Protecting Windows Registry Directory and Hence Increasing the Security Level of the Windows Operating System

INTRODUCTION

---

Windows registry is one of the main components of the Windows 9x/ME, Windows CE, Windows NT/2000/XP/ 2003 and Windows Vista. It is used to store the system wide-resources which are naturally shared by all applications available in the system. Owing to its importance, most system-attackers tend to crack and alter the Registry settings in order to exploit the user`s system security. Thus most system administrators attempt to enhance their system security level by installing anti-virus, anti-spyware and firewalls and modifying the Registry settings as well. Anti-spyware software or tools which can is a cure for any spyware problems the most suggested solution where it monitors threads and removes it from the system as mentioned by Wu et al. (2007). But resulted from the study by Lee and Kozar (2008) only 10% users adopted to user the anti-spyware tool. Meanwhile, firewall also one of the option to ensure the security for the operating system where as an enhancement of using firewall discussed by Abassi and Fatmi (2008) and Pereira and Ordonez (2008). By modifying the registry settings, it is a risky action that might cause system instability. Any change to the registry settings will affect the stability of the operating system, even to the extent that the whole system could collapse owing to misconfiguration of this important component. Attackers can exploit the operating system easily, if the registry is not well-configured and well-protected. Protecting the registry manually is not a simple job. It requires a user or administrator who is really familiar with the Windows security architecture as well as the structure of the Windows Registry.

An automated tool is necessary to help the system administrator to secure their Windows operating system and optimize the system performance. An automated Windows Registry tool may reduce the system administrator`s workload and the time spent on configuring the Registry settings compared with the manual process. It can also optimize the system performance and allow an administrator to customize their system working environment preferences according to their needs or organization policy. Furthermore, the importance of Windows Registry in aiding the computer forensics are discussed by Kim and Hong (2008), Chang et al. (2007), Mee et al. (2006) and Carvey (2005).

The motivation for this research and development came from the problems identified by Lynette et al. (2007), who produced a framework that can be used to prevent injection attacks on Windows. There is also a statistical showing that malicious software can harm the Windows Registry by modifying all the data inside to hack or attack computers. In addition to being pervasive, malicious mobile codes tend to change in how they behave over time. A detection system must therefore be able to handle known as well as unknown threats (Mazeroff et al., 2008).

Inappropriate configuration of file-sharing features will also allow intruders, such as Nimda worms, to access critical system files and compromise them. Although Windows has several tools and options to customize system settings, such as the Control Panel, it only provides the user with entry level of customization. Third-party tools overcome these problems by developing their own Registry Tuning Tool, but most of them are not free and not cost-effective. Thus, it is important to develop a tool to overcome the identified problems and assist system administrators to configure their system Registry settings more easily and safely, thereby reducing system collapses owing to misconfiguration.

Overview of windows security: Windows NT security model tends to affect the entire Windows NT operating system. Windows Security acts as a central location, which verifies all access to, objects first, so that no application or user can access them without correct authorization. NT-based Windows have implemented the inter-process protection described by Viega and Vaos (2000) to ensure that a single process cannot directly access the memory which is allocated to other processes and also cannot directly access the memory in use by the operating system. This will greatly reduce the chances of error occurrence. The inter-process protection did not exist at all, however, in earlier 16-bit Windows. Because of that, the intruder can simply change the data in other programs since all programs share a single address space. Before developing a tool as a guard to secure an operating system, it is important to understand the system behavior itself. Most significant is the behavior related to the security-relevant input. System administrators can focus on a protection of that input to prevent unauthorized usage and the harm that can be caused by malicious users with unlimited resources can be avoided. Component of the NT-based windows are divided into two, user space and an operating system kernel. Most of the applications are executed in the user-level code, also known as user space, described by Viega and Vaos (2000) but occasionally it needs to make a call to the kernel if any application needs special services from the operating system. Kernels are where the operating system developers typically implement the security policies to manage access to devices, files, processes and objects. In short, the applications which are running in user space will experience the security restrictions that are implemented in the kernel. NT-based operating systems may have several different components in the kernel that make up the Windows security model. Each of them plays an important role within the overall NT security model to insure that the resources will only be available to the authenticated and authorized applications. Some of the NT`s biggest shortcomings are poor user authentication, a susceptibility to malicious code and lack of mandatory access control.

Overview of windows registry: The Windows Registry is universal, with a hierarchical information database where all entries can be accessed by keys which store the configuration data for the operating system to make it function properly. Each registry key has a security context attached to it which controls the access to the keys. In the earlier version of Windows (especially 16-bit Windows), the same information was stored in the text file. The organization of the text files, however, makes access to the settings slower. It is also unable to keep up with the increasing speed of current hardware technologies.

The Registry is organized as a tree where every entry is called a key and has an associated value. The Windows Registry is an effective data source for monitoring attacks because many attacks are detectable through anomalous Registry behavior. The Registry is not stored in a single file in the hard drive. Windows stores the Registry in a few separate binary files which is called Hives. The Hives have a different value which has a different purpose. Supported by Kim and Hong (2008), they also mentioned on threats that can happened in Registry that related to the forensic analysis from forensic related registry keys and suspect`s viewpoints. The Windows Registry contains three important components, which are the hives, keys and data entries. A Hive is similar to the root directory on a drive. It is the highest level in the Registry structure and therefore the hive cannot be a sub-hive inside another hive in the Registry. Hives` names have the prefix HKEY to show that it is a handler and contains the Keys (just as the files and directories are contained in a root directory).

