Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Introducing Windows Defender Application Guard for Microsoft Edge

blogs.windows.com

Post reply on HN
Print view View original

41–50 of 59 posts

Re: Introducing Windows Defender Application Guard for Microsoft Edge

#41

Post by transpute »

Two related projects, both with copy-on-write "forks" of disk storage and OS memory, creating disposable VMs with hardware-enforced memory isolation.

Cappsule (open-source for Linux), https://cappsule.github.io

  virtualize any software on the fly (e.g. web browser,
  office suite, media player) into lightweight VMs called 
  cappsules. Attacks are confined inside cappsules and 
  therefore don’t have any impact on the host OS. 
  Applications don’t need to be repackaged, and their usage 
  remain the same for the end user: it’s completely 
  transparent. Moreover, the OS doesn’t need to be 
  reinstalled nor modified.
Bromium (proprietary for Windows, based on open-source Xen), https://blogs.bromium.com/2016/09/26/introducing-virtualizat...

  Bromium and Microsoft partnered in 2015 
  .. extends VBS – isolating the execution of targeted 
  applications such as the browser, documents, executables, 
  downloads, attachments and media files .. to all 
  vulnerable applications on all Windows 7, 8 and 10 
  endpoints

Re: Introducing Windows Defender Application Guard for Microsoft Edge

#42

Post by jlgaddis »

daeken wrote: post #18
0xFFC wrote: post #12

Earlier quoted context omitted.

The idea of starting new fresh copy of Windows software stack for every site is kinda naive. I would say they are using something similar to Linux kernel namespace mechanism for sandboxing in Windows kernel, which is quite efficient and secure sandboxing without going through the pain of virtualization(Google uses this mechanism for implementing Android subsystem in ChromeOS). But how hyper-v fits to this equation, I…

I see two options: 1) they're using Hyper-V and exposing a small number of hypercalls to allow for rendering and interaction. 2) they've overloaded the Hyper-V name for a user space sandbox. I'm really hoping for the former, as it'll mean they finally might expose a KVM-esque API. That would mean a drastic change for virtualization dev on Windows.

Maybe I'm misunderstanding the question, but the article clearly describes that they're using Hyper-V to launch a separate instance of the kernel and the browser in a "container" (which is later "discarded").

Re: Introducing Windows Defender Application Guard for Microsoft Edge

#44

Post by lawnchair_larry »

nickpsecurity wrote: post #28
chrismorgan wrote: post #4

Fewest vulnerabilities: I suspect that Chrome and Firefox being open source is a factor here. Thus it seems possible to me that they actually have fewer vulnerabilities than Edge—Edge’s just haven’t been found yet. This is pure speculation on my part; I have no evidence nor any investigation, deep or otherwise.

"Edge’s just haven’t been found yet." Haven't been introduced and haven't been found. It's both. Microsoft's SDL has dramatically reduced number of 0-days in their products. I speculate that eliminating many common vulnerability classes also eliminates a lot of the low-hanging fruit that's easiest to spot in the binaries by reverse engineers. They have potential to raise the security even higher if they apply MS Rese…

You're kind of talking out of your ass here, fyi. They have been introduced and they have been found. Don't underestimate Google's resources on chrome. Especially considering that many Google security folks were previously at MS.

Re: Introducing Windows Defender Application Guard for Microsoft Edge

#45

Post by santaragolabs »

tptacek wrote: post #11
jasonkostempski wrote: post #5

"We’re determined to make Microsoft Edge the safest and most secure browser." Then open source the whole thing, not just little parts of it. It has the lowest number of vulnerabilities in the National Vulnerability Database because it has the least number of eyes able to look for them.

It's been a little while since I was close to Microsoft (they were a client for a bit at Matasano), but: those people spend more on software security for WINMINE.EXE than a lot of startups do for their whole stack. Would their software be safer if it was open source? Probably. Open code is rarely a loss for security. But it's not easy to say how much safer. Probably less than you think.

