Author Topic: Ask Questions Here - ReHIPS Features & Unexpected Behaviors  (Read 172958 times)

shmu26

  • Active Testers
  • Sr. Member
  • *****
  • Posts: 438
  • Win10 x64 latest stable
Re: Ask Questions Here - ReHIPS Features & Unexpected Behaviors
« Reply #630 on: August 24, 2017, 01:20:41 pm »
Standard User account quirks:
1 If I install ReHIPS, and later I change one of the admin users to standard, sooner or later I start to get service link errors that are unsolvable even by uninstall/reinstall. I have to uninstall/reinstall+delete rules.

2 A few days ago, I installed LibreOffice in a standard user account, and it did not get isolation rules. Today I installed it in an admin account, and it got isolation rules.

fixer

  • Administrator
  • Hero Member
  • *****
  • Posts: 1395
Re: Ask Questions Here - ReHIPS Features & Unexpected Behaviors
« Reply #631 on: August 26, 2017, 10:49:01 pm »
1. Service link error may mean that you need Administrator rights to connect to the Service, so you have to start GUI as Administrator or add this user to trusted users list in ReHIPS settings. This error was fixed to more obvious text in the upcoming 2.3.0 build.

2. It didn't get isolation rules or it didn't get any rules at all?

shmu26

  • Active Testers
  • Sr. Member
  • *****
  • Posts: 438
  • Win10 x64 latest stable
Re: Ask Questions Here - ReHIPS Features & Unexpected Behaviors
« Reply #632 on: August 26, 2017, 10:55:29 pm »
2 It got rules but not isolation rules

fixer

  • Administrator
  • Hero Member
  • *****
  • Posts: 1395
Re: Ask Questions Here - ReHIPS Features & Unexpected Behaviors
« Reply #633 on: August 26, 2017, 11:12:55 pm »
You mean you have 2 users: Admin and non-Admin. Rules were installed for both users, but for the first user LibreOffice rules were isolating and for the second user just allowed it to execute without isolation?

shmu26

  • Active Testers
  • Sr. Member
  • *****
  • Posts: 438
  • Win10 x64 latest stable
Re: Ask Questions Here - ReHIPS Features & Unexpected Behaviors
« Reply #634 on: August 26, 2017, 11:50:02 pm »
I installed Libreoffice from the standard user. I forgot to check what happened to the admin user.

fixer

  • Administrator
  • Hero Member
  • *****
  • Posts: 1395
Re: Ask Questions Here - ReHIPS Features & Unexpected Behaviors
« Reply #635 on: August 27, 2017, 08:37:02 pm »
Thanks for your report. Added this issue to our TODO list, we'll take a look at it.

shmu26

  • Active Testers
  • Sr. Member
  • *****
  • Posts: 438
  • Win10 x64 latest stable
Re: Ask Questions Here - ReHIPS Features & Unexpected Behaviors
« Reply #636 on: August 27, 2017, 08:55:39 pm »
add this user to trusted users list in ReHIPS settings.
I tried that. I also tried, on a different occasion, turning the standard user back into an admin user. But the error messages kept coming.

perisanboy

  • Jr. Member
  • **
  • Posts: 72
Re: Ask Questions Here - ReHIPS Features & Unexpected Behaviors
« Reply #637 on: September 04, 2017, 09:48:49 pm »
Hey,
Sometimes when I allow a file to run(permanent rule)and then exit the application the next time I want to run that tool again Rehips ask me and wants me to allow or block it.

Example: happened 2 times for Securemybit
Has any one this issue?

aDVll

  • Active Testers
  • Hero Member
  • *****
  • Posts: 1119
  • Windows 10 latest 64 bit
Re: Ask Questions Here - ReHIPS Features & Unexpected Behaviors
« Reply #638 on: September 04, 2017, 10:01:40 pm »
Hey,
Sometimes when I allow a file to run(permanent rule)and then exit the application the next time I want to run that tool again Rehips ask me and wants me to allow or block it.

Example: happened 2 times for Securemybit
Has any one this issue?
Either the application spawns a new process each time with a different hash or you didn't allow with the permanent option but instead used the allow once option.

perisanboy

  • Jr. Member
  • **
  • Posts: 72
Re: Ask Questions Here - ReHIPS Features & Unexpected Behaviors
« Reply #639 on: September 04, 2017, 10:49:39 pm »
Hey,
Sometimes when I allow a file to run(permanent rule)and then exit the application the next time I want to run that tool again Rehips ask me and wants me to allow or block it.

