Recent Posts

41

ReHIPS / Re: Ask Questions Here - ReHIPS Features & Unexpected Behaviors

« Last post by winuser on February 27, 2020, 11:36:05 pm »

Alright, It makes sense. Thanks for the reply, I really appreciate it. I also wanted to report:
1. A serious bug:
When I run "MS Office Powerpoint 2016" in isolation, it works fine but if I put it in slide show mode (F5) everything freezes so I have to press Ctrl+Alt+Delete, only then I realize Rehips has an alert in the background. It says powerpoint.exe is trying to run wisptis.exe. I have no idea why the alert window doesn't stay on top! ok, after allowing that (with allow only for once option), Powerpoint still remains hanged!
Edit: I have modified the "default.rdb" database before installation (shrinking the list to Windows pre-installed apps only) and added office apps to isolated apps list later. Maybe the default "default.rdb" file Allows the operation and such problem never happens there but still I wonder why the alert window doesn't show itself on top of other windows causing the issue.
Edit-2: I tested this on another computer and everything works fine. Apparently there is a problem with this computer. I'm so sorry, please ignore this till I find out what is going on.
2. A few minor bugs:
A) When running full-screen applications (like a full-screen youtube video in a browser) , the isolation taskbar sometimes stays on top and sometimes it doesn't and I'm not sure why.
Edit: I think I'm getting the hang of it. With a few clicks on isolation taskbar and isolated app/video, it hides. so probably not an issue here. sorry.
B) In the Allowed section (tab) of Rules Database, I can not change the "ignore file modification" state of any of the programs listed. It always reverts back to "checked" state no matter what! This is actually a cool feature and I think unchecking that option makes Rehips compare sha512 hashes. BTW, The option works fine with programs listed in the Isolated tab!
Edit: OK, it seems it's behavior is dependent on the current protection mode. I'm a bit confused.
C) For some reason On-Screen Keyboard (osk.exe) can not run in isolation! It's a windows accessibility app and might be important for some users.

That said, your software is awesome 

ps: Don't you think the forum needs a "known issues" section, with descriptions and links to original posts. Users (like me) could have a quick look at that post before reporting here.

42

ReHIPS / Re: Ask Questions Here - ReHIPS Features & Unexpected Behaviors

« Last post by fixer on February 26, 2020, 11:28:59 am »

1. UAC is not a security boundary. In other words, it's for usability/foolproofing, not for real security. So it's bypassable and it may not even be considered a bug. ReHIPS on the other hand relies on security boundaries. And if they somehow are bypassed, it's considered a serious bug (usually with CVE) and will be patched by MS in a prioritized manner. And even successful exploits for unpatched OS sometimes get caught by ReHIPS trying to spawn additional processes. As an additional anti-elevation measure ReHIPS can block spawning elevated processes by isolated ones. To further tighten the security ReHIPS has second and third protection echelons, but they're for corporate environments.

2. Doesn't really matter. It'll be visible enough when an isolated program requests elevation. If you don't expect it to do so, just deny. It's more of a usability thing than security. Showing the prompt increases number of questions OS asks the user on one hand, but on the other hand it won't block something silently leaving the user wondering why it doesn't work.

43

ReHIPS / Re: Ask Questions Here - ReHIPS Features & Unexpected Behaviors

« Last post by winuser on February 25, 2020, 09:26:57 pm »

Hi, two questions about Rehips isolation

1. Considering both Rehips and Windows with default settings:
Isolation is mostly based on OS built-in access management, right? So what if an isolated malware bypasses those restrictions? Remember NotPetya malware?! That malware could bypass standard user account (SUA) restrictions with no UAC prompt and could gain administrative privilege. I just mentioned that malware as an example so you guys better understand what i mean here.
Imagine a malware (capable of bypassing SUA) running in Rehips isolated user account. Here is my question: What does Rehips do to prevent elevation of that malware? Does it have any mitigation technique to stop privilege escalation?


2. Should I change the following Group Policy setting:
"User Account Control: Behavior of the elevation prompt for standard users"
To:
"Automatically deny elevation requests" ?
Does it make Rehips isolation safer? Or am i just being paranoid?


I have to use an admin user account and that's why i use Rehips isolation in the first place. Any help would be greatly appreciated.

44

ReHIPS / Re: Problem with Directory OPUS's viewer and ReHIPS

« Last post by Stephen on February 14, 2020, 08:56:37 am »

I look forward mostly to solving an issue that I have with Windows Update while ReHIPS is running. The workaround is effective, but I would prefer a more elegant solution.

45

ReHIPS / Re: Problem with Directory OPUS's viewer and ReHIPS

« Last post by fixer on February 12, 2020, 07:49:42 am »

It'll definitely be this year Though I don't want to name exact dates as we planned to release it earlier,but decided to add more features that required more time.

