3 ms·

Tangential: Are there any good methods for windows/windows software? Hyper V is fine for small code, but if you want to install a program everytime it gets old

Tangential: Are there any good methods for windows/windows software? Hyper V is fine for small code, but if you want to install a program everytime it gets old really fast. I wouldn't want to trust random files off the internet either.

int0x29 1y ago
You can turn off win32k calls for a process if you don't need gui. You can also run the process with a lower privilege access token to reduce file access and some kernel access. I'd love to see one to block more kernel calls than just win32k. The best method I've come up with is to create a shared memory buffer to a seperate interface process and then unmount ntdll.dll by marking its pages `page_noaccess`. Thanks to win32 weirdness you can still allocate memory into the process without nt calls from the interface process as VirtualAllocEx, VirtualAlloc2, VirtualProtectEx, VirtualFreeEx, VirtualQueryEx, NtAllocateVirtualMemory, NtFreeVirtualMemory, etc take a process handle as an argument. This kinda requires writing a userspace kernel and your own standard library though. MS please give me a better method to lock down kernel access beyond nowin32k. Hyperv doesn't work for consumer apps as half the consumer versions of windows don't have it.
- mike_hearn 1y ago
  Windows has a fairly capable sandbox called app isolation levels: https://learn.microsoft.com/en-us/windows/win32/secauthz/appcontainer-for-legacy-applications- https://learn.microsoft.com/en-us/windows/win32/secauthz/app... Look at how Chrome does it if you want to learn more. The API is classic Win32 unfortunately: extremely complicated, under-documented and full of razor sharp edges. The way Chrome does it also requires custom installer logic. But, it does exist.
  - mwcampbell 1y ago
    Why do you say the way Chrome does it requires custom installer logic? Electron is able to use Chromium's sandbox for renderer processes without imposing any installer requirements as far as I know.
    - mike_hearn 1y ago
      That's a good question, I'm not sure how Electron does it. Chrome sets things up at install time with special permissions on its own files so the sandboxed processes can read them.
      - mwcampbell 1y ago
        Ah, OK. Honestly, it wouldn't surprise me if Electron made it work by weakening the sandboxing. Someone should look into that though before we assume that's the case.
- SpaghettiCthulu 1y ago
  Correct me if I'm wrong, but ntdll isn't magic. An attacker could just use raw syscall machine code, although they would need to pay close attention to the OS version.
  - int0x29 1y ago
    The goal to my madness was producing a binary without interrupts in any region of executable memory. Assuming W^X protection holds that should be pretty airtight. I was also assuming I controlled the compiler
homebrewer 1y ago
Years ago I was a heavy user of Sandboxie. But those were simpler times and malware was far less advanced than it is now. No idea how good of a protection it provides there days. https://en.wikipedia.org/wiki/Sandboxie https://en.wikipedia.org/wiki/Sandboxie
- wslh 1y ago
  Yes, a non-secure way of sandboxing is/was to hook OS functions. Hooking is used still today to modify the behaviour of existing apps and testing apps under custom virtual environments. We develop on of this that it us used in this Microsoft product[1]. [1] https://learn.microsoft.com/en-us/fslogix/overview-what-is-fslogix https://learn.microsoft.com/en-us/fslogix/overview-what-is-f...
cyanf 1y ago
There is windows sandbox: https://learn.microsoft.com/en-us/windows/security/application-security/application-isolation/windows-sandbox/ https://learn.microsoft.com/en-us/windows/security/applicati... Not available on the home edition of windows though.
masteruvpuppetz 1y ago
Virtual Box

int0x29 1y ago

You can turn off win32k calls for a process if you don't need gui. You can also run the process with a lower privilege access token to reduce file access and some kernel access. I'd love to see one to block more kernel calls than just win32k. The best method I've come up with is to create a shared memory buffer to a seperate interface process and then unmount ntdll.dll by marking its pages `page_noaccess`. Thanks to win32 weirdness you can still allocate memory into the process without nt calls from the interface process as VirtualAllocEx, VirtualAlloc2, VirtualProtectEx, VirtualFreeEx, VirtualQueryEx, NtAllocateVirtualMemory, NtFreeVirtualMemory, etc take a process handle as an argument. This kinda requires writing a userspace kernel and your own standard library though. MS please give me a better method to lock down kernel access beyond nowin32k. Hyperv doesn't work for consumer apps as half the consumer versions of windows don't have it.

mike_hearn 1y ago
Windows has a fairly capable sandbox called app isolation levels: https://learn.microsoft.com/en-us/windows/win32/secauthz/appcontainer-for-legacy-applications- https://learn.microsoft.com/en-us/windows/win32/secauthz/app... Look at how Chrome does it if you want to learn more. The API is classic Win32 unfortunately: extremely complicated, under-documented and full of razor sharp edges. The way Chrome does it also requires custom installer logic. But, it does exist.
- mwcampbell 1y ago
  Why do you say the way Chrome does it requires custom installer logic? Electron is able to use Chromium's sandbox for renderer processes without imposing any installer requirements as far as I know.
  - mike_hearn 1y ago
    That's a good question, I'm not sure how Electron does it. Chrome sets things up at install time with special permissions on its own files so the sandboxed processes can read them.
    - mwcampbell 1y ago
      Ah, OK. Honestly, it wouldn't surprise me if Electron made it work by weakening the sandboxing. Someone should look into that though before we assume that's the case.
SpaghettiCthulu 1y ago
Correct me if I'm wrong, but ntdll isn't magic. An attacker could just use raw syscall machine code, although they would need to pay close attention to the OS version.
- int0x29 1y ago
  The goal to my madness was producing a binary without interrupts in any region of executable memory. Assuming W^X protection holds that should be pretty airtight. I was also assuming I controlled the compiler

homebrewer 1y ago

Years ago I was a heavy user of Sandboxie. But those were simpler times and malware was far less advanced than it is now. No idea how good of a protection it provides there days. https://en.wikipedia.org/wiki/Sandboxie https://en.wikipedia.org/wiki/Sandboxie

wslh 1y ago
Yes, a non-secure way of sandboxing is/was to hook OS functions. Hooking is used still today to modify the behaviour of existing apps and testing apps under custom virtual environments. We develop on of this that it us used in this Microsoft product[1]. [1] https://learn.microsoft.com/en-us/fslogix/overview-what-is-fslogix https://learn.microsoft.com/en-us/fslogix/overview-what-is-f...

cyanf 1y ago

There is windows sandbox: https://learn.microsoft.com/en-us/windows/security/application-security/application-isolation/windows-sandbox/ https://learn.microsoft.com/en-us/windows/security/applicati... Not available on the home edition of windows though.

masteruvpuppetz 1y ago

Virtual Box