Risky Business #182 -- Major flaws in Microsoft's AppLocker

Presented by

This week's feature interview is a chat with Didier Stephens about his work in bypassing Windows-based whitelists.

You can read about Didier's work here and here.

You can really lock down Windows boxes by whitelisting what can run on them. You've got SRP -- or Software Restriction Poly, and you've got the Windows 7 feature AppLocker. Primarily they're designed to stop daft employees from installing malware-laden baby name generators and stuff like that, but some administrators have found this approach is quite effective at blocking malware.

After Stuxnet came along, for example, some admins turned to AppLocker for a bit of extra comfort. But as you'll hear, if your goal is preventing custom malware from running on your system, you're about to learn that AppLocker is pretty much useless.

Didier Stephens is based in Belgium, works as a security guy in the finance industry and enjoys doing unnatural things to Windows. He joined us by phone to discuss his latest party trick.

In this week's sponsor interview we're joined by Astaro's Jack Daniel. He joins us to discuss security for small to medium businesses. It seems that half the time their paying way too much for top level advice or being fleeced by charlatans. What's some practical advice for SME businesses?

In this week's new segment Adam Boileau and Patrick Gray discuss the HBGary hack.