Windows XP A brief intro, to Gimp surfing(How-To negate almost all hostile internet attacks)

[Zhoul]

This post is a bit lengthy and I already assume 50% of you havn't gotten to this word 'here', in the very first sentence, before clicking back. BUT! There is hope. The real 'content' of this entire post is a section called "How-to Evolve into a Gimp-Surfer" . CTRL+F and search for that string if you'd rather not read the bulk of what is below




A brief intro to Gimp surfing (How-To negate almost all hostile internet attacks and remain God):

Well, I've lost the write-up I created for muckshifter, which was some-what a response to his recent article, entitled "Protecting yourself against Adware and Spyware"

(located here)
https://www.pcreview.co.uk/articles/Windows/Protection_against_Adware_and_Spyware/


But, this theory is so important to me, that I'll re-create it a 3rd time (yep, I had written 3/4ths a novel to Muck and as my finger passed over the ESC key, reaching for my smokes, my lifes work, well.. at least the last 2 1/2 hours of it, was lost here


- Just what is this... "Gimp Surfing"

Gimp Surfing is just a name that I've given to the Windows verion of a method that's long been used in the Unix/Linux scene, but was not made readily available to windows users until recently. I'm a proud Gimp surfer, and I hope, after this write-up, you will be too



The Issue:

Since the dawn of Windows logon and security, not one person has ever wanted anything less then quick admin access to their own PC. But the way that Microsoft approached security is almost bass-ackwards, when looked at by the logical eye. All the software companies out there only add fuel to the fire, both by infecting you, and charging you to remove such infections (only to re-infect you once more). This isn't some big scheme to undo you and only you. It's just a big scam to keep creating 'new , wonderful technology' that is hard to keep up with.

That aside, lets continue


The Theory:

So we all want to be Gods (admins) of our own machines, but each time you run a program, you're running it with an admin account. If that program has *ANY* way to communicate with the outside world (in or out, server or client), then it will eventually get hacked. Such things as Torrent Clients, Web Browsers, Mail Clients, and even game clients/servers are just a *few* of the things we all run as admins. This is why people have started getting software firewalls, and active virus scanners. Because they don't feel safe, leaving their PC running for 2+ weeks, while they're away on vacation.

All these scanners would be great if...
- They didn't take so many resources
- They didn't conflict with eachother
- They didn't remove programs which are Flag Ships to their own company...
(http://www.bbspot.com/News/2005/01/microsoft_antispyware.html)
- They didn't act like nannys cleaning up after a bunch of 3 year olds... and acted more like teachers and advisors.


So the age-old theory on a unix box, to solve this very issue, was to launch servers/clients, using a separate set of credentials. This makes perfect sense! Let's look at 2 different examples:


Example 1:
On a unix machine, I decide to create a web server. This will open up port 80 "to the world" (as I'll naturally use the default HTTP port). All a web server does, is 'deliver' requested data to a client of some sort. If you've ever used the telnet application, you might know that you can actually connect and interact with nearly *any* server type program, reguardless the port it's on. (i.e. telnet www.google.com 80). This means that things other then your average web client (like IE or firefox) will be accessing my gaping hole to internet land. If someone can successfully connect and send something to my server that will cause an over-flow (something that shouldn't happen, but is a result of humans trying to code), then that person now has an Administrator account shell, to my system.

Hmph.. That is, unless I run the web server application using a different user, that only has specific access to the files/locations it *needs* to function. If I were to create such a gimp user and someone did gain shell access, they'd be severely gimped themselves. Yeah, they can compromise my web server now, but at least they can't take me out where it hurts. I could even go as far as creating separate users for each 'server' I run, i.e. Gimp_FTP, Gimp_WWW, but usually, admins will group several applications into a logical 'group' and use 1 username for that group.



Example 2:
Ok, so we all now know that 'servers' are easily hacked, simply because they do all but call you on your home phone, asking to be hacked, what with their static IP's and 'standard' port numbers (not to mention the fact that most server apps broadcast their software name/version upon connection). But what about the clients? I mean, it can't be as bad, can it? As you've seen with all the recent explosions of spyware/adware, it can actually be worse. This example details my revelation, or shall I say, transfer of knowledge in "Gimp Surfing".

I have a job that takes me away from my house 8-10 hours a day and a girlfriend that loves those damn IQ tests. When she first started using my PC, I'd come home just waiting to see what new game, err, spyware she'd managed to come across that day. You see, I'm a Network Manager, so I actually like seeing the style (or lack there of) that these spyware/adware creators have obtained. It did, however, impose on my usual Everquest time and the active scanners I would run when I left weren't doing the trick. Eventually, something would get in and I'd have to jump in and take it out.

