in single server version of TPF5!

Deleting rules

Delete Rule – will remove rule you have just selected. A confirmation dialog will appear.

In This Section

Hidden Folder Example

Predefined File Objects

See Also

Windows Security

Unknown Application

Exceptions

Registry Protection

Applications Spawning

Access to OLE and COM interfaces

Services

Predefined Time Intervals

Windows Security Options

Miscellaneous


Hidden Folder Example

Let's create hidden folder. This folder will be invisible to all installed applications except of notepad.exe,which we'll use for writing secret notes.

  1. Make sure that Windows security module is enabled.
  2. Create a directory named c:\hidden
  3. Run Admin Tool and go to Files and Folders panel.
  4. Right click on High priority common rules. Select Add new... from the context menu
  5. In Object field of the new rule select direct specify and fill in c:\hidden or select it using browse function
  6. Leave -All (*) in the application field (rule will be enabled for all applications)
  7. Set Permission to Deny for each access type (R,W,C,D). Set Audit level to Monitor (we will change it to ignore later)
  8. Go to the Exceptions panel and enable file guards for all applications/groups except of userinit.exe.
  9. Press CTRL + S to save changes
  10. Run Activity monitor

Try to access the directory c:\hidden using Windows Explorer or any other application e.g. command prompt (cd \;dir),IE, notepad.exe (ctrl + o) etc.

You shouldn't see the directory! Look at the Activity monitor - there should be plenty of Prevented messages (red minus), as applications we used tried to access the directory. The directory c:\hidden should not be visible in Admin Tool's file tree as well.

Now change the Audit level of the rule to ignore for all access in order to keep the folder 'stealth'. This should result complete invisibility of the folder to any user of this PC.

Remember: By assigning this rule to particular user account (e.g. Guest or other) you may hide this directory for particular user account only.

Now let's open up the access to our c:\hidden folder for notepad.exe.

  1. Right click on our rule, select Copy.
  2. Select notepad.exe in the Application field (hint - to select it fast press 'n' when you pop up the list of applications.
  3. Change Permission to allow. Press ctrl + S.

Run notepad, write something, save it to the hidden directory.

Remember! You must have Win Security module enabled. If you have entries in the Exception Panel they must have have File guards enabled (except of userinit.exe) in Exceptions panel! Otherwise the folder won't be stealth.

See Also

Files and Folders Protection

Predefined File Objects


Predefined File Objects

Using File Objects you may define collections of files and folders and use them as a group in the rules. There are two levels of the objects - Common and User. Common objects may be used in Common rules, User objects may be used in User rules. Only user with administrative privileges may define Common Objects.

Adding an Object (User or Common)

  1. Click on Add Object button.
  2. New row appears.
  3. Click on <Please change ID> in the Identification column and name the object.
  4. Now find in the File Tree the object you want to use, press right mouse button and select Copy to selected definition. You can repeat it as many times as you need, add lots of files or folders to one object.

Deleting an Object

  1. Click on the definition.
  2. Press Delete button.
  3. When confirmation dialog appears, click on Yes.

Deleting an entry from the Object

  1. Click on Contents field
  2. Click on the entry you want to remove
  3. Deleting from database dialog appears
  4. Click on Yes

Or you can click on the Object using right mouse button and select remove.

See Also

Files and Folders Protection

Hidden Folder Example


Registry Protection

What is Registry?

Registry is a database used to store settings and options for the 32 bit versions of Microsoft Windows and the applications. It includes information and settings for all hardware, software, users, and preferences of the PC. Whenever user makes changes to Control Panel settings, File Associations, System Policies or installed software the changes would be reflected and stored in the Registry.

There are five main branches of Registry each containing a specific portion of the information stored in the Registry. They are as follows:

HKEY_CLASSES_ROOT - This branch includes all file associations to support the drag-and-drop feature, OLE information, Windows shortcuts and core aspects of the Windows user interface.

