5 ms·

I know that sandboxing is desirable here, but it runs as SYSTEM. How do you sandbox something running as SYSTEM? They must have changed the identity of Defender

I know that sandboxing is desirable here, but it runs as SYSTEM. How do you sandbox something running as SYSTEM? They must have changed the identity of Defender. That's all I can come up with. Anyone else know how this works?

staticassertion 8y ago
I can't speak to the exact implementation here, but you can just run specific components as system, and then the dangerous stuff (parsers, decompression, possibly emulation) as unprivileged. Here's one approach. https://blog.trailofbits.com/2017/08/02/microsoft-didnt-sandbox-windows-defender-so-i-did/ https://blog.trailofbits.com/2017/08/02/microsoft-didnt-sand...
hs86 8y ago
MS posted an image from Process Explorer: https://cloudblogs.microsoft.com/uploads/prod/sites/13/2018/10/windows-defender-av-sandbox.png https://cloudblogs.microsoft.com/uploads/prod/sites/13/2018/... Notice how the child process is running with an "AppContainer" integrity level.
- youdontknowtho 8y ago
  Thanks. It seems like this would be a good candidate for the virtualization based isolation that they built for protecting LSASS.
userbinator 8y ago
I believe it runs with even higher privileges than SYSTEM --- a while ago I had to deal with an unresponsive and 100%-CPU-consuming scanner process, which I tried to kill it from a command prompt running as SYSTEM, and it still said "access denied". I know the reasoning is "if SYSTEM can kill it then so can malware", but still a bit unsettling that there's processes running on your system that even the owner doesn't have privilege to control.
- ourmandave 8y ago
  ...but still a bit unsettling that there's processes running on your system that even the owner doesn't have privilege to control. Welcome to Windows 10 Home Edition!
  - tbronchain 8y ago
    Can you get higher system privileges on other editions?
  - ChrisSD 8y ago
    TrustedInstaller has existed since Vista.
  - crankylinuxuser 8y ago
    And to think, people actually pay money for this... It's like Android, but you pay. Worst of both worlds.
- deleted 8y ago
  [deleted]
- ChrisSD 8y ago
  The windows defender service only gives full control to TrustedInstaller (e.g. for Windows update) and WinDefend. However, SYSTEM can impersonate TrustedInstaller. Maybe this will change in the future but as of now it doesn't block malware unless the author didn't know what they were doing. IMHO, it's wrong to say that TrustedInstaller and WinDefend have "higher privileges" to SYSTEM as that is only true for specific files/executables and in most of those cases SYSTEM can take direct control even without impersonating them.
ape4 8y ago
It would need to be able to access every file on the machine.
vectorEQ 8y ago
the sandbox runs as system and redirects things where it allows by its policy, catchign all the lower privelege requests and where allowed converting them to requests to the lower system. So now you just have to exploit the sandbox process instead of the av process. i'm sure someone will do it sooner than later :')... it always ends in tears these things.
- ToFab123 8y ago
  "just"? You imply that is an easy task. It is not.

staticassertion 8y ago

I can't speak to the exact implementation here, but you can just run specific components as system, and then the dangerous stuff (parsers, decompression, possibly emulation) as unprivileged. Here's one approach. https://blog.trailofbits.com/2017/08/02/microsoft-didnt-sandbox-windows-defender-so-i-did/ https://blog.trailofbits.com/2017/08/02/microsoft-didnt-sand...

hs86 8y ago

MS posted an image from Process Explorer: https://cloudblogs.microsoft.com/uploads/prod/sites/13/2018/10/windows-defender-av-sandbox.png https://cloudblogs.microsoft.com/uploads/prod/sites/13/2018/... Notice how the child process is running with an "AppContainer" integrity level.

youdontknowtho 8y ago
Thanks. It seems like this would be a good candidate for the virtualization based isolation that they built for protecting LSASS.

userbinator 8y ago

I believe it runs with even higher privileges than SYSTEM --- a while ago I had to deal with an unresponsive and 100%-CPU-consuming scanner process, which I tried to kill it from a command prompt running as SYSTEM, and it still said "access denied". I know the reasoning is "if SYSTEM can kill it then so can malware", but still a bit unsettling that there's processes running on your system that even the owner doesn't have privilege to control.

ourmandave 8y ago
...but still a bit unsettling that there's processes running on your system that even the owner doesn't have privilege to control. Welcome to Windows 10 Home Edition!
- tbronchain 8y ago
  Can you get higher system privileges on other editions?
- ChrisSD 8y ago
  TrustedInstaller has existed since Vista.
- crankylinuxuser 8y ago
  And to think, people actually pay money for this... It's like Android, but you pay. Worst of both worlds.
deleted 8y ago
[deleted]
ChrisSD 8y ago
The windows defender service only gives full control to TrustedInstaller (e.g. for Windows update) and WinDefend. However, SYSTEM can impersonate TrustedInstaller. Maybe this will change in the future but as of now it doesn't block malware unless the author didn't know what they were doing. IMHO, it's wrong to say that TrustedInstaller and WinDefend have "higher privileges" to SYSTEM as that is only true for specific files/executables and in most of those cases SYSTEM can take direct control even without impersonating them.

ape4 8y ago

It would need to be able to access every file on the machine.

vectorEQ 8y ago

the sandbox runs as system and redirects things where it allows by its policy, catchign all the lower privelege requests and where allowed converting them to requests to the lower system. So now you just have to exploit the sandbox process instead of the av process. i'm sure someone will do it sooner than later :')... it always ends in tears these things.

ToFab123 8y ago
"just"? You imply that is an easy task. It is not.