The OS that I run today, is actually a living, breating, entity itself. It has been upgraded from Win 3.1 > 95 > 98 > 98SE > 2000 > XP. In all that time, I've never had to re-install and each new PC I get, inherits this being as it's new OS. With the type of spyware out there these days, it was becoming obviously apparant that I'd have to divise a way to save one of my oldest friends (yes, I mean the OS

I've often heard the suggestion that we should just create a gimp account, and use *that* account "as much as possible". But we all know that's nothing more then a hinderance. 2 profiles and would have to logoff/logon to install software or minor updates? ha!


RunAs - Not 'just' a Network Junkies Tool:

If you drop out to a DOS shell and type runas (2k/XP), You'll see some output as to the use of this extremely useful tool. It was mostly created so that a network admin could sit down at a real gimp's PC, and preform admin functions without having to logoff, or interrupt the PC in any major way, also functioning as a remote admin gateway. It's real usefulness, however, is the exact opposite of that. It can be used to run local programs, as a gimp user.

 

[Zhoul]

Pt 2

How-to Evolve into a Gimp-Surfer:

Below, is a list of steps I trodded through in order to turn my Windows Internet Exploiter, into a real-live, "Won't bite you in the @55" web client. This theory can be applied to nearly any software, as I've done with my Torrent Client, FTP Server, and streaming audio server.


--- The Birth of a Gimp ---

- Login to your XP/2k machine as "An" administrator. Most likely, you already are one. It doesn't specifically have to be "Administrator" who logs in though.
- Right-click "My Computer", Left-Click "Manage"
- Expand the "Local Users and Groups" tree
- Right-click on the "Users" folder, Left-click "New User"
- I'm going to use the name "gimp" in this example, although you are free to use what you wish. I do suggest that you don't use spaces in the username. (this notoriously causes 'flaws' in certain areas of computing in general.)
- Fill in Username/Full Name(different from admin name)/Password/Confirm Password
- For the password, I recommend something you never, ever use. Simply because you won't really need to type it but once or twice hence forth (and it can always be changed if months later, you forget it).
- Un-check "User must change password at next logon"
- Check "User cannot change password"
- Check "Password Never Expires"
- Just incase, make sure "Account Disabled" is left un-checked.

--- It's Alive! ---

- Now all that's left is to bring this entity to life. To do this, we need to login the new gimp account once, so it's profile is created. (Yes, Windows *is* actually doing a few more things on the first login, then each successive login there after).
- Copy/paste the rest of this guide to a document or text file, and place it directly on the C drive. (This is so you can access it while logged in as Gimp.)
- Logoff your admin account.
- Now login to your newly created gimp account. Dont worry, to the 50% or so of you who are currently rebooting, as opposed to simply logging off.... we'll wait... we got time....
- Ok, I think we're all back... Our mission is completed, but while we're here, go ahead and 'clean up' the default profile.
- I highly suggest loading the Windows Classic theme, and removing all the special features you can (such as animated scrolling). *Most* of these settings won't actually matter or be visible once we're done here, and you'll hopefully *never* see this gimps desktop again. In short: The smaller the 'profile', the less resources it will take to run it.

--- Back to Playing God ---

- Logoff again, then login as you normally would (admin acct, or whatever)
- Right-click your desktop, click "New", then "Shortcut"
- Most of you will be able to copy/paste the below data directly into your shortcut, however, some of you might have to use your knoggins and sluth abilities to find the proper paths.

*The Shortcut* - XP Default
C:\WINDOWS\System32\runas.exe /savecred /user:"Gimp" "C:\Program Files\Internet Explorer\IEXPLORE.EXE"

*The Shortcut* - 2k Alternative
C:\WINNT\System32\runas.exe /savecred /user:"Gimp" "C:\Program Files\Internet Explorer\IEXPLORE.EXE"

- Quick explination:
We are invoking Runas.exe, using /savecred (which will cause it to prompt you for the password once, then not again after that), specifying the local user "Gimp" as the 'runas' target, then invoking Internet Explorer with that set of security credentials.

- Click "Next"
- Name it "Internet Explorer", then click "Finish"
- Bah, the icon even looks gimp... Right-click it, Left-click Properties
- Click "Change Icon", Click OK to the duh message
- Click "Browse"
- Find Iexplore.exe (usually in C:\program files\internet explorer\) and use one of these.
- Click "Ok" then "Ok"...


