Sign in with
Sign up | Sign in

An Intro To Sandboxing

Behind Pwn2Own: Exclusive Interview With Charlie Miller
By

Alan: Let’s talk a little bit of tech. Mac owners are often smug about their system being "more secure" and yet it would seem as if Chrome/Vista offered the most secure solution this year. A lot has been said about Chrome's "Sandboxing" model. How is this different from IE7's Protected Mode? What does Sandboxing really mean when Chrome's first exploit allowed remote applications to be launched from Java?

Charlie: Sandboxing helps quite a bit, if done properly. It’s one of the many exploit mitigation technologies being used. The idea is there will always be bugs and vulnerabilities in software, but you can make it difficult for attackers to get code running on the system and even if they do, limit the amount of damage that can be done. Basically, the attacker has to get code running and then figure out how to get out of (or break) the sandbox.

Alan: Interrupt me if I’m wrong. My understanding of it is that you compartmentalize the different parts of the application. Historically, the Web renderer is the point of entry, since that’s what interacts with the rest of the Internet. Once code is arbitrarily run, that application can then do all sorts of stuff like track keystrokes, format your hard drive, etc.

The idea behind sandboxing in a Web browser is that the application is split into different threads. The thread that manages user input/keystrokes is separated from the thread that deals with rendering the Web page. An application like Google Chrome will rely on the Windows security model to give the renderer zero privileges. That way, the randomly executed code by the “renderer thread” is blocked from accessing other stuff by the operating system. The “main browser thread” will only pull bitmaps from the renderer. So, even if you hacked into the renderer component, you couldn’t go any further than messing around with the text, pictures, etc.

The main weakness with relying on the sandbox, though, is that I could hack the renderer so the next time I went to a legit Web site, it altered the HTML so that I had a realistic “You Need a Newer Version of Flash” message. All of a sudden, I’m downloading a Trojan Horse and now I’m screwed.

Charlie: I don’t know the nuts and bolts of Chrome, but I imagine you could start a new renderer each time. I also think they use processes as opposed to threads.

[Alan’s Comment: Charlie is correct. Chrome uses processes instead of threads. The difference is that the memory space for each process is different--better sandboxing]

Ask a Category Expert

Create a new thread in the Reviews comments forum about this subject

Example: Notebook, Android, SSD hard drive

Display all 32 comments.
This thread is closed for comments
  • 2 Hide
    crisisavatar , March 25, 2009 7:28 AM
    he was born to kill
  • 6 Hide
    Niva , March 25, 2009 8:00 AM
    Blah, sad he didn't give an estimate to linux security. He said it has some method of protection but didn't expand on that much...

    As osx market share grows we'll see more exploits.
  • 0 Hide
    Silluete , March 25, 2009 8:12 AM
    Interesting thing about sandboxing, it's mean chrome more safe than other browser? or i missing something here?
  • 0 Hide
    lire210 , March 25, 2009 9:29 AM
    whats up mac
  • 1 Hide
    pcfxer , March 25, 2009 12:45 PM
    Chrome uses processes instead of threads. The difference is that the memory space for each process is different--better sandboxing.

    Processes have increased headroom: they are making a copy of local variables and structures at the time of "forking".

    Threads "fork off" as functional code and work with their own memory space... in a nutshell.

    Sandboxing doesn't mean that Chrome is safer, it does mean that if sandboxing is implemented correctly Chrome CAN be safer. Security is so relative ;) .
  • 4 Hide
    AlanDang , March 25, 2009 12:57 PM
    Exactly, Chrome is currently safer than any other web browser on Windows Vista or Windows 7. We have an upcoming interview that talks a little bit more about this, but we haven't made plans on a dedicated article. Is that something people are interested in?
  • 0 Hide
    echdskech , March 25, 2009 1:44 PM
    AlanDangExactly, Chrome is currently safer than any other web browser on Windows Vista or Windows 7. We have an upcoming interview that talks a little bit more about this, but we haven't made plans on a dedicated article. Is that something people are interested in?count me in A


    Count me in. Come to think of it, I spend more time on my browser than any other piece of software (except the OS ofcourse) at any given day. primarily because I use it both at work for research and for play (ie reading articles here). Also, trend these days seem indicate it becoming more and more a target rather than the OS.

    Would be extra nice if the level of detail would be like the articles you guys write when a new cpu architecture is discussed. =)
  • 0 Hide
    anthony lackey , March 25, 2009 2:50 PM
    There is less ppl attacking Mac's because they aren't the mainstream. Hackers would rather try to infect as many ppl as possible thats why they target PC users.
  • 0 Hide
    Anonymous , March 25, 2009 4:16 PM
    If Apple does not allow cloning mac os may be safe for a long while, nobody likes to be tied to a single hardware vender. I really don't see how Apple could pull more that 15% to 18% market share without clones. JMO.
  • 1 Hide
    dedhorse , March 25, 2009 4:25 PM
    Good interview. Makes up for that Mac review.
  • 0 Hide
    zodiacfml , March 25, 2009 5:16 PM
    count me in. :)  i've been using chrome since it came out.
    though, in my usage, they haven't fixed the issue with auto-hide taskbar in vista.
  • 0 Hide
    eddieroolz , March 25, 2009 5:27 PM
    Great read, nice article Alan!
  • 0 Hide
    4c1dr41n1 , March 25, 2009 7:18 PM
    What if I use a virtual machine? I could

    1) copy it, open it, surf the web, close it, delete the copy.
    2) copy it again, open it, use internet bank, close it, delete copy again.

    Nice enough sandboxing?
  • 1 Hide
    Herbert_HA , March 25, 2009 7:31 PM
    It's a very nice article, indeed.

    But please, stop using so many pages! It's a pain in the ass to keep clicking every 2 questions...and that was an small article, other have more than 10 pages, unnecessarily. I guess you people are trying to keep access numbers up, so you could sell more ads, but it's surely not user-friendly to have to load the same content over and over.
  • -4 Hide
    4c1dr41n4 , March 25, 2009 7:36 PM
    What if I use a virtual machine? I could

    1) copy it, open it, surf the web, close it, delete copy.
    2) copy again, open it, use internet banking, close it, delete copy again.

    Nice enough sandboxing?
  • 1 Hide
    nukemaster , March 25, 2009 9:12 PM
    4c1dr41n4What if I use a virtual machine? I could1) copy it, open it, surf the web, close it, delete copy. 2) copy again, open it, use internet banking, close it, delete copy again.Nice enough sandboxing?

    In that case, just mount a live linux CD image in the drive then use it. always clean, no need to del + copy.
  • -4 Hide
    Anonymous , March 25, 2009 10:05 PM
    Miller, page 4: "In neither case did I get root/admin access."

    In other words, he actually didn't hack the Mac.

    What in the world is this fraud? How can you say you 'pwned' a computer without root access?
  • 0 Hide
    TheFuzzball , March 26, 2009 12:50 AM
    God help us when Conficker becomes cross-platform :D 
  • 0 Hide
    Anonymous , March 26, 2009 1:43 AM
    I wish there was more Charlie's voice in this interview. Now Alan did the most of the talking and Charlie basically had to say yes or no. At least in the most important topics.

    Nice reading, but not perfect.
  • 1 Hide
    Anonymous , March 26, 2009 1:58 AM
    It's a little upsetting that he sidesteps the issue of linux on the grounds of granny's incompetence, does he expect granny to stay on top of vulnerabilities in all of her installed software on the windows or mac boxes, assuming she'd need more third party software sources on either of the other platforms than say ubuntu with it's repositories.
Display more comments