HKEY_CURRENT_USER - This branch links to the section of HKEY_USERS appropriate for the user currently logged onto the PC and contains information such as logon names, desktop settings, and Start menu settings.

HKEY_LOCAL_MACHINE - This branch includes computer specific information about the type of hardware, software, and other preferences on a given PC, this information is used for all users who log onto this computer.

HKEY_USERS - This branch includes individual preferences for each user of the computer. Each user is represented by SID sub-key located under the main branch.

HKEY_CURRENT_CONFIG - This branch links to the section of HKEY_LOCAL_MACHINE appropriate for the current hardware configuration.

RUN keys (http://support.microsoft.com/?kbid=179365) are special Registry keys. They are frequently misused by viruses and Trojans to auto start various spyware application on or even before user's logon. The ability to protect Run keys from unwanted entries is THE very effective weapon against to most aggressive viruses.

Registry tab of Advanced Security panel allows to set rules for registry. Left window frame displays registry tree (similar to regedit) and right panel displays the rules.

Rule processing priority:

High priority common rules have higher priority than User rules, which have higher priority than Low priority Common rules.

Inside each group(High, User, Low) the Applications are sorted alphabetically(!) and have higher priority than Groups, which are alphabetically sorted as well. All application sign '(*)' has the lowest priority.

The order of rules you create them does not matter since their priority is set by the position of the object in the tree. Therefore the object deeper in the tree (e.g. HKLM/Software/TinySoftware) will inherit the settings tied to the object higher in the tree (HKLM). That said means that the settings for the object deeper in the tree will have higher priority then the settings for the object higher in the tree. As an example the allow access to HKLM/Software/TinySoftware registry will prevail over the deny access set for the same application or its group to HKLM.

Adding a rule

  1. Click Insert after button.
  2. Click on Object field in the new rule. You can select predefined object or find the key you need by clicking on "Direct specify". In this case, a dialog appears:

    "Enter a key" field offers search for specific key.
  3. Select for which application or Group the rule would be effective

Set the access result of the rule in the permission table:

Types of Access:

Read – key may be read
Write – key may be changed
Create – key may be created
Delete – key may be deleted

4. Specify Day & Time when the rule would be effective

All – rule is enabled permanently
Direct specify – dialog box called "Specify time of the day" will appear. You can specify times when the rule will be enabled. Multiple select is allowed.
Custom items – can be created through "Time Intervals" tab

5. Assign the rule to User(s) account(s) so that the rule would be applied only to application or group of applications running under that particular user account.

In This Section

Predefined Registry Objects

See Also

Windows Security

Unknown Application

Exceptions

Files and Folders Protection

Applications Spawning

Access to OLE and COM interfaces

Services

Predefined Time Intervals

Windows Security Options

Miscellaneous


Predefined Registry Objects

Predefined Registry Objects

Predefined Registry Objects are parts of the registry tree (keys, branches), which can be named and used in Registry rules. There are two kinds of these object, Common and User ones. Common objects can be used in Common rules, User objects can be used in User rules.

Adding an Object (User or Common)

1. Click on Add object button.

2. New row appears.

3. Click on <Please change ID> in the Identification column and name the object.

4. Now find in the Registry Tree the key you want to use and press right mouse button and select Copy to selected definition. You can repeat it as many times as you need, add lots of keys to one object.

5. Press Back to Registry button and you can start using the newly created object in rules.

Deleting an Object

1. Click on the definition.

2. Press Delete button.

3. Confirmation dialog appears, click on Yes.

Or you can use right mouse button on the Object and select remove.

Deleting an entry from Object

1. Click on Contents column in user created object row

2. Combo box appears – containing entries of the object

3. Click on the entry you want to remove

4. Deleting from database dialog appears

5. Click on Yes

See Also

Registry Protection


Applications Spawning

What is Spawning?

The spawning is the application activity when one process starts another.

Example:

When you open up notepad or just any application using menu Start it is a spawning. Eplorer.exe which is your user interface through which your access other application is built in Windows operating system and controls just about any process running on your computer excluding the system services.

