Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Introducing Windows Defender Application Guard for Microsoft Edge

blogs.windows.com

Post reply on HN
Print view View original

11–20 of 59 posts

Re: Introducing Windows Defender Application Guard for Microsoft Edge

#11

Post by tptacek »

jasonkostempski wrote: post #5

"We’re determined to make Microsoft Edge the safest and most secure browser." Then open source the whole thing, not just little parts of it. It has the lowest number of vulnerabilities in the National Vulnerability Database because it has the least number of eyes able to look for them.

It's been a little while since I was close to Microsoft (they were a client for a bit at Matasano), but: those people spend more on software security for WINMINE.EXE than a lot of startups do for their whole stack.

Would their software be safer if it was open source? Probably. Open code is rarely a loss for security. But it's not easy to say how much safer. Probably less than you think.

Re: Introducing Windows Defender Application Guard for Microsoft Edge

#12

Post by 0xFFC »

dahjelle wrote: post #8

Am I reading correctly: WDAGfME (for lack of a better acronum) is essentially starting a VM with a fresh copy of Windows for every site that it is protecting ? Does this happen for every open & protected tab/window? What kind of overhead does it have? The idea sounds similar to Qubes OS, with the exception that it's transparent to the user and doesn't have to be configured by the end-user. I presume this kills any of…

The idea of starting new fresh copy of Windows software stack for every site is kinda naive. I would say they are using something similar to Linux kernel namespace mechanism for sandboxing in Windows kernel, which is quite efficient and secure sandboxing without going through the pain of virtualization(Google uses this mechanism for implementing Android subsystem in ChromeOS). But how hyper-v fits to this equation, I don't know.Maybe something similar to docker service in hyper-v.

But anyhow this is quite amazing idea, Microsoft really tries hard to improve Edge.

The reason they can overcome technical difficulty of something this cool is because they have very consistent and very limited underlying platform (they don't have to support macOS, Linux, etc). Imagine how hard it would be for Firefox and chrome to pull off something similar.

>I presume this kills any of the offline-storage approaches?

Not necessarily, it depends on how they did implement this.

(I may be wrong,please correct me)

Re: Introducing Windows Defender Application Guard for Microsoft Edge

#16

Post by satysin »

dahjelle wrote: post #8

Am I reading correctly: WDAGfME (for lack of a better acronum) is essentially starting a VM with a fresh copy of Windows for every site that it is protecting ? Does this happen for every open & protected tab/window? What kind of overhead does it have? The idea sounds similar to Qubes OS, with the exception that it's transparent to the user and doesn't have to be configured by the end-user. I presume this kills any of…

My understanding (which could easily be wrong) is that it works similar to Sandboxie. However it looks like it is using the Hyper-V container functionality they recently announced.

So basically when you run this protected Edge session it starts the browser in a Hyper-V container, it has some read access to the host file system, registry, etc. but no write and when the session is closed everything else goes with it.

Re: Introducing Windows Defender Application Guard for Microsoft Edge

#17

Post by nickpsecurity »

The one good thing about this is that they're relying on Hyper-V. It may end up much more secure than solutions like Xen simply because Microsoft is investing in so much verification. That started with Verisoft project where they started using their VCC tool to verify the C-level source against specifications. They later extended the tool for assembly. The first report I saw indicated 20% was verified against its spec. So, it should get more robust overtime.

People interested in Microsoft Research's work on secure browsers should look at Gazelle browser and Xax plugin architecture:

https://www.microsoft.com/en-us/research/wp-content/uploads/...

https://www.microsoft.com/en-us/research/wp-content/uploads/...

Re: Introducing Windows Defender Application Guard for Microsoft Edge

#18

Post by daeken »

0xFFC wrote: post #12
dahjelle wrote: post #8

Am I reading correctly: WDAGfME (for lack of a better acronum) is essentially starting a VM with a fresh copy of Windows for every site that it is protecting ? Does this happen for every open & protected tab/window? What kind of overhead does it have? The idea sounds similar to Qubes OS, with the exception that it's transparent to the user and doesn't have to be configured by the end-user. I presume this kills any of…

The idea of starting new fresh copy of Windows software stack for every site is kinda naive. I would say they are using something similar to Linux kernel namespace mechanism for sandboxing in Windows kernel, which is quite efficient and secure sandboxing without going through the pain of virtualization(Google uses this mechanism for implementing Android subsystem in ChromeOS). But how hyper-v fits to this equation, I…

I see two options: 1) they're using Hyper-V and exposing a small number of hypercalls to allow for rendering and interaction. 2) they've overloaded the Hyper-V name for a user space sandbox.

I'm really hoping for the former, as it'll mean they finally might expose a KVM-esque API. That would mean a drastic change for virtualization dev on Windows.

Re: Introducing Windows Defender Application Guard for Microsoft Edge

#19

Post by nickpsecurity »

michaelbuckbee wrote: post #10
pjmlp wrote: post #6

Earlier quoted context omitted.

Yes, because it has helped OpenSSL a lot.

The point isn't that every open source app is awesome, it is that now you KNOW. You're directing snark towards OpenSSL presumably because you think it's a poorly coded. If it was closed source you might not even be aware of the issues and there certainly wouldn't be the open source efforts to code alternatives.

If it was closed-source, we would assume it had lots of issues until reviewed by a qualified, third party that we trust saying otherwise who also gives us signed hash for binary that was reviewed. The way it's been done in proprietary evaluations a long time. It would be done more if companies were actually interested in a real evaluation instead of a stamp that knocks out their liability. ;)

Under DOD's TCSEC criteria, the high-assurance systems (A1-class) also had to be delivered in source form to paying customers with evaluation evidence. They can check hashes/signatures, check the evaluation evidence themselves, and build it on site. So, vendors got paid large sums of money to develop the products, independent evaluation ensured you got some pentesting, and you could inspect the source yourself. My modification to the scheme involved evaluators with hacking background in mutually-suspicious countries working side-by-side with developers every step of the way.

Traditional open-source development is weak against all of these given there's usually a lack of qualified expertise or just people willing to dig into it. Just open-sourcing something gets people almost nothing in security. Has to be reviewed.

Re: Introducing Windows Defender Application Guard for Microsoft Edge

#20

Post by nickpsecurity »

tptacek wrote: post #11
jasonkostempski wrote: post #5

"We’re determined to make Microsoft Edge the safest and most secure browser." Then open source the whole thing, not just little parts of it. It has the lowest number of vulnerabilities in the National Vulnerability Database because it has the least number of eyes able to look for them.

It's been a little while since I was close to Microsoft (they were a client for a bit at Matasano), but: those people spend more on software security for WINMINE.EXE than a lot of startups do for their whole stack. Would their software be safer if it was open source? Probably. Open code is rarely a loss for security. But it's not easy to say how much safer. Probably less than you think.

I recall the Windows source leaked a long time ago. One programmer wrote an article on it saying it was actually good code. The problem areas seem to be little hacks they had littered everywhere to keep 3rd party hardware or software from breaking. My bookmark leads to a missing article that's not in Wayback Machine. Do you have a substitute link to a review by a qualified person who got to look at the source? I'd be interested in that.
Post reply on HN