The Windows Sandbox Paradox
summary
Windows 10 reshapes sandboxing: faster six‑month releases add features that both harden and widen attack surface. Concrete changes include app container capabilities, child app containers, arbitrary capability SIDs, and the win32k syscall filter; font loading moves to a user-mode font driver. Demonstrated exploits include symbolic‑link and section‑handle bypasses that are later patched, and a named/unnamed section permissions quirk. A custom GUI tool inspects access tokens, security descriptors and runs access‑checks to prove which mitigations actually stop escapes.
AI-written summary · about
chapters (17)
- 0:00Start
- 2:10Basic Requirements for Sandboxes
- 3:21Internet Explorer Protecting Mode Sandbox
- 8:05Owner Check
- 8:51Sam Boxing
- 12:27Abusing the Operating System Functionality
- 13:07What Has Changed from Microsoft Active Is Windows 10
- 14:31Time To Release
- 19:54Capability Seeds
- 24:35Mitigation Work
- 25:00Symbolic Links on Windows
- 28:03Explicit Mitigations
- 31:51Blocks Non System Fonts
- 32:34The User Mode Font Driver
- 37:57Sharing of Resources
- 39:53Demo
- 40:24Inspect Access Token
related talks
58msandboxes: no thy limit
41mThinking Outside the Sandbox - Violating Trust Boundaries in Uncommon Ways
40mDigging for IE11 Sandbox Escapes Part 2
57mDigging for IE11 Sandbox Escapes Part 1
44mModernize your Win32 application for security and privacy Q&A
51mAnalysis of the Attack Surface of Windows 10 Virtualization-Based Security
36mSandboxing Your Sandbox: Leveraging Hypervisors for WebAssembly Security
11mPlaying in the Sandbox: A Study on the Usability of Seccomp