As someone who spent a lot of time in the past 5 years at MSFT and also at tons of other firms doing security work / SDL-work on code bases; there are very few companies where a giant C/C++ code base is getting even close to the quality of Microsofts.

And indeed; very few companies spent as much money as Microsoft on their entire SDL. Sadly never had the chance to get a look into Google's kitchen but I'm hearing that they're great too.

They're also not dealing with the kind of backwards compatibility that Microsoft is dealing with which helps them out a lot too.

Re: Introducing Windows Defender Application Guard for Microsoft Edge

#46

Post by nickpsecurity »

lawnchair_larry wrote: post #44
nickpsecurity wrote: post #28

Earlier quoted context omitted.

"Edge’s just haven’t been found yet." Haven't been introduced and haven't been found. It's both. Microsoft's SDL has dramatically reduced number of 0-days in their products. I speculate that eliminating many common vulnerability classes also eliminates a lot of the low-hanging fruit that's easiest to spot in the binaries by reverse engineers. They have potential to raise the security even higher if they apply MS Rese…

You're kind of talking out of your ass here, fyi. They have been introduced and they have been found. Don't underestimate Google's resources on chrome. Especially considering that many Google security folks were previously at MS.

Im not sure what comment you read as I mentioned they both have 0-days and that number of them dropped sharply due to SDL. The numbers available prove both. Even more true given attackers are focusing on common applications more than Windows itself. That's because they're easier to attack than Windows code.

Re: Introducing Windows Defender Application Guard for Microsoft Edge

#47

Post by WorldMaker »

chrismorgan wrote: post #4

Fewest vulnerabilities: I suspect that Chrome and Firefox being open source is a factor here. Thus it seems possible to me that they actually have fewer vulnerabilities than Edge—Edge’s just haven’t been found yet. This is pure speculation on my part; I have no evidence nor any investigation, deep or otherwise.

Edge's JS engine (Chakra) has had the majority of itself open sourced (ChakraCore). Given how central the JS engine is to overall browser security, I wonder if that changes your suspicions at least a bit?

Re: Introducing Windows Defender Application Guard for Microsoft Edge

#49

Post by dsp1234 »

0xFFC wrote: post #12
dahjelle wrote: post #8

Am I reading correctly: WDAGfME (for lack of a better acronum) is essentially starting a VM with a fresh copy of Windows for every site that it is protecting ? Does this happen for every open & protected tab/window? What kind of overhead does it have? The idea sounds similar to Qubes OS, with the exception that it's transparent to the user and doesn't have to be configured by the end-user. I presume this kills any of…

The idea of starting new fresh copy of Windows software stack for every site is kinda naive. I would say they are using something similar to Linux kernel namespace mechanism for sandboxing in Windows kernel, which is quite efficient and secure sandboxing without going through the pain of virtualization(Google uses this mechanism for implementing Android subsystem in ChromeOS). But how hyper-v fits to this equation, I…

The Windows Container architecture is explained at https://msdn.microsoft.com/en-us/virtualization/windowsconta...

This looks like a use of those containers for running edge processes.

Re: Introducing Windows Defender Application Guard for Microsoft Edge

#50

Post by ksk »

nickpsecurity wrote: post #26
ksk wrote: post #24

Earlier quoted context omitted.

Yes, it leaked during the Win2K release cycle I believe. And you're probably thinking about the kuro5hin website, where someone claimed to have analyzed it. ( http://webcache.googleusercontent.com/search?q=cache:3BlVJSk... ) >One programmer wrote an article on it saying it was actually good code. "one programmer" commenting about 30+ million lines of code. Yeah. uh-huh. Anyway, you can still find the kernel's source…

"Yes, it leaked during the Win2K release cycle I believe. And you're probably thinking about the kuro5hin website, where someone claimed to have analyzed it. " Yeah, my inability to evaluate the skill level or character of source was main drawback of claim. I gave a little credence to it because I knew that they were ramping up QA due to image problems and potential lost sales. Steve Lipner... who did high-assurance…

>Will do. Appreciate the tip.

CDCFKW.zip not saying anything.. just sayin :P

Post reply on HN