This year at TROOPERS16 in Heidelberg we welcomed James Forshaw for his talk about “The Joy of Sandbox Mitigations“.
He is a security researcher in Google’s Project Zero. He has been involved with computer hardware and software security for over 10 years looking at a range of different platforms and applications. With a great interest in logical vulnerabilities he has numerous disclosures in a wide range of products from web browsers to virtual machine breakouts as well as being a Pwn2Own and Microsoft Mitigation Bypass bounty winner. He has spoken at a number of security conferences including Black Hat USA, CanSecWest, Bluehat, HITB, and Infiltrate.
When researchers think of Microsoft Windows process mitigations they’re likely to come up with DEP and ASLR. However, Microsoft has been adding a number lesser known mitigations ranging from blocking Win32k system calls to reducing a sandbox’s attack surface which already assume RCE has been achieved. This presentation will describe the implementation of these less well known mitigations, some silly bypasses and bugs in their implementations as well as how you can use them in real world code to improve the security of your own applications.
The Assumption is, that the system is already compromised and with sandboxed applications it should be quite harder for the attacker to go further.
There are three points which Sandbox Mitigations are all about:
– Reducing the attack surface (f.e. less code -> less exploits possible)
– Increasing exploits costs (criminals need to investigate more money for getting more tricky exploits )
– Reducing Exploit reliability (Failing exploits, less vulnearable systems)
He started talking about simple problems like:
– calling malicious software “notepad.exe” and get policies enforced on it
– pointing to windows fonts folder and then to custom paths (bait n switch), which doesn’t lead to more problems at the moment
There are explicit and implicit mitigations.
Some explicit:
– Dynamic code policy
– Binary Signature policy
– Image Load Policy (Win10 Only)
– * some more
And the implicit:
– Blocking NTFS Mount Points
– Blocking NTFS Hard Links
– Blocking Process Device Map ( Bypass using Anonymous Token)
At the end, he made some nice recommendations for Win10, he calls it the
“Ultimate Set of Options for Win10”:
– Run with a lowbox token, ideally lowbox+restricted
– Disable dynamic code
– Only allow Microsoft signed images to be loaded
– Disable child process creation
– Win32k Lockdown, at least block custom fonts
– Prevent loading DLLs from untrsuted locations
There are many more mitigations coming up, also many unknown by the user per default.
For more details please look at the slides and video recording about his talk.
Kind regards,
Tom Wellinger