Example: happened 2 times for Securemybit
Has any one this issue?
Either the application spawns a new process each time with a different hash or you didn't allow with the permanent option but instead used the allow once option.
thnx for the answer but I'm sure it was the permanent rule.
 IDK about hash...maybe that's why.

perisanboy

  • Jr. Member
  • **
  • Posts: 72
Re: Ask Questions Here - ReHIPS Features & Unexpected Behaviors
« Reply #640 on: September 05, 2017, 12:29:30 am »
I just found Rehips has only one weakness and that's hook attacks?honestly, idk what is it :) :P
But can you pls tell us how to secure our mahcine from these attacks?some one told me to don't set hooks but how?


HJLBX

  • Active Testers
  • Sr. Member
  • *****
  • Posts: 495
Re: Ask Questions Here - ReHIPS Features & Unexpected Behaviors
« Reply #641 on: September 05, 2017, 08:57:02 am »
I just found Rehips has only one weakness and that's hook attacks?honestly, idk what is it :) :P
But can you pls tell us how to secure our mahcine from these attacks?some one told me to don't set hooks but how?

https://msdn.microsoft.com/en-us/library/windows/desktop/ms632589(v=vs.85).aspx

  • Windows itself uses hooks
    3rd-party programs use hooks
    Hooking can be done in both the kernel and user mode
    ReHIPS uses no hooks except probably for some specific GUI\limited monitoring stuff (ask fixer)
    The hooks settings you find in ReHIPS are to enable\disable Windows hooks

1.  Operating System vulnerabilities (serious ones are very rare - the incidence is perhaps once every 10 years or more)
2.  Windows Hooks (advanced attack with probably the same incidence as No. 1)

If you can avoid it, don't set more hooks via ReHIPS GUI Settings\Configuration than what is already enabled by default; if you do not need default enabled hook(s), then disable them.
« Last Edit: September 05, 2017, 09:08:58 am by HJLBX »

aDVll

  • Active Testers
  • Hero Member
  • *****
  • Posts: 1119
  • Windows 10 latest 64 bit
Re: Ask Questions Here - ReHIPS Features & Unexpected Behaviors
« Reply #642 on: September 05, 2017, 11:55:36 am »
I just found Rehips has only one weakness and that's hook attacks?honestly, idk what is it :) :P
But can you pls tell us how to secure our mahcine from these attacks?some one told me to don't set hooks but how?
They probably meant having hook control on and the isolated program running on the real desktop. If you use the default setting with hook control and different desktop then nothing to worry about.

perisanboy

  • Jr. Member
  • **
  • Posts: 72
Re: Ask Questions Here - ReHIPS Features & Unexpected Behaviors
« Reply #643 on: September 05, 2017, 03:44:25 pm »
I just found Rehips has only one weakness and that's hook attacks?honestly, idk what is it :) :P
But can you pls tell us how to secure our mahcine from these attacks?some one told me to don't set hooks but how?

https://msdn.microsoft.com/en-us/library/windows/desktop/ms632589(v=vs.85).aspx

  • Windows itself uses hooks
    3rd-party programs use hooks
    Hooking can be done in both the kernel and user mode
    ReHIPS uses no hooks except probably for some specific GUI\limited monitoring stuff (ask fixer)
    The hooks settings you find in ReHIPS are to enable\disable Windows hooks

1.  Operating System vulnerabilities (serious ones are very rare - the incidence is perhaps once every 10 years or more)
2.  Windows Hooks (advanced attack with probably the same incidence as No. 1)

If you can avoid it, don't set more hooks via ReHIPS GUI Settings\Configuration than what is already enabled by default; if you do not need default enabled hook(s), then disable them.
Hello,
thanks for the answer.
I know it's rare because another guy told me the same but I just wanted to know if there is a fix or patch for it :D
Sorry, but where is that enabled Hook?do you mean lock down mode?


perisanboy

  • Jr. Member
  • **
  • Posts: 72
Re: Ask Questions Here - ReHIPS Features & Unexpected Behaviors
« Reply #644 on: September 05, 2017, 03:45:48 pm »
Quote
If you use the default setting with hook control and different desktop then nothing to worry about.
I see thanks for the info.