Behind Pwn2Own: Exclusive Interview With Charlie Miller

An Intro To Sandboxing

Alan: Let’s talk a little bit of tech. Mac owners are often smug about their system being "more secure" and yet it would seem as if Chrome/Vista offered the most secure solution this year. A lot has been said about Chrome's "Sandboxing" model. How is this different from IE7's Protected Mode? What does Sandboxing really mean when Chrome's first exploit allowed remote applications to be launched from Java?

Charlie: Sandboxing helps quite a bit, if done properly. It’s one of the many exploit mitigation technologies being used. The idea is there will always be bugs and vulnerabilities in software, but you can make it difficult for attackers to get code running on the system and even if they do, limit the amount of damage that can be done. Basically, the attacker has to get code running and then figure out how to get out of (or break) the sandbox.

Alan: Interrupt me if I’m wrong. My understanding of it is that you compartmentalize the different parts of the application. Historically, the Web renderer is the point of entry, since that’s what interacts with the rest of the Internet. Once code is arbitrarily run, that application can then do all sorts of stuff like track keystrokes, format your hard drive, etc.

The idea behind sandboxing in a Web browser is that the application is split into different threads. The thread that manages user input/keystrokes is separated from the thread that deals with rendering the Web page. An application like Google Chrome will rely on the Windows security model to give the renderer zero privileges. That way, the randomly executed code by the “renderer thread” is blocked from accessing other stuff by the operating system. The “main browser thread” will only pull bitmaps from the renderer. So, even if you hacked into the renderer component, you couldn’t go any further than messing around with the text, pictures, etc.

The main weakness with relying on the sandbox, though, is that I could hack the renderer so the next time I went to a legit Web site, it altered the HTML so that I had a realistic “You Need a Newer Version of Flash” message. All of a sudden, I’m downloading a Trojan Horse and now I’m screwed.

Charlie: I don’t know the nuts and bolts of Chrome, but I imagine you could start a new renderer each time. I also think they use processes as opposed to threads.

[Alan’s Comment: Charlie is correct. Chrome uses processes instead of threads. The difference is that the memory space for each process is different--better sandboxing]