Thinking Outside the Sandbox - Violating Trust Boundaries in Uncommon Ways
summary
Four concrete sandbox bypasses from Pwn2Own 2014 are dissected with root cause and fixes: a Flash use‑after‑free chains to presentation host elevation policy abuse that spawns medium‑integrity processes (zero‑day released); a save‑dialog logic flaw plus CRecovery store lets a low‑integrity renderer write a startup HTA; a Chrome broker accepts undocumented CBF clipboard format to instantiate COM controls and hit a DirectShow overflow; a typed‑array exploit uses an NTFS :$I30 stream to get a directory handle and create junctions to write startup executables. Each attack reproduces and is fixed by precise API/registry checks.
AI-written summary · about
chapters (23)
- 0:00Introduction
- 2:58whois Jasiel Spelman
- 3:38Don't let mitigations get in your way!
- 6:17Restricted Access Tokens
- 7:37Job Object Limitations
- 8:42Window Station and Desktop Isolation
- 10:03Mandatory Integrity Control
- 11:06Sandboxed Process Communication
- 12:16Attack Surface Archetypes
- 14:51Inter-Process Communication Handling
- 16:25Shared Resources
- 17:26Additional Vectors
- 18:12Uncommon Attack Vectors
- 18:30Internet Explorer Save As Dialog Sandbox Escape
- 19:38Save File Dialog Abuse
- 23:46Google Chrome Clipboard Sandbox Bypass
- 24:48Clipboard Abuse
- 28:19Internet Explorer Presentation test Sandbox Bypass
- 30:11Elevation Policy Abuse
- 33:39Google Chrome Symbolic Link Sandbox Escape
- 35:04Symbolic Link Abuse
- 38:56Conclusion
- 39:38Drives Next Evolution in Exploits
related talks
58msandboxes: no thy limit
36m"Playing in the Sandbox: Adobe Flash Exploitation Tales"
49m$Hell on Earth: From Browser to System Compromise
54mSubverting Apple Graphics: Practical Approaches to Remotely Gaining Root
43mThe Most Secure Browser? Pwning Chrome from 2016 to 2019
01h 16mClassic Vulnerabilities
01h 05mClassic Vulnerabilities
50mPwnie Awards 2016