Strange enough when you open up Windows Explorer to see the files on your drive the explorer.exe starts itself. Once the explorer.exe represents the user interface and the other instance is the Windows explorer opening up as an application.

Rule processing priority:

High priority common rules have bigger priority than User rules, which have bigger priority than Low priority common rules.

Inside of each priority group (High, User, Low) the Application names of spawned object (child processes) are sorted alphabetically(!) and have bigger priority than the Groups of spawned object, which are alphabetically sorted as well. All aplications '(*)' have the lowest priority.

Last sorting can be done according to spawning object (parent processes). Alphabetically sorted Application names have priority than alphabetically sorted Groups, All aplications '(*)' have the lowest priority.

Inserting a spawning rule

  1. Click on the row where you want to add a rule
  2. Click on Insert after button, new row appears
  3. Click on Start what (child) and select the application or group to be spawned
  4. Click on Start by (parent) and select the application or group which will spawn the previous application or group

    Now look at the bottom of the Admin tool:

    Use child's     – child (spawned process) will run in its own security context. All and only rules assigned to such child process or to group where the child process is a member will be applied).

    Use parent's - child (spawned process) will run in parent's security context. It means that rules effective for the parent process will be applied to the child process as well. The child process still may have defined other set of rules for the situations where the child process would be started by some other application or undertaking.

    As an example MS Outlook may have different set of rules when it would be started by user's direct activity (by explorer.exe - user interface) then when it would be started by some other application (which might be trojan potentially).

    Ask user – tpf will ask which of above two scenarios will be applied

  5. Day & Time column – select the time and date where the rule will be valid
  6. Assign the rule to User(s) account(s) so that the rule would be applied only to application or group of applications running under that particular user account.

In This Section

Application Spawning Example

See Also

Windows Security

Unknown Application

Exceptions

Files and Folders Protection

Registry Protection

Access to OLE and COM interfaces

Services

Predefined Time Intervals

Windows Security Options

Miscellaneous


Application Spawning Example

The spawning rules may be used simply where each rule would not conflict with another. Using hierarchical inheritance the administrator may define spawning rules which would be effective only in case that preceding rules would be in accordance.

Note: By inheriting the security of the parent application (1) the child process (2) is inheriting the parent's identity. Therefore if such child process (2) would try to start another process (3) such process (3) would not see this child (2) as a child (2) but as its parent (1).

As confusing as it may seem the application of this logic is quite simple:

Example of recursive security assignment:

Create two spawning rules:

  1. realplay.exe started by iexplore.exe - allow spawning in parent's security context, monitor
  2. realsched.exe started by realplay.exe - allow spawning in parent's security context, monitor
  3. any(*) started by any(*) - ask for access (allow/deny) and ask for security (child's/parent's)

When realplay.exe would be started by iexplore.exe it would inherit the security settings and the identity of iexplore.exe.

Then when realplay.exe would try to start realsched.exe it would not be seen as realplay.exe but as iexplore.exe. Therefore the second rule in the list would not apply and the user would be presented with the ask user dialog in which he would have to confirm what security would be given to realsched.exe.

However when the same realsched.exe would be started by explorer.exe (Windows Explorer) such start would be allowed according the the second rule in our list.

See Also

Applications Spawning


Access to OLE and COM interfaces

What is OLE and COM?

OLE (object linking and embedding) was originally developed for the applications to cooperate between each other. Later it has been extended to a complete system - COM.

The Component Object Model (COM) is a technology that combines the benefits of object-oriented programming with binary reuse, language independence, version-ability, self-registration, and ease of licensing. The management of the COM technology covers such topics as ActiveX, inter process communications and distributed COM. If misconfigured it could create potentially significant problems resulting the application being unable to start etc.

