Slashdot Mirror
Microsoft Claims PowerShell Now More Secure (wired.com)
An anonymous reader quotes Wired:
Last year, well over a third of the incidents assessed by security firm Carbon Black and its partners involved some sort of PowerShell component. But as network defenders catch on to Microsoft's recent release of additional PowerShell protections, the attack sequences that exploit PowerShell are finding some long-overdue resistance... PowerShell 5.0, released last year, added a full suite of expanded logging tools... While it's no panacea, and doesn't keep attackers out, the renewed focus on logging aids flagging and detection. It's a baseline step that helps remediation and response after an attack is over, or if it persists long-term... And PowerShell's recent defense improvements go beyond logs. The framework also recently added "constrained language mode," to create even more control over what commands PowerShell users can execute... The security industry at large has also made strides to determine what baseline normal activity for PowerShell looks like, since deviations could indicate malicious behavior.
Lee Holmes, Microsoft's principal software design engineer for PowerShell, says they've been "laser-focused on security since the very first version," adding that they're now moving towards a more enlightened approach.
"You can focus harder on protecting against breaches and defense in depth, but the enlightened approach is to assume breach and build the muscle on detection and remediation -- make sure that you're really thinking about security end-to-end in a holistic manner."
Lee Holmes, Microsoft's principal software design engineer for PowerShell, says they've been "laser-focused on security since the very first version," adding that they're now moving towards a more enlightened approach.
"You can focus harder on protecting against breaches and defense in depth, but the enlightened approach is to assume breach and build the muscle on detection and remediation -- make sure that you're really thinking about security end-to-end in a holistic manner."
shows how it is not secure.
Microsoft can say what they want, but we all know that absolutely nothing in Windows is secure. If you want security, your only real option is to run a Linux distribution like Devuan that doesn't use systemd. Hope that helps.
The parent contains no sustance, just unverified claims with no links to the alleged source. It might as well just say 'fp' but that is the quality of posts you get from users like turkeydance, creimer, drinkypoo, and MightyMartian. Please do your part to encourage better posting on Slashdot by modding the parent -1 troll.
That is easy. I would have been impressed had MS managed to make to less secure.
Oh its secure, probably because by the time i have the shell opened i have already chosen a different method, dogshit slow because its built on .NET crap, at least cmd opens in 1sec
And more than have the PS commands I look up don't work.
Let's start with the operative sentence: "...doesn't keep attackers out, the renewed focus on logging aids flagging and detection. It's a baseline step that helps remediation and response after an attack is over, or if it persists long-term..." Really? Gee - thanks, Mister! After the damage is done - long-term, BTW -we'll have logs! Logs solve everything! Dumbass....
Thinks putting "power" in their miserable noobware makes it powerful. MS is complete rubbish.
Layers and layers of proprietary rubbish. COM and dotNet are two of the worst ideas ever.
Have we already forgotten about the notorious Shellshock bug that affected something like 25 years worth of releases of GNU Bash?
MS has been the uncrowned queen of "just barely good enough to make money" forever and people were too stupid to recognize that and stay away. Now they can easily get away with it. Take these new promises for what they are worth: nothing at all.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
While it's no panacea, and doesn't keep attackers out...
Well I'm sold! Say no more!
Anons need not reply. Questions end with a question mark.
What class of users should be allowed access to powershell but not to all the commands ? I struggle to imagine that powershell is the domain of anyone who doesn't merit full access to the computer. OK maybe they do exist, but I can't see it being a lot of people. And besides, if the restrictions only apply to powershell people who can grasp powershell have the wherewithal to find other ways to get around them.
Nullius in verba
Get-AppxPackage -allusers | Remove-AppxPackage
Need I say more?
If you can have a random program remotely run executables with different credentials and elevated privileges in a scripting tool, you've screwed something up.
These exploits are the equivalent of setting the setuid bit on /bin/bash
Custom electronics and digital signage for your business: www.evcircuits.com
The war is over. The black hats won.
"You can focus harder on protecting against breaches and defense in depth, but the enlightened approach is to assume breach and build the muscle on detection and remediation"
Translation: we can't even figure out how to protect Windows from security breaches.
You don't. This is why you need to set-execution policy remote signed or allsigned off before you can do anything useful.
http://saveie6.com/
How about stopping this from happening ?
C:\Windows\system32>p^ow^er^sh^el^l
Windows PowerShell
Copyright (C) 2009 Microsoft Corporation. All rights reserved.
PS C:\Windows\system32>
The powershell signing situation always baffled me.
To run a powershell script, you must sign it. Which is of course terribly inconvenient, but hey, at least it is secure.
Except you can disable the restrictions easily, so easily in fact that a would be attacker need only do one very minor thing prior to their script having to execute for all this to not matter, and that minor thing is readily accessible through a .bat or .cmd script (which I have seen professional software do even, temporarily relax the policy then re-enable when done, without a user having to approve/explicitly do it manually).
It's a way to vigorously say 'we were focused on security' and all the inconvenience for people to feel 'yep they thought about security' and arrive at a completely useless protection against attackers.
XML is like violence. If it doesn't solve the problem, use more.
Of course a cmd/bat file can merrily do that as a prelude to an evil powershell script, so the execution policy is only annoying to legit users without being a significant problem to those that would use ps1 as an attack vector.
It would be maybe something if ps1 content could execute in some context that cmd/bat files could not (e.g. the way microsoft put activex everywhere), but they know better than to even try that. So they have something that would have mitigated problems they had with ActiveX, but also a reluctance to even risk it anywhere where ActiveX was a unique threat...
XML is like violence. If it doesn't solve the problem, use more.
Powershell was already more usable, more powerful and far FAR more secure than any Linux shell, so Microsoft upping the ante here just goes to show once again how top down cathedral style development is a better way to develop software than any shitty "bazaar".
The problem with PowerShell is in its basic design. Merging an embeddable scripting language and a shell is just a lousy idea. How do we know that? Because people in the UNIX world have tried it for decades and it failed every single time. It failed because, among many other problems, securing such a thing is really hard, as Microsoft is discovering. It also failed because creating such a Swiss army knife of a tool means that each individual function just isn't very well supported, and that simple things get more complex than they need to be.
It reminds me of the never-ending claims that "Windows <fill-in-the-version> is the most secure Windows ever".
CUR ALLOC 20195.....5804M