Shao
Rìu Chiến Vàng Chấm
Hardentools - là một tập hợp các tiện ích đơn giản được thiết kế để vô hiệu hóa một số “tính năng” được hiển thị bởi hệ điều hành (hiện tại là Microsoft Windows) và các ứng dụng dành cho người tiêu dùng chính.
Những tính năng này, thường được cho là đối với khách hàng Doanh nghiệp, thường vô dụng đối với người dùng thông thường và thay vào đó gây nguy hiểm vì chúng rất thường bị kẻ tấn công lạm dụng để thực thi mã độc hại trên máy tính của nạn nhân. Mục đích của công cụ này chỉ đơn giản là giảm bề mặt tấn công bằng cách vô hiệu hóa quả treo thấp.
Hardentools dành cho những cá nhân gặp rủi ro, những người có thể muốn có thêm mức độ bảo mật với mức giá của một số khả năng sử dụng. Nó không dành cho môi trường công ty.
Generic Windows Features
• Disable Windows Script Host. Windows Script Host allows the execution of VBScript and Javascript files on Windows operating systems. This is very commonly used by regular malware (such as ransomware) as well as targeted malware.
• Disabling AutoRun and AutoPlay. Disables AutoRun / AutoPlay for all devices. For example, this should prevent applications from automatically executing when you plug a USB stick into your computer.
• Disables powershell.exe, powershell_ise.exe, and cmd.exe execution via Windows Explorer. You will not be able to use the terminal, and it should prevent the use of PowerShell by malicious code trying to infect the system.
• Sets User Account Control (UAC) to always ask for permission (even on configuration changes only) and to use “secure desktop.”
• Disable file extensions mainly used for malicious purposes. Disables the “.hta”, “.js”, “.JSE”, “.WSH”,.”WSF”, “.scf”, “.scr”, “.vbs”, “.vbe” and “.pif” file extensions for the current user (and for system-wide defaults, which is only relevant for newly created users).
• Shows file extensions and hidden files in explorer.
• Windows Defender Attack Surface Reduction (ASR). Enables various remediations using ASR starting with Windows 10 / 1709 (Block executable content from email client and webmail, Block Office applications from creating child processes, Block Office applications from creating executable content & from injecting code into other processes, Block JavaScript or VBScript from launching downloaded executable content, Block execution of potentially obfuscated scripts, Block Win32 API calls from Office macro). Needs the following prerequisites to work: (1) Windows 10 version >= 1709, (2) You are using Windows Defender Antivirus as the sole antivirus protection app. (3) Real-time protection is enabled in Windows Defender.
Microsoft Office
• Disable Macros. Macros are at times used by Microsoft Office users to script and automate certain activities, especially calculations with Microsoft Excel. However, macros are currently a security plague, and they are widely used as a vehicle for compromise. With Hardentools, macros are disabled, and the “Enable this Content” notification is disabled, too, to prevent users from being tricked.
• Disable OLE object execution. Microsoft Office applications can embed so-called “OLE objects” and execute them, at times also automatically (for example, through PowerPoint animations). Windows executables, such as spyware, can also be embedded and executed as an object. This is also a security disaster that we observed used time and time again, particularly in attacks against activists in repressed regions. Hardentools entirely disables this functionality.
• Disabling ActiveX. Disables ActiveX Controls for all Office applications.
• Disable DDE. Disables DDE for Word and Excel
Acrobat Reader
• Disable JavaScript in PDF documents. Acrobat Reader allows executing JavaScript code from within PDF documents. This is widely abused for exploitation and malicious activity.
• Disable execution of objects embedded in PDF documents. Acrobat Reader also allows the execution of embedded objects by opening them. This would normally raise a security alert, but given that legitimate uses of this are rare and limited, Hardentools disables this.
• Switch on the Protected Mode (enabled by default in current versions)
• Switch on Protected View for all files from untrusted sources
• Switch on Enhanced Security (enabled by default in current versions)
What’s New
Please download and use "hardentools.exe" for normal use cases.
Changes since 2.1:
removed functionality in "restore" that deleted registry keys which have not been saved during harden. If you hardened your system with a (really) old version of hardentools, best first restore with an older version (<= 2.1) and then harden with this version again.
Compiled with golang 1.18.3 to include all security fixes, even if hardentools seems not be affected (by e.g golang/go#52574)
Activation of Microsoft Defender PUA Protection added (enabled by default)
Improved CLI version
UAC with password prompt now (see #46 )
now makes sure that all other UAC registry settings are set correctly (which they are by default)
Title Release: Hardentools.2.2
Developer: Home Page
License: FreeWare
OS: Windows
Then, you will see the main Hardentools window. It's very simple, you just click on the "Harden" button, and the tool will make the changes to your Windows configuration to disable a set of features that are risky. Once completed, you will be asked to restart your computer for all the changes to have full effect.
Note: You can select the expert settings checkbox to be able to select or deselect specific harden measures. Please only use this if you know what you are doing.
In case you wish to restore the original settings and revert the changes Hardentools made (for example, if you need to use cmd.exe), you can simply re-run the tool and instead of an "Harden" button you will be prompted with a "Harden again (all default settings)" and a "Restore..." button. Selecting "Restore" will start reverting the modifications. "Harden again" will first restore the original settings and then harden again using the default settings. This comes in handy if you have started a newer version of hardentools and you want to make sure the most current features are applied to your user.
Please note: the modifications made by Hardentools are exclusively contextual to the Windows user account used to run the tool from. In case you want Hardentools to change settings for other Windows users as well, you will have to run it from each one of them logged in.