Adding a new rule

  1. Highlight the appropriate High priority-User-Low priority area and insert the new rule
  2. Find desired COM object in Registered COM objects frame, right click on it and select Copy to Selected rule(s)
  3. Click on Application row and select the Application which the rule would be applied to
  4. Set the accesses and their auditing at the bottom of the view:

    COM Init     - use ActiveX and other COM objects (automation, etc.)
    Create In-Proc Server     - COM objects can be created only in the process boundaries (e.g. ActiveX), thus process security applies on them
    Create local server     - separate COM executables can be started or accessed from an application
    Create remote servers     - the same as local servers but in addition on remote computers
  5. Set the time and date when the rule will be valid
  6. Assign the rule to User(s) account(s) so that the rule would be applied only to application or group of applications running under that particular user account.

In This Section

Predefined OLE\COM Objects

See Also

Windows Security

Unknown Application

Exceptions

Files and Folders Protection

Registry Protection

Applications Spawning

Services

Predefined Time Intervals

Windows Security Options

Miscellaneous


Predefined OLE\COM Objects

Predefined OLE\COM Objects follows the same logic like the predefined file and registry objects - define the name of the object and add as many entries of OLE/COM objects as you wish to it. Experienced security professionals may using these definitions groups interfaces for particular applications and reuse them at various occasions.

See Also

Access to OLE and COM interfaces


Services

What are services?

The difference between the regular applications and the services is that the services are started by the system automatically rather then by a user. Please do not be mistaken by the applications starting every time you boot up the computer automatically. Such applications are started because of the entries in the Run key in registry. Even though these applications start automatically they are not considered as the services.

The services can be automatically started when the computer boots, they can be paused and restarted. The services do not show any user interface. The services are monitored using the Windows systems tools and the events are displayed in the Control Panel -> Administrative Tools -> Event Viewer. All these parameters make services ideal for use on a server or whenever you need long-running functionality that does not interfere with other users who are working on the same computer. You can also run some services in the security context of a specific user account that is different from the logged-on user or the default computer account. The reasons for that may be different - from the ability to control them through the opportunity to assign them with various security privileges.

Services settings in TPF5 determine the protection of the computer against to hostile programs that could register themselves as a system service or stop or delete other services otherwise.

Adding a rule

  1. Click on the list of rules an insert the new rule
  2. Find service in the Service's descriptive names frame, right click on it and select Copy to selected rule(s)
  3. Set the access result of the rule on the permission table:

    Query service status     – right to query service's status
    Start service     – right to start the service
    Stop service     – right to stop the service
    Remove     service – right to remove service
    Open service     – right to open handle to service
    Install     service – right to install service. Some viruses install their own services acting like Trojans horses then.
    Control service    – right to e.g. restart the service
  4. Set the time and date when the rule will be valid
  5. Assign the rule to User(s) account(s) so that the rule would be applied only to application or group of applications running under that particular user account.

See Also

Windows Security

Unknown Application

Exceptions

Files and Folders Protection

Registry Protection

Applications Spawning

Access to OLE and COM interfaces

Predefined Time Intervals

Windows Security Options

Miscellaneous


Predefined Time Intervals

In this part of network security tab you can add custom defined Time Intervals. You will use these Time Intervals in rules later.

Adding a Time Interval

  1. Click add, dialog window appears:
  2. Name the Time object (e.g. "in_work").
  3. Specify times for the object (from Monday to Friday, from eight AM to five PM) .
  4. Click OK.

The dialog "Specify Time of the day" appears when you double-click the content field in the rule.

Deleting a Time Interval

  1. Click on the row you want to delete.
  2. Press delete button, confirmation dialog appears.
  3. Select Yes, rule is deleted.

See Also

Windows Security

Unknown Application

Exceptions

Files and Folders Protection

Registry Protection

Applications Spawning

Access to OLE and COM interfaces

Services

Windows Security Options

Miscellaneous


Windows Security Options

There are some general settings which may affect Windows Security module behavior.

Access result options

Ignore – action won't appear in Activity window

Monitor - action will be monitored in Activity window

Alert – Will be implemented.

