Block untrusted fonts to keep your Network safe in Windows 10

Fonts seem innocent when on the computer. Most of the time, nosotros practise non fifty-fifty pay attending to the fonts on spider web pages except when they are besides difficult on eyes. But untrusted fonts on spider web pages may hold out misused past times hackers to compromise your network. This postal service explains how to block untrusted fonts inwards Windows 10.

While working locally, nearly all the fonts nosotros use, come upwards from the %windir%/fonts folder. That is, the fonts are installed into the Windows fonts folder when Windows or whatever other application is installed. These are trusted fonts together with practise non pose whatever threat. When nosotros meet such fonts on webpages, they are loaded from the local fonts folder.

But when the fonts on a webpage are non introduce on our reckoner – i.e., the local fonts folder – a re-create of that font is loaded into our computer’s memory, together with that is when a cybercriminal tin gain access to your network.

Dangers of untrusted fonts

When a spider web page utilizes a font that is already introduce inwards the local fonts folder, the browser picks upwards the fonts from the local folder to homecoming the webpage. Since the fonts inwards local font folder are scrutinized past times antivirus programs when existence installed, they practise non pose a threat.

When a website or webpage utilizes a font that is non introduce inwards local fonts directory or folder, browsers volition ask “elevated privileges” to charge a re-create of the fonts into local retentivity past times downloading them to the computer. Simple downloads are non much of an number equally the antimalware packages volition give away if the fonts incorporate whatever malware. There is no threat of malware amongst such fonts. The number is “elevated privileges” that tin hold out industrial plant life together with exploited past times the cybercriminals. If they receive got command of browser nether such a situation, they are capable of doing much impairment to non exclusively the reckoner only to the network equally a whole.

The best method is to avoid browsers from using “elevated privileges, ” together with that tin hold out done inwards Windows 10 past times blocking the fonts that are non introduce inwards the local folder. In such cases, the website volition hold out rendered past times substituting the untrusted website fonts amongst the trusted fonts i a local folder. This may, however, displace the webpage to homecoming improperly together with create problems acre printing.

Three states available for untrusted fonts inwards Windows 10

There are iii options available to you lot when it comes to untrusted fonts inwards Windows 10. They are:

1. Block the fonts
2. Audit mode: you lot practise non genuinely block the font, only you lot proceed a log that shows if untrusted fonts were loaded together with if yes, which website together with application used them
3. Exclusion of apps: You tin whitelist some of the apps on Windows 10 to travel untrusted fonts if you lot intend they won’t hold out a problem; For example, if you lot whitelist Word app, it tin utilize third-party fonts originating from the Internet fifty-fifty though you lot receive got blocked untrusted fonts

The best method, inwards my opinion, given the express number of options, is to block all untrusted fonts together with whitelist exclusively those apps that pose less threat via downloading fonts to local memory. Compared to browsers, apps similar Microsoft Word, Excel, etc. pose less of a threat equally when the fonts are downloaded, your anti-malware is triggered, together with if it finds anything objectionable, it volition give you lot a message or block the downloaded fonts. Browsers, on the other hand, are a complex architecture (relying on rendering engines together with processors, etc.) therefore fifty-fifty if the antimalware blocks fonts inwards memory, cyber criminals may soundless hold out able to receive got command of the auto easily.

Block untrusted fonts inwards an Enterprise

Using Registry Editor

To block untrusted fonts inwards Windows 10 together with to whitelist apps that tin travel untrusted fonts, you lot volition receive got to travel the Windows Registry Editor. As of now, in that location is no graphical user interface that makes it easier for the admins. The next explains how to block untrusted fonts inwards Windows 10.

1. 1. Press WinKey+R together with inwards the Run dialog that appears, type regedit together with hitting Enter key

• Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel\

• Look for the entry named MitigationOptions. If it is non there, create a QWORD entry of 64 fight together with cry it MitigationOptions

• There volition already hold out a value for the QWORD entry nosotros created; re-create glue the next values to BEFORE the value therefore that the value is in that location inwards towards the destination of value nosotros pasted.

• For turning off untrusted fonts, travel inwards 1000000000000. To run audit mode, travel inwards 3000000000000. To plough it off, travel inwards 2000000000000. For example, if in that location is a value of grand already inwards the QWORD nosotros created, it should expect 30000000000001000

• Close the registry editor, relieve piece of occupation inwards whatever other applications that mightiness hold out opened upwards together with reboot the computer.

As mentioned earlier, in that location may hold out problems viewing the websites or printing when you lot plough off untrusted fonts. To larn unopen to it, it is recommended that you lot download together with install the font manually into the %windir%/fonts folder. That volition larn inwards safer to browse the website using that font. Though you lot tin exclude or whitelist apps, it should hold out done exclusively if you lot tin install the fonts for some reasons.

Using Group Policy Editor

If you lot travel Windows 10 Enterprise together with Windows 10 Pro editions, you lot tin brand travel of the Local Group Policy Editor.

Run gpedit.msc to opened upwards the Local Group Policy Editor together with navigate to the next setting:

Computer Configuration > Administrative Templates > System > Mitigation Options.

In the correct pane, you lot volition see Untrusted Font Blocking. Select Enabled together with therefore guide Block untrusted fonts together with log events from the drop-down menu.

This safety characteristic provides a global setting to forestall programs from loading untrusted fonts. Untrusted fonts are whatever font installed exterior of the %windir%\Fonts directory. This characteristic tin hold out configured to hold out inwards 3 modes: On, Off, together with Audit. By default, it is Off together with no fonts are blocked. If you lot aren’t quite fix to deploy this characteristic into your organization, you lot tin run it inwards Audit manner to see if blocking untrusted fonts causes whatever usability or compatibility issues.

NOTE: This policy setting could brand your Icons & Fonts become missing inwards IE11.

Using EMET 5.5 together with later

Enhanced Mitigation Experience Toolkit straightaway lets you lot block untrusted fonts.

How to see log of apps accessing untrusted fonts

If you lot guide the audit method, you lot volition give away that none of the untrusted fonts are blocked. Instead, a log volition hold out created that you lot tin travel to see which app accessed which untrusted font type together with where, when, etc. details. To see the log, opened upwards Windows Event Viewer. Go to Application together with Service Logs/Microsoft/Windows/Win32k/Operational.

Under the EventID: 260, you lot volition give away all the log entries related to access of untrusted fonts past times dissimilar browsers together with apps during the runtime of the local computer. An instance of the final result log would hold out equally follows:

WINWORD.EXE attempted loading a font that is restricted past times font loading policy.

FontType: Memory

FontPath:

Blocked: true

This type of entry would hold out shown when you lot receive got completely blocked the untrusted fonts from loading on local computers. It also shows that download of untrusted font happened only was blocked past times the policy you lot created using the Windows Registry Editor.

Another instance could be:

Iexplore.exe attempted loading a font that is restricted past times font loading policy.

FontType: Memory

FontPath:

Blocked: false

In the inwards a higher house case, the untrusted fonts are non blocked equally shown past times the entry. It also shows that the browser attempted the download of the fonts to local retentivity together with was used.

The inwards a higher house explains untrusted fonts, dangers posed past times untrusted fonts together with finally, how to block untrusted fonts inwards Windows 10. If you lot receive got whatever doubts or anything to add, delight comment.

Source: TechNet.

Source: https://www.thewindowsclub.com/

Share This :