46

ReHIPS / Re: Problem with Directory OPUS's viewer and ReHIPS

« Last post by matra on February 10, 2020, 05:46:02 pm »

When please version 2.5 will be released?

47

ReHIPS / Re: ReHIPS Questions

« Last post by fixer on December 30, 2019, 05:16:05 pm »

1. There are some reasons for this. Even when ReHIPS is disabled it's useful to support already running isolated programs. By support I mean usability features like isolated desktop for example. Another reason is monitoring, even when it's Disabled, sometimes it's useful to know what started what and when. Especially in corporate environments. So killing it completely is not recommended. Besides PC resources load is minimal.

2. The question of monitoring compared with Sansboxie is covered HERE. Updating usually takes different paths depending on where the program was installed. There usually are 2 locations: Program Files (global system-wide) or in user profile folder, AppData Local or Roaming (local user-wide). In the first case for the program to update Administrator rights are required as Program Files is one of trusted locations. So to update it (or install there) you'll have to run it without isolation. Which is usually OK since most programs like Office aren't malicious by themselves and only become ones when they're exploited. In the second case Copy User Data feature comes into play. In short words, you'll have a copy of the program in the isolated environment profile folder. And it'll be updated there. But in this case the best scenario is to install it straight into isolated environment with DeployHelper.

48

ReHIPS / Re: ReHIPS Questions

« Last post by LimeKey on December 29, 2019, 09:14:45 pm »

Thank you, fixer.  I appreciate your taking the time to explain.

1.  It's good to know that the increase is a static time instead of a multiplier.  However, is there any good reason why this needs to happen at all if ReHIPS is set to Disabled?  My expectation is that if it's set to Disabled, then it should take next to zero active resources (except for memory if a service/driver needs to remain running) unless it's started up or called on via context menu.  Is there a way to configure it so that this is the case?

2.  I only used the stenography app as an example - the workflow given applies to many types of applications.  The issue with the workflow suggested is that it's not that easy if the application is getting pointed to via the registry.  For example, an application update patch.  With Sandboxie, I can let it run, then easily observe what it tried to change and selectively allow or block the addition/modification of files.  I'm not sure how I can accomplish that with ReHIPS, since copying an application folder to a ReHIPS folder won't do anything given that the registry is still pointing to the original/real location.

49

ReHIPS / Re: ReHIPS Questions

« Last post by fixer on December 29, 2019, 12:26:48 pm »

Hello, LimeKey.
Welcome to our forum and thank you for your interest in our product.

1. I guess you're referring to this blogpost https://forum.rehips.com/index.php?topic=11868.0 ? Even when ReHIPS is Disabled, it gets notified about processes starting and exiting and other things. You can notice it by logs, they keep coming. Slowing a process startup in 10 times is not entirely correct. You see, for these tests a special program for used that does nothing on startup to minimize the time it takes to start. For this program, yes, startup with ReHIPS takes 10 times more. But even in this case a single start takes for about 10ms, I don't think you'll notice this time interval or that you start hundreds of processes in a second to start noticing it. Let's return to the real world. In real world programs take some time to start, some bulky programs take more time. For example a program takes 1 second to start. With ReHIPS it'll take 1 second+~8ms=1.008 seconds to start, difference is 0.8%. So I don't think it's noticeable.

2. The most simple (and insecure) way to do this is to simply allow READ+WRITE access to the desired folder. And voila. More secure alternatives usually take more steps. For example if a program supports it, it can read from one folder, but save to some other. Or you can copy files to a ReHIPS folder and process them there. As usual, the more secure you want to have it, the less convenient it'll be. On the other hand, I doubt a steganography program will insert some scary exploit into the images and security should be tightened to the max in this case.

50

ReHIPS / ReHIPS Questions

« Last post by LimeKey on December 29, 2019, 11:09:14 am »

I've been researching ReHIPS as an alternative to Sandboxie for me, and I have a few questions.


1.  According to the FAQ about performance, it seemed to indicate that if ReHIPS is installed, but set to Disabled, applications will experience a 10-fold increase in startup time. 

Is that correct?  The FAQ seems to indicate that these are fantastic numbers, but slowing down application startup by an order of magnitude seems to be absolutely awful.  If I have ReHIPS set to disabled, why would application start times have any additional lag whatsoever? 
Or does it only refer to apps that are started in isolation while ReHIPS is set to Disabled?



2.  Some applications are designed to process existing files - for example, an application that adds/modifies stenography in images might do the following:

a.  Scan the contents of a folder to find the appropriate files it wants to modify.
b.  Copy each target file to a backup (e.g. Target.jpg to Target.jpg.BAK).
c.  Modify the target file or delete the original and add the new replacement.


If I run this type of application sandboxed through Sandboxie, then the original folder remains protected and untouched - but I can find all new/modified files in the sandbox and selectively decide which ones to bring over into the actual file system.

Is this something that I can do with ReHIPS?  If so, just how messy a process will it be?