Change security audit level

Displays the event of enabling/disabling Windows Security module in Activity window.

Start process audit level

Displays the start of the new process in the Activity Monitor.

End process audit level

Displays the end of the new process in the Activity Monitor.

Alert when unknown application starts

This checkbox should be ticked in order to inform about every unknown process trying to run. If unchecked TPF5 would let unknown applications start without warning.

Guard system processes

System processes are not guarded by Windows Security Guards by default. They are guarded by the network security module only. Thus system processes may access all internal system resources. When you choose to guard the System processes you will be allowed to create the rules for them. Each process is automatically enrolled into $KnownSystemApps group.

NOTE!! This option is dangerous. Enabling Windows Security guards and using incorrect rules on System Processes may lead to the system instability and or the computer may not boot properly after restart because you may have disable access of system process to its vital resources. If you would experience difficulties during the boot and could not logon you must follow the steps below.

  1. reboot into Safe Mode
  2. run Start -> Run and type regedit
  3. go to HKLM/System/CurrentControlSet/Services/KmxAgent/Parameters and SecurityEnabled key to 0
  4. Reboot (you will notice that TPF5's icon is gray - security was disabled
  5. Run Admin tool and delete conflicting tool. If you are unsure restore the default configuration.

Press CTRL + s or click on "Save changes" button in upper right corner of Admin tool to save changes!

See Also

Windows Security

Unknown Application

Exceptions

Files and Folders Protection

Registry Protection

Applications Spawning

Access to OLE and COM interfaces

Services

Predefined Time Intervals

Miscellaneous


Miscellaneous

In this part of Advanced Security panel you can set the rules for VBA macros, Process termination, System shutdown, System low-level API calls, Clipboard access and Dangerous devices access.

VBA macros - Visual Basic® for Applications (VBA) macros. MS Office documents (e.g. *.doc, *.xls) may contain some VBA macros, which are often misused by various viruses and Trojans. Without VBA Macro guard these macros could replace or delete the important files just by running *.doc attachment. VBA macros and JScrips are interpreted by wscript.exe or cscript.exe.

Do not run - Running of VBA macro will be prevented

Use Custom VBA Settings - VBA macro would be allowed to run with the security settings set for the custom application 'VBA Macro'. The rule set for such application would be applied for every macro process.

Inherit from Parent - VBA Macro would be allowed to run in the security context of the parent application (e.g. MS Word - whichever access would MS Word has the macro would have it too).

VBA Auto Macro - used in the background are invisible for a user. For example by creating or opening a new document some hidden macro can be run. These VBA macros are very dangerous and thus you can treat them separately.

Do not run - Running of VBA macro will be prevented

Use Custom VBA Settings - VBA macro would be allowed to run with the security settings set for the custom application 'VBA Macro'.

Inherit from Parent - VBA Macro would be allowed to run in the security context of the parent application

Forced process/Thread termination - With this option enabled all thread and process manipulation of the selected application or group is restricted in accordance with the set policy.

System shutdown - When this option is set to prevent, no system shutdown requests will be allowed from the selected application or group.

System low level API - When this option is set to prevent, a number of unusual application requests are not allowed for the selected application.

Clipboard access - This option can prevent an application to copy data into or paste from the clipboard.

Dangerous devices access - When this option is set to prevent, access rights requests, (e.g. reformat hard drive) are not allowed from the selected application.

Following device accesses are blocked
Dismount volume, Lock volume, Set compression, Unlock volume, Disk eject media, Disk format tracks, Disk load media, Disk media removal, Disk reassign blocks, Disk set drive layout, Disk set partition info, Disk verify, Serial lsrmst insert.

Users column allows assigning entire rule (or rather policy since there are several rules together on one line) to selected users.

See Also

Windows Security

Unknown Application

Exceptions

Files and Folders Protection

Registry Protection

Applications Spawning

Access to OLE and COM interfaces

Services

Predefined Time Intervals

Windows Security Options


Log Viewer

In This Chapter

Log Viewer


Log Viewer

TPF5 stores the events reported by the firewall engine in the log. Each log has the maximum size of 1MB and logs are stored for 7 days. One day represents one or several logs based on the number of activities reported by the engine. After 7 days the particular log(s) would get deleted.