Keys/Subkey are an organizational unit in the Registry and can contain data entries or further subkeys. A key will have either a Hive or Key as a parent above it. A Key`s name is not case-sensitive but it must be unique within a key or subkey. Sometimes Microsoft refer to the key as a sub-hive. Data Entries (Values), can be the instructions for how specified applications, devices or the operating system should behave. Data entries comprise three parts, the data entries name, data entries type and the data entries data.

Table 1:	The advantages and disadvantages of common tools

Windows Registry is related to the Windows Component. Windows Registry comprises a lot of settings including the control on the system to run services, launch applications, to use or to load some devices. Some of these settings may change or be updated depending on each time the system boots.

The Windows components that will modify the Registry settings include device drivers, hardware application and network protocol. A device driver is a piece of software that allows a hardware device to communicate with the operating system. The device drivers rely on Windows Registry to store and retrieve the configuration parameters and also to load the needed data during the system start-up. The Registry provides a centralized storage area for system resource information about IRQ settings, DMA channel and configuration settings for device drivers. Hardware is where the configuration and set-up information is stored in the Registry when the user installs certain hardware devices in their system. Application will store the related information, such as associated file extension, the application path and also the related uninstaller in the Registry for further reference. Protocol. Windows Registry is responsible for keeping track of a number of network protocol values, such as the internet proxy settings or MTU size in the system configuration.

Although the Registry is a powerful tool to customize the Windows settings, most system administrators would not make the Registry their first choice to customize the system. Inexperienced system administrators prefer to use the Windows utilities tools (such as the control panel) instead of using the Registry to reduce the risks while they are trying to customize Windows. Sometimes the administrator may inadvertently corrupt the Registry entries when they try manually to fix misconfiguration problems using a Registry editor. Using the specific tools to customize Windows is safer than using the Registry. Corrupted Registry settings can result in the operating system`s network connection being disabled, specified hard-drive partition or optical drive becoming inaccessible, or the system logging out a user upon any successful login and the danger is that the system administrators are forced to reinstall the operating system if the Registry corruption is too great and cannot be recovered. Table 1 shows the common tools chose by administrator in order to modify the Registry. These listed the advantage and disadvantages by using it.

Analysis: Compagna et al. (2007) emphasize that in a corporate world security is becoming an important asset, whereby customers are picking and choosing suppliers evidencing privacy and security practices. Security critical action is defined as an action which will compromise system security if it is conducted in an uncontrollable manner. Security is relevant to analysis inasmuch as an input will affect the behavior of at least one security critical action in the system and the type of input can vary from input from user, to input or read from file, network, environment variable and other processes to Windows Registry keys as mentioned by Du et al. (1999).

A registry key or value is security-relevant to the system if an improper change in its value can lead to violation of system security, including confidentiality, integrity, accountability and availability. Some of the registry keys high in security-relevance should be configured as protected resources to which the non-privileged user cannot make arbitrary modification. This can make the system more secure and avoid Registry misconfiguration problems caused by the unauthorized user.

The security action in Windows NT is categorized into two categories, which are non-security critical action and security critical action. For the non-security critical action, the input will not compromise the system security even though it is misconfigured. This project is more concerned with the security critical action as listed below and it is categorized by the target for which the actions are applied:

Executable: Program execution, load dynamic link library and executing procedure or invoking a service.

Permission or Privilege: The editing or modifying of the permission or privilege on a target. The target can be any file, folder, root drive or application.

File or directory: Action on the files and folders, including reads, writes and destroys.

Registry: Settings in the Registry. Usually refers to the access right on specific keys.

Network: The right to access the internet or network to connect to internet.

Process and Service: If the changing of a process or a service is inappropriate, it might cause denial-of-service problems.

Security policy: To determine the specific user privilege on the computer.

Four existing tools to modify Windows Registry that are currently available on the market are identified and analyzed: XP Smoker, Regtick, TweakUI and FitW. These four tools, as shown in Table 2, have their own advantages and disadvantages based on the criteria used. These tools may have their own characteristics, which include ease-of-use, rich settings, protection, etc as shown in Table 2. The degree of customization can be categorized into three levels, which are low, medium and high. Applications which provide fewer than fifty registry settings will be accorded the low degree of customization. Applications which provide more than fifty but fewer than 100 settings will be categorized as medium. Applications which provide more than 100 registry settings will be categorized as high.

Most of the tuning tools categorize the registry settings into a few categories, either categorized by characteristics, such as restriction and performance, or by the domain that the settings will perform, such as Explorer, Internet or Startup.

Table 2:	Comparisons between four existing tools

Excellent categorization will use both methods to classify the settings, such as categorizing the settings according to the settings characteristic and then grouping the category with the domain that the registry settings will perform. Average categorization will only apply one of the two methods that are listed above for grouping the registry settings. Poor categorization will neither group the registry settings with the characteristic, nor group them with the domain that the settings will use. Ease-of-use is one of the important characteristics that will influence the user acceptance of the application. Excellent ease-of-use software will be designed in a more understandable form with good labeling policies, such as easy-to-understand, meaningful and representative names for the settings provide full descriptions to the user of the effect of registry key settings which are going to change and provide complete user guide documentations to the users to increase the application usability. Average level of ease-of-use software may use good labeling policies, user guide documentations, but lack registry settings description which will make it hard for the users to understand the system. Poor level of ease-of-use software is lack of documentation and settings description. Some of them do not even apply good labeling policies and thus make the system harder to learn.

Interface design has been classified into three levels. Using the group box properly to group similar registry settings together, applying good interface layout design policy during the design phase and applying systematic interface design will fall into the excellent interface design level. For the moderate level, the similar settings are not grouped properly or good interface layout policy was not applied in the user interface design. Poor interface design may not apply any of the requirements stated above.