World of EUC

What's the consensus on the "Virtual Channel Allow list" setting?  Are we disabling it?  Using it with some known list?

I disable it. Zero chance I want to manage a list that changes every time Webex does something stupid.

Doubt there is a consensus on it. Hear some with it enabled and manage a list. I have it disabled because I have a few dictation products across different clients that I know I have to work through before I can enable it. Hasn't been a top priority project.

I think I agree with Nick.  I was just curious what others are doing.

we also managed the list for a while, but recently we also put them on disabled

Here you will find "Known 3P Channels" <https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/secure/virtual-channel-security#known-third-party-virtual-channels>

I have always hated that page because it's useless. "Here are the known third party virtual channels... but we're not going to tell you what they actually are".

Of course, ControlUp is also missing from the list as a big one. I know our various dictation software packages are also not listed, but they probably aren't as widely known/used as ControlUp.

Pretty much everyone is turning that off.  Has there ever been an attack that hijacked those virtual channels?

Can we consider Webex changing theirs and not telling anyone an attack?

Logging got better in the newer releases <https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/policies/reference/ica-policy-settings/virtual-channel-allow-list-policy-settings.html#virtual-channel-allow-list-logging|https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/policies/reference/ica-po[…]licy-settings/virtual-channel-allow-list-policy-settings.html>

Usually I enable the log for a few days and then configure the whitelist after checking the logs with Posh

That's fine and all, but Citrix should include the actual channel names in their document since they already know them. Forcing everyone to rely on the logs just to get the values is just a waste of everyone's time.

I hated having to maintain my own list:

```	CTXMM,C:\Program Files (x86)\Windows Media Player\wmplayer.exe
	PSPSBEX,C:\Program Files\Nuance\DMO\SoD.exe
	PMICIIB,C:\Program Files\Nuance\DMO\SoD.exe
	PSPMIX,C:\Program Files\Nuance\DMO\SoD.exe
	NUCAAUX,C:\Program Files\Nuance\DMO\SoD.exe
	NUACOM,C:\Program Files\Nuance\DMO\SoD.exe
	NUAPLAY,C:\Program Files\Nuance\DMO\SoD.exe
	NUAREC,C:\Program Files\Nuance\DMO\SoD.exe
	CSCOTM,C:\Program Files\Cisco Spark\dependencies\teamshvdagent.exe
		-This is missing a virtual channel. Look for picadd entries in event log when testing 2203 LTSR
			-May be this:
				CSCOMT,C:\Program Files (x86)\Webex\Webex\Meetings\meetingshvdagent.exe
	BJNBLUE,C:\Program Files\BlueJeans\current\BlueJeans.exe
	BJNLOGS,C:\Program Files\BlueJeans\current\BlueJeans.exe
	EPCUSER,C:\Program Files (x86)\Epic\vW.X\Shared Files\EpicVCHelperWX.exe,C:\Program Files (x86)\Epic\vY.Z\Shared Files\EpicVCHelperYZ.exe
	EPCUSR2,C:\Program Files (x86)\Epic\vW.X\Shared Files\EpicVCHelperWX.exe,C:\Program Files (x86)\Epic\vY.Z\Shared Files\EpicVCHelperYZ.exe
		-Warp Drive: <https://galaxy.epic.com/?#Browse/page=1!68!50!1591155,1591190,1601681,1591198&amp;from=Galaxy-Redirect>```