Những tính năng này, thường được cho là đối với khách hàng Doanh nghiệp, thường vô dụng đối với người dùng thông thường và thay vào đó gây nguy hiểm vì chúng rất thường bị kẻ tấn công lạm dụng để thực thi mã độc hại trên máy tính của nạn nhân. Mục đích của công cụ này chỉ đơn giản là giảm bề mặt tấn công bằng cách vô hiệu hóa quả treo thấp.
Hardentools dành cho những cá nhân gặp rủi ro, những người có thể muốn có thêm mức độ bảo mật với mức giá của một số khả năng sử dụng. Nó không dành cho môi trường công ty.
FeaturesGeneric Windows Features
• Disable Windows Script Host. Windows Script Host allows the execution of VBScript and Javascript files on Windows operating systems. This is very commonly used by regular malware (such as ransomware) as well as targeted malware.
• Disabling AutoRun and AutoPlay. Disables AutoRun / AutoPlay for all devices. For example, this should prevent applications from automatically executing when you plug a USB stick into your computer.
• Disables powershell.exe, powershell_ise.exe, and cmd.exe execution via Windows Explorer. You will not be able to use the terminal, and it should prevent the use of PowerShell by malicious code trying to infect the system.
• Sets User Account Control (UAC) to always ask for permission (even on configuration changes only) and to use “secure desktop.”
• Disable file extensions mainly used for malicious purposes. Disables the “.hta”, “.js”, “.JSE”, “.WSH”,.”WSF”, “.scf”, “.scr”, “.vbs”, “.vbe” and “.pif” file extensions for the current user (and for system-wide defaults, which is only relevant for newly created users).
• Shows file extensions and hidden files in explorer.
• Windows Defender Attack Surface Reduction (ASR). Enables various remediations using ASR starting with Windows 10 / 1709 (Block executable content from email client and webmail, Block Office applications from creating child processes, Block Office applications from creating executable content & from injecting code into other processes, Block JavaScript or VBScript from launching downloaded executable content, Block execution of potentially obfuscated scripts, Block Win32 API calls from Office macro). Needs the following prerequisites to work: (1) Windows 10 version >= 1709, (2) You are using Windows Defender Antivirus as the sole antivirus protection app. (3) Real-time protection is enabled in Windows Defender.
Microsoft Office
• Disable Macros. Macros are at times used by Microsoft Office users to script and automate certain activities, especially calculations with Microsoft Excel. However, macros are currently a security plague, and they are widely used as a vehicle for compromise. With Hardentools, macros are disabled, and the “Enable this Content” notification is disabled, too, to prevent users from being tricked.
• Disable OLE object execution. Microsoft Office applications can embed so-called “OLE objects” and execute them, at times also automatically (for example, through PowerPoint animations). Windows executables, such as spyware, can also be embedded and executed as an object. This is also a security disaster that we observed used time and time again, particularly in attacks against activists in repressed regions. Hardentools entirely disables this functionality.
• Disabling ActiveX. Disables ActiveX Controls for all Office applications.
• Disable DDE. Disables DDE for Word and Excel
Acrobat Reader
• Disable JavaScript in PDF documents. Acrobat Reader allows executing JavaScript code from within PDF documents. This is widely abused for exploitation and malicious activity.
• Disable execution of objects embedded in PDF documents. Acrobat Reader also allows the execution of embedded objects by opening them. This would normally raise a security alert, but given that legitimate uses of this are rare and limited, Hardentools disables this.
• Switch on the Protected Mode (enabled by default in current versions)
• Switch on Protected View for all files from untrusted sources
• Switch on Enhanced Security (enabled by default in current versions)
What’s New
Please download and use "hardentools.exe" for normal use cases.
Changes since 2.1:
removed functionality in "restore" that deleted registry keys which have not been saved during harden. If you hardened your system with a (really) old version of hardentools, best first restore with an older version (<= 2.1) and then harden with this version again.
Compiled with golang 1.18.3 to include all security fixes, even if hardentools seems not be affected (by e.g golang/go#52574)
Activation of Microsoft Defender PUA Protection added (enabled by default)
Improved CLI version
UAC with password prompt now (see #46 )
now makes sure that all other UAC registry settings are set correctly (which they are by default)
Title Release: Hardentools.2.2
Developer: Home Page
License: FreeWare
OS: Windows
How to use it
Once you double-click on the icon of 'hardentools.exe', depending on your Windows privileges, you are asked if you want to run Hardentools with administrative privileges. If you select "No" only a subset of the harden features is available, but you can also use hardentools if you have only restricted privileges to harden your user account. If you select "Yes", depending on your Windows security settings, you should be prompted with an User Access Control dialog asking you confirmation to allow Hardentools to run. Click "Yes".
Then, you will see the main Hardentools window. It's very simple, you just click on the "Harden" button, and the tool will make the changes to your Windows configuration to disable a set of features that are risky. Once completed, you will be asked to restart your computer for all the changes to have full effect.
Note: You can select the expert settings checkbox to be able to select or deselect specific harden measures. Please only use this if you know what you are doing.
In case you wish to restore the original settings and revert the changes Hardentools made (for example, if you need to use cmd.exe), you can simply re-run the tool and instead of an "Harden" button you will be prompted with a "Harden again (all default settings)" and a "Restore..." button. Selecting "Restore" will start reverting the modifications. "Harden again" will first restore the original settings and then harden again using the default settings. This comes in handy if you have started a newer version of hardentools and you want to make sure the most current features are applied to your user.
Please note: the modifications made by Hardentools are exclusively contextual to the Windows user account used to run the tool from. In case you want Hardentools to change settings for other Windows users as well, you will have to run it from each one of them logged in.