XML

The events are reported and stored in the XML format. The XML log provided by TPF5's engine is easily readable and allows for simple and advanced analysis using external data mining tools.

For simple queries TPF5 includes built-in log analyzer which provides the basic access to logs.

Finding an Event in Log Viewer:

  1. Click on Show Filter button, above window appears
  2. Fill in the time period in Show logs From To text boxes
  3. Select the Module which generated the Event
  4. Select the application or leave it blank
  5. Select the Access result (e.g. action was prevented)
  6. Press Go button

Note: Filtered and unfiltered log would display on several pages where each page would correspond to one xml file as explained earlier.

See Also

Log Viewer


Troubleshooting

When TPF5 doesn't seem to work properly

It is our experience that most of the problems reported with the use of TPF relate to the rule settings. Wrong rules (especially rules related to file and registry access) may easily cause other application not working properly or not starting at all.

The rule of thumb is to allow unrestricted access to all resources for the applications that you know (move them to Trusted group). The applications that you don't know may be subject to more restrictive decisions and you always have the options to allow the application particular activity only 'once' - until it ends.

When you run into problems always look at the Activity Monitor for events with 'Prevented' status. If you see such events and these events would be related to your application try to delete or adjust the rules accordingly. As a last (but not uncommon) resort you may disable TPF5 modules to see whether the problems were caused TPF or not.

For example: you may try to connect to FTP server unsuccessfully, because you set all inbound TCP connection to be prevented (remember, unlike HTTP TCP protocol is more complicated and may include active incoming connections on port 20).

When reporting the problems always use utility sysreport.exe, which dumps important information about your configuration (tpf rule settings, system settings, installed SW etc.). It is located in the TPF5 folder (usually C:\program files\Tiny Personal Firewall) and its result sysinfo.cab can be found in SysReport subdir.

If you are using multiple security products you may experience (on a very rare occasion0 BSOD (http://bsod.org/) (Blue Screen Of Death, Bugcheck for Microsoft people ;). If BSOD occurs, reboot and go to %systemroot%\minidumps (%systemroot% is windows installation folder, usually c:\windows), find the newest *.dmp file and send it to Tiny Software. The file can be located in another place e.g for Win2k it is usually in C:\winnt or in the location specified in System properties tab( press Win key + Pause) ->Advanced- >Startup and Recovery->Settings...

Normal uninstallation of tpf5

Click on Start button, go to Settings, click on Add/Remove programs, find TPF5, select remove.

Emergency Uninstallation

On a very rare occasion your Windows may not start correctly or at all. This may occur if combining several firewalls together or if your application or devices have drivers from less experienced software developer.

In case you cannot start your windows, follow this uninstallation procedure:

  1. reboot into Safe Mode
  2. delete system32\drivers\kmxcfg.u2k
  3. run Services control applet (Control Panel -> Administrative Tools) and set Startup type (in properties) to 'Disabled' for the following services:

    FW Configuration Interpreter

    FW Event Manager

    FW Policy Manager

  4. reboot normally and remove TPF5 using Add/Remove Programs in Control Panel

Starting TPF5 with the security modules disabled

Enabling Windows Security guards and using incorrect rules on System Processes may lead to the system instability and or the computer may not boot properly after restart because you may have disable access of system process to its vital resources. If you would experience difficulties during the boot and could not logon you must follow the steps below.

  1. reboot into Safe Mode
  2. run Start -> Run and type regedit
  3. go to HKLM/System/CurrentControlSet/Services/KmxAgent/Parameters and SecurityEnabled key to 0
  4. Reboot (you will notice that TPF5's icon is gray - security was disabled
  5. Run Admin tool and delete conflicting tool. If you are unsure restore the default configuration.