3 ms·

This is the reason I like the Qubes OS approach of opening PDF files in disposable VMs.

_8j50 4y ago
I also like Microsoft Defender application guard: https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-application-guard/test-scenarios-md-app-guard https://docs.microsoft.com/en-us/windows/security/threat-pro... You can open a PDF in edge inside a hyper-v contained environment. VBS in general is much better in windows. Qubes is the right direction for sure for nix though. But IMO a standard way of doing this is needed instead of a distro. Something like KVM contained cgroups? My wish is I could define rules where some execv syscall when matching would execute under a virtualized environment.
- GekkePrutser 4y ago
  The solution loses a bit of its shine coming from the company that created the tech for most weaponised documents though (VBA Macros)
  - _8j50 4y ago
    Meh, hardly the only attack vector, not even the biggest one these days. They made a lot of things. VBA Macros are very powerful and useful in the Excel world, those people are not learning python and writing scripts. O365 wasn't a thing then to make key distribution easier. But they do have signed macros now. The need for users to have smart documents that interact with the FS and processes on the system and talk to the local network was there and continues to be there. Evem libreoffice has their own macros that do similar things. The crappy part here is email, the almost 4 decade old tech they slap features on to no end. If there was a well thought out modern async federated messaginf service it should require attachment capability declaration so if the recipient org has a "no process exec" policy an attachment of any kind when opened would not be allowed to have child processes(zone indentifiers already enforce policies like this in windows).
- neodypsis 4y ago
  That's cool. Hopefully macOS implements something similar in the near future.
aaron695 4y ago
mike_hearn 4y ago
But this wasn't a PDF, it was a program that users were opening (maybe a program disguised to look like a PDF), so that wouldn't have helped here.
- ThePowerOfFuet 4y ago
  It absolutely would have helped; the containment (and in a disposable qube!) would have nullified the attack.
  - mike_hearn 4y ago
    If the user ensures the program runs in a separate Qube, but if they think it's a document presumably they won't do that. You can run every app in a totally isolated sandbox but only by breaking every kind of OS integration and inter-app interaction, which will often be a bigger problem than security.
    - ThePowerOfFuet 4y ago
      Your comment shows that you likely have never used Qubes in any substantial manner.

I also like Microsoft Defender application guard: https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-application-guard/test-scenarios-md-app-guard https://docs.microsoft.com/en-us/windows/security/threat-pro... You can open a PDF in edge inside a hyper-v contained environment. VBS in general is much better in windows. Qubes is the right direction for sure for nix though. But IMO a standard way of doing this is needed instead of a distro. Something like KVM contained cgroups? My wish is I could define rules where some execv syscall when matching would execute under a virtualized environment.

GekkePrutser 4y ago
The solution loses a bit of its shine coming from the company that created the tech for most weaponised documents though (VBA Macros)
- _8j50 4y ago
  Meh, hardly the only attack vector, not even the biggest one these days. They made a lot of things. VBA Macros are very powerful and useful in the Excel world, those people are not learning python and writing scripts. O365 wasn't a thing then to make key distribution easier. But they do have signed macros now. The need for users to have smart documents that interact with the FS and processes on the system and talk to the local network was there and continues to be there. Evem libreoffice has their own macros that do similar things. The crappy part here is email, the almost 4 decade old tech they slap features on to no end. If there was a well thought out modern async federated messaginf service it should require attachment capability declaration so if the recipient org has a "no process exec" policy an attachment of any kind when opened would not be allowed to have child processes(zone indentifiers already enforce policies like this in windows).
neodypsis 4y ago
That's cool. Hopefully macOS implements something similar in the near future.

aaron695 4y ago

mike_hearn 4y ago

But this wasn't a PDF, it was a program that users were opening (maybe a program disguised to look like a PDF), so that wouldn't have helped here.

ThePowerOfFuet 4y ago
It absolutely would have helped; the containment (and in a disposable qube!) would have nullified the attack.
- mike_hearn 4y ago
  If the user ensures the program runs in a separate Qube, but if they think it's a document presumably they won't do that. You can run every app in a totally isolated sandbox but only by breaking every kind of OS integration and inter-app interaction, which will often be a bigger problem than security.
  - ThePowerOfFuet 4y ago
    Your comment shows that you likely have never used Qubes in any substantial manner.