sR6uWE

More documents

Recommendations

Info

CONCLUSION• Simplistic sandbox architecture• Reduced IPC messages– Adobe Reader (200+) vs MS Office (38)• Sandbox Internals– No desktop isolation– No job (UI) restrictions• IPC Mechanism– 2 read-AVs– Directory-traversal• What to expect…– Not much changes• 1 new ICP messages• New CreateProcessW() option• Still a good sandbox (kernel-bugs aside)…Labs.mwrinfosecurity.com | © MWR Labs 50
REFERENCES• Yason, Mark Vincent. "DIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOX". [Online]https://www.blackhat.com/docs/asia-14/materials/Yason/WP-Asia-14-Yason-Diving-Into-IE10s-Enhanced-Protected-Mode-Sandbox.pdf.• Forshaw, James. "IE11 Sandbox Escapes". [Online]https://github.com/tyranid/IE11SandboxEscapes.• Keetch, Tom. "Practical Sandboxing on the Windows Platform". [Online]https://www.hackinparis.com/slides/hip2k11/12-EscapingWindowsSandboxes.pdf.• MSDN. "How to: Configure Microsoft Error Reporting". [Online] Microsoft Corporation.https://msdn.microsoft.com/en-us/library/office/bb219076(v=office.12).aspx.• MSDN. "Naming Files, Paths, and Namespaces". [Online] https://msdn.microsoft.com/enus/library/windows/desktop/aa365247(v=vs.85).aspx.• Vreugdenhil, Peter. "ADOBE SANDBOX: WHEN THE BROKER IS BROKEN". [Online]https://cansecwest.com/slides/2013/Adobe%20Sandbox.pdf.• Ionescu, Alex. "New Security Assertions in Windows 8". [Online] http://www.alexionescu.com/?p=69.• ………Labs.mwrinfosecurity.com | © MWR Labs 51
Page 1 and 2: UNDERSTANDING THE MICROSOFT OFFICE
Page 3 and 4: Outline• Introduction• Sandbox
Page 5 and 6: INTRODUCTION• Sandboxing 101- Wik
Page 7 and 8: MS OFFICE 2013 PROTECTED-VIEW SANDB
Page 9 and 10: OperatingINTERNALS: ARCHITECTUREBro
Page 11 and 12: INTERNALS: ARCHITECTURE• Elevatio
Page 13 and 14: OperatingINTERNALS: ARCHITECTUREBro
Page 15 and 16: INTERNALS: INITIALIZATIONMSO.sub_00
Page 17 and 18: INTERNALS: INITIALIZATIONLowIntegri
Page 19 and 20: INTERNALS: RESTRICTIONSFile Locatio
Page 21 and 22: INTERNALS: RESTRICTIONS• Capabili
Page 25 and 26: IPC: INTERNAL OBJECTSThreadMgr Obje
Page 27 and 28: IPC: MESSAGE FORMATMessage HeaderMe
Page 29 and 30: IPC: MESSAGE 0X001000• No message
Page 31 and 32: IPC: MESSAGE 0X091000Message Body f
Page 33 and 34: IPC: MESSAGE 0X0C1000• Windows Er
Page 35 and 36: WER ServerIPC: MESSAGE 0X0C1000Wind
Page 37 and 38: IPC: MESSAGE 0X0C1000• Issue 2: D
Page 39 and 40: IPC: MESSAGE 0X0C1000• DemoLabs.m
Page 41 and 42: IPC: MESSAGE 0X0F1000• “Microso
Page 45 and 46: MS OFFICE 2016: SANDBOX INTERNALS
Page 47 and 48: MS OFFICE 2016: IPC 0X161000• New
Page 49: MS OFFICE 2013 PROTECTED-VIEW SANDB

sR6uWE

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?