--- Go Get Em' Tiger ---
- Supposedly, a super-being known as God, gave us 'free will'. It's now your turn to play god and give Gimp his own free will.
- Disable ALL virus scanners and adware/spyware active scanners (or, leave them up if you're not quite convinced).
- Go to the *worst* spyware site you know... I could suggest a few, but I'm pretty sure their content is grounds for removal from this forum, therefore, I'll leave this one up to you.
- Surf and actually try to infect yourself... After 15-20 minutes of trying, close all instances of Internet Explorer.
- Load up your favorite Spyware/Adware scanners and lets see what we've got.
- You'll most likely find nothing more then a bunch of cookies. It *may* even find some evil 'spyware', but thats only the payload data. Gimp couldn't install solitare if he wanted to, so the spyware is inactive, dead. Since I've done this, I've only had to remove a minor 'bug' that seeped through, and I've seriously gave it my all to try to infect myself.


Simply put, Gimp does not have access to change many things on the system, therefore, when asked to do so, he will only reply with a grim look. Now we don't need to actively scan for crap, because we're stopping it before it gets there (or, before it 'worms' its way into a nesting spot).

There are a few 'flaws', which are easily overcome.

1. You will notice that all your internet settings, favorites, etc etc etc are GONE!!
- They're not gone, they're just sitting in that *other* profile you've been using all this time. You can copy darn near all profile data over to the new gimp, however (although, I highly *highly* recommend *NOT* copying your old profile over top your new profile. Be picky.)
- You can find this data in C:\documents and settings\<username> - I'll list a few directories of interest you may want to copy.

C:\Documents and Settings\<user>\Favorites
C:\Documents and Settings\<user>\Application Data - Most likely wont have anything in it that matters, but I had to copy a folder from here to my gimp account, when I started running my torrent client using gimp. This was only so I didn't have to re-configure it.
C:\Documents and Settings\<user>\Cookies - This contains all your 'auto login' information for web pages.

2. You'll notice, that when you 'save to desktop' from the internet, that the item doesn't appear on your desktop! OMG!!!
- It's appearing on Gimp's desktop. Simply create a shortcut on God's desktop to Gimp's desktop and the problem is solved.

3. You'll notice that you don't have install permissions! OMG! Cant install anything from the web anymore?!
- You can.. just run Iexplore.exe by itself, using its old icon. Install the web software, and Gimp can access it once he closes all his IE windows and re-opens them.
- At first this seems like a pain, but realllly, how many times has IE installed software you actually wanted? I could count the times on my old shop teachers left hand, and hes only got 4 fingers.

4. You'll notice you can no longer save to your "usual" downloads folder or other paths.
- Simply open up my computer, right click on the folders and add Gimp, or the Users group to the access/rights list. You can even give Full rights to the account for most folders (i.e. downloads, or documents folders).
- Try not to set *too* many individual securities, however. Try to set entire drives or root folders, instead of 1000 individual folders under it.
- NEVER give Gimp or Users any more access then they already have, to system folders, including c:\windows and c:\documents and settings
- If you give gimp access to God's profile path, it'd be much easier for a hacker/sour program to get in.
- When we did /savecred on the runas command earlier, Windows basically saved this password in plain text, to your registry, however, Gimp cannot access that, unless someone were to unknowingly give him access to it.

5. Hmm... Well this sh%t is pretty cool Zhoul, but I sometimes have trouble determining if I'm using an 'admin' version, or the gimp version. A lil help here?
- Sure. In the registry, is a key that sets the title of your Internet Explorer window. It's used by people like AOL/Mindspring/etc, to 'Label' it with their company name. Let's use it to our advantage...
- On your god account, click 'Start' , 'Run' , and type 'regedit'
- *WARNING* - It's very easy to screw something up here, so get yourself a cup of coffee hoss... Do some jumping jacks... whatever it takes to not screw this part up

- First and foremost: Whenever dealing with registry 'updating', SAVE FIRST!
- Click "File" , Click "Export"
- **IMPORTANT** - Make sure you put a tick in the "All" option, in the bottom-left of this dialogue. If we only save the 'selected branch', well, that could be 1/10,000 of your registry.
- Save the file in a logical location (pfft, where ever, just remember it for when/if you call tech support hehehe)

- Navigate to this path...

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main

- If you've clicked on the "Main" folder, you should have a long list of entries to the right.
- Find "Window Title" , then double-click it
- This is going to change your admin account title. I've set mine to this "!! - Warning - !! Using non-secure IE window."
- Make it something that will catch your eye...
- Now we could change gimp's , without having to log-out, but that'd just take too long to explain.
- Logoff admin, login gimp, make the same update, different title, and you're done



A few other things may seem weird at first, but once you Gimp for a few days, you'll never go back. But unlike a Microsoft update, this one is *easily* reversable =). If you like what it seems to do for you, I suggest replacing *all* Internet Explorer icons with clones of the shortcut we created earlier. This will, for the most part, stop other people from running the admin version. If you need to run it, you can easily double click on iexplore.exe yourself (and they can be open simultaniously, might I add).


- Zhoul

Imagine, the possibilities... and then imagine what your possibilities could imagine...