Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add whitelist based on file path and file hash #21

Open
Proposer233 opened this issue Dec 5, 2024 · 3 comments
Open

Add whitelist based on file path and file hash #21

Proposer233 opened this issue Dec 5, 2024 · 3 comments

Comments

@Proposer233
Copy link

Sometimes, some annoying antivirus software forcibly injects their dynamic link library into every process. Thankfully, MP can stop this. But at the same time, the protected applications don't work properly. I tried to sign my antivirus with a user certificate, but due to its protection mechanism, I couldn't copy any files into the directory where it was installed. In this regard, I hope that MP can implement a "special case whitelist" by adding both the file path and the file hash to the MP configuration data

@DavidXanatos
Copy link
Contributor

Oh that's an interesting edge case, will need to look into it...
I think here the most expedient implementation would be to have a user signed database of whitelisted hashes, with or without a path restriction.
Blanked whitelisting of a path without hashing would be not secure.

Also I'm looking into adding the ability to add trusted certificates such that you only would need to whitelist the antivirus software vendors certificate to allow all its files.

@Proposer233
Copy link
Author

Proposer233 commented Dec 6, 2024

Oh that's an interesting edge case, will need to look into it... .

AVAST

@DavidXanatos
Copy link
Contributor

DavidXanatos commented Dec 24, 2024

In the next build under C:\ProgramData\Xanasoft\MajorPrivacy
will be the folder mpsig
containing suo bolders with file names of the signed files in which will be SHA_HASH.mpsig files where the filename is the full hash of the file

So no path whitelisting but the ability to have the mpsig files collected separately from the signed exes and dlls

also the *.sig files will be renamed to *.mpsig to no longer confligt with otehr *.sig file usages

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants