Slashdot Mirror
Windows 10 Will Soon Run Edge In a Virtual Machine To Keep You Safe (arstechnica.com)
An anonymous reader quotes a report from Ars Technica: Microsoft has announced that the next major update to Windows 10 will run its Edge browser in a lightweight virtual machine. Running the update in a virtual machine will make exploiting the browser and attacking the operating system or compromising user data more challenging. Called Windows Defender Application Guard for Microsoft Edge, the new capability builds on the virtual machine-based security that was first introduced last summer in Windows 10. Windows 10's Virtualization Based Security (VBS) uses small virtual machines and the Hyper-V hypervisor to isolate certain critical data and processes from the rest of the system. The most important of these is Credential Guard, which stores network credentials and password hashes in an isolated virtual machine. This isolation prevents the popular MimiKatz tool from harvesting those password hashes. In turn, it also prevents a hacker from breaking into one machine and then using stolen credentials to spread to other machines on the same network. Credential Guard's virtual machine is very small and lightweight, running only a relatively simple process to manage credentials. Application Guard will go much further by running large parts of the Edge browser within a virtual machine. This virtual machine won't, however, need a full operating system running inside it -- just a minimal set of Windows features required to run the browser. Because Application Guard is running in a virtual machine it will have a much higher barrier between it and the host platform. It can't see other processes, it can't access local storage, it can't access any other installed applications, and, critically, it can't attack the kernel of the host system. In its first iteration, Application Guard will only be available for Edge. Microsoft won't provide an API or let other applications use it. As with other VBS features, Application Guard will also only be available to users of Windows 10 Enterprise, with administrative control through group policies. Administrators will be able to mark some sites as trusted, and those sites won't use the virtual machine. Admins also be able to control whether untrusted sites can use the clipboard or print.
Have to be in a HURD to be safe, you know that!
Sigh. The browser is so bad that it requires sandboxing/virtualization? I'm "impressed"
So they are finally ported it to a Linux based VM
Hooray! A security feature exclusive to Windows 10 Enterprise customers. That will substantially cut down on the actual difference this makes.
How about we let Firefox and Chrome do their thang, and let Edge go the way of the dinosaurs?
Well, I already keep Win10 sequestered inside a VM, so now I'll be running a VM inside a VM?
How's that meme go? "Yo dawg ... "
This signature is false.
It sure would be nice if our OS ran every single program and app in its own private VM, with individually tailored permissions.
Now do this for EVERY applications.
So, what was once Visual Basic Script is now Virtualization Based Security? I guess we're running out of alphabet letters.
Once VM's attack vectors become mainstream and script kiddy level MS decides that is the best option to protect ie users. lol
All applications should be sandboxed. The kernel should be sandboxed.
“He’s not deformed, he’s just drunk!”
>> Windows 10 Will Soon Run Edge In a Virtual Machine To Keep You Safe
Correction : Windows 10 Will Soon Run Edge In a Virtual Machine as a desperate attempt to try to Keep You Safe
aaaaaaa
Wake me up when Windows becomes secure. Meanwhile I'll use Linux which doesn't even need an anti-virus.
And if they can't program the app properly, what makes anyone think their hypervisor is going to be any better?
remember the days Microsoft said they cannot separate the browser. now they are forced to from a security standpoint
Sand boxing is great and fun and wonderful. Virtualization just seems overkill, like taking your AR-15 into the morgue to make sure everyone's dead.
It's akin to a deadbolt manufacturer including a Glock handgun with every purchase.
In other words, safe spaces for Edge! Would do a lot of good protecting the OS from external micro-aggression. Now, if only Windows 10 could itself be sandboxed by the OS
I don't think the author of the article understands what a password hash is if they think that passwords can be decrypted from them.
Running Java apps in a VM is safe right? Nothing bad can happen in a VM.
You bet your ass there will be Telemetry spying here.
I know this is Slashdot and it's essentially illegal to say "good" and "Microsoft" in the same sentence but, "good". I don't plan on using Edge any time soon but I still applaud any security based efforts made by mainstream OS vendors, that can help improve things. I know this won't stop idiots downloading "movie.torrent.exe" and running it but at least it will significantly cut down on drive by downloads of malware through hacked ad servers and out of date Flash. That's got to be a good thing.
So this is basically saying that we can no longer depend on the OS to protect us against privilege escalation attacks. The bad guys will have to concentrate on breaking out of VMs or, at least in this case, attacking through the access that the Edge VM has to system resources.
As a previous poster mentioned, the Virtualization Based Security (VBS) feature is in Enterprise edition only. If you look up the directions on implementing VBS and Credential Guard, it is much too complex for places without a dedicated sysadmin (and Windows Server 2016 + TPM). Although the feature is technically impressive, it would be nicer if it could be simplified for regular users.
If you blow out the sandbox it's running in, you still lose all your browser data, and are now stuck without a browser unless you reload the OS or have already downloaded alternate browsers, which DON'T run sandboxed.
Good fuckin' going!
Chas - The one, the only.
THANK GOD!!!
Oh you mean like the countless applications (including this website's server) running inside a chroot? It was probably required after "swiss-cheese" Apache started getting rooted by a kiddie everytime your turned it on.
What the fuck do you think Sand Boxing is? Virtualisation is Sandboxing
I've got a more secure solution.
I'll only let Edge run on other people's computers.
I'm a dreamer, the world is my playpen. But hey, I'm a serious person, I can't dream all the time.
Does this mean they'll finally fix network access for hyper-v hosted VMs when the host system is connected via wifi?
Just that right now it's a fucking shitfest.
Or maybe they're creating a whole new hypervisor for Edge, that will actually work.
There used to a disclaimer every time an older VM program ran, I think it was "bochs", which told the user that a VM is not security.
It only gives you the illusion of it.
In reality the VM software has to get it's hooks so deep into the hosts networking and other sensitive bits that you can never be sure that software running on the client can't get up to nasty tricks on the host.
If you want security design for security instead of taking the lazy way out of using something completely different done by someone else and pretend that partial separation for totally different reasons is equivalent to security.
It's just like expecting to enter a Ford Bronco is a horse race. The name makes it sound like it belongs but it's not the same thing and was never intended to be.
A company who spies on every keypress is worried about your privacy? Microsoft you are so full of shit! http://www.independent.co.uk/life-style/gadgets-and-tech/news/windows-10-spying-how-to-opt-out-of-microsofts-intrusive-terms-of-use-10432300.html http://www.techtimes.com/articles/73725/20150802/windows-10-spies-on-you-by-default-heres-how-to-opt-out.htm https://www.rt.com/usa/311304-new-windows-privacy-issues/ http://www.pcadvisor.co.uk/how-to/windows/how-disable-hidden-keylogger-in-windows-10-3639643/ http://www.businessinsider.com/windows-10s-privacy-settings-are-invasive-and-vague-2015-7 http://www.ibtimes.com/windows-10-spying-you-privacy-fears-raised-os-secretly-contacts-microsoft-regardless-2051900
I don't think the author of the article understands what a password hash is if they think that passwords can be decrypted from them.
They can and are. "Salting" the passwords with extra complexity makes it a lot harder (to the point of impractical to crack if done right) and is the usual practice now to avoid situations like this when it was not done right:
https://techcrunch.com/2016/05...
I mean, really, what will keep me safe from the egregious data harvesting of Windows 10? If I do not trust the operating system, then I do not trust anything the operating system does.
good buy steam / game mods / maps editors then.
How about "Windows 10 Will Soon Run Edge In a Virtual Machine For Increased Security"? Ya know...something that doesn't sing the praises of the Benevolent Leader?
Just say it together and say it loud:
FUCK PROPRIETARY SOFTWARE
I don't want you in my HOUSE, I don't want you in my DEVICES, I don't want to even HEAR your NAME. I sure as hell don't want your VR hardware wrapped around my face like a cheap prostitute.
If people would stop FEEDING beasts, then they can finally be FREE from them.
No. Sand Boxing is not necesarily virtualisation, although any virtualization technology by definition sandboxes whatever runs on top of it (some do it very paranoically, some less so).
And you post as AC. I chastize you with my very intelligent gaze.
NO SIG
Thats pretty much throwing the towel and admiting "hey, we just can't get security right".
A good start. But I run the Windows virtual machine inside a virtual machine, because Windows 10 can not be trusted. I don't store any personal information on it, and use it just for games.
Windows runs BETTER virtualized, because it has simpler hardware, that Microsoft programmers can understand.
No running for driver CD's, or having Windows brick my machine.
I can roll back updates just by copying a file.
The way Windows should be run.
No they CAN'T and AREN'T, you can brute force a hash or use rainbow tables to lookup possibilities but you CANNOT decrypt them as they are one way.
No they CAN'T and AREN'T, you can brute force a hash or use rainbow tables to lookup possibilities but you CANNOT decrypt them as they are one way.
Solving with brute force IS a way to decrypt.
A dictionary is not just for attacks, it's also a book for looking up the accepted meanings of words such as decrypt instead of your own pet definition that I'm somehow supposed to know before you attack me for not reading your poorly educated mind.
I would assert that -all- browsers should be run in a VM, just because they are in constant contact with untrusted code 24/7. We have firewalls for untrusted stuff trying to come in, might as well have a similar layer for stuff that is just as bad. Next to Trojans, browser issues are a major cause for intrusions and compromise.
I do applaud MS for this. ACLs help some, but ideally, a browser needs to be run in a completely different filesystem and RAM space than the rest of the OS, just so when (not if) some process that exploits the browser of an add-on gets out, the damage it can do is limited.
On modern OSs, all applications are sandboxed, the VM surface they see is the kernel exposing a lower privilege level to them.
Virtualization != sandboxing. You can sandbox on Windows with SandboxIE, where all writes from the sandboxed app are redirected elsewhere. Doing this doesn't require a separate OS or filesystem, so it doesn't add that context shifting as overhead.
You can also run your Web browser in a VM. You get better separation, but at a price, although with hypervisors becoming the norm and not the exception, running VMs may not have as onerous a penalty as they used to.
I like a combination of the two. I like browser windows and tabs separated from each other, like what Chrome/Chromium does, but the browser should run in its own VM so if something does get out of the browser, it is in a completely separate user and machine context. Without the VM isolation, even if malware just has context of a user, that can allow files to be uploaded and ransomware to do its dirty work.
Jails are another solution, but it can be argued that it might be best to completely isolate filesystems, especially if some software decides to do stuff like mkdir foo; cd foo loops, or just create tons of files in order to use up all inodes. Done on a VM, worst case, it means one dumps the VM and rolls back. Done on a desktop, it can mean work stoppage.
Bought it years ago after testing the hacked version on XP, sandboxed every program I installed on the machine, worked great for preventing game spyware installing into the core OS.
home
You can't use "Windows 10" and "keep you safe" in the same sentence unless that sentence includes "won't".
I'll run Ubuntu on my PC and call it Windows 10. I will also run Firefox but will call it Edge. I call this my virtual Windows OS and virtual Edge solution. Although only in spirit and not reality.
Does Microsoft not know how Type 2 hypervisors actually work? Does Microsoft not know that software running on the same host as the hypervisor can monkey with the VMs as well? Does Microsoft not know that you cannot have a truly isolated virtual machine on a type 2 hypervisor?
A hypervisor that runs in userland is NOT a layer of additional security. In fact, it is quite the opposite, because you can monkey around with it while it is running, while it is paused, while it is off, and the VM's OS will have absolutely no idea or visibility of it.
This sounds a bit like https://www.qubes-os.org .
Who comes up with these acronyms? That guy needs to get fired.
so if something does get out of the browser
I cried a little on the inside... and then longed for the static HTML of the 90s... :-(
This.
That's the, what now, 4th? time that MS is promising that its browser will be sandboxed and virtualized and whatnot. Guess what: They managed to botch it every single time.
Wake me when they actually deliver, their promises are less credible than that of a politician or a religious figurehead.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
OK, you cannot decrypt them per se. Let's agree that you can find a combination of characters that will produce the correct hash and hence be accepted as a valid version of the password.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
I could mistype something when I'm downloading Chrome and end up in trouble.
https://linux.slashdot.org/story/16/09/26/053253/boot-linux-or-openbsd-or-oberon-or-freedos-in-your-browser
I mean, if it purposely shits the bed when you run Edge, that's a bug...but when it does it under qemu / kvm--that's a feature!
Basically, all businesses are going to have to subscribe to Windows 10 Enterprise if they want the features they were used to getting from Pro in the past. Microsoft should just merge Home and Pro into one edition and call it Consumer or Ad-and-Telemetry-Supported or something. A lot of places, including my workplace, have been used to getting the features we need from the OEM license of the Pro version of Windows shipped with the PC. This is how Microsoft is going to work around the claim they won't be charging subscriptions, 365-style, for Windows. They aren't, oh, except for enterprise customers.
It is a good business model -- companies will pay for Enterprise if they want any hope of managing their Windows client OS fleet. Adobe is a good example of how this works out - they know they have very little competition in the video editing, photo and publishing space, so they switched to a subscription model years ago. If you can force your customers to keep paying over and over again for the same product, why wouldn't you? Microsoft is going to be the next IBM - the main reason the company hasn't gone under is the recurring mainframe revenue...they get millions and millions of dollars monthly from customers just to retain the right to run a mainframe. IBM has been in the process of eating itself for 15+ years, and they will never completely die because they keep getting this revenue stream - - no matter how many businesses they sell off.
Wake me when they actually deliver, their promises are less credible than that of a politician or a religious figurehead.
You mean Trump is more credible than someone?
They say it's not a virtual machine, just an environment that only allows a subset of APIs and capabilities required for the browser to work... Sounds like what SELinux policies do
Twinstiq, game news
Windows 10 sucks!
And yet the static HTML of the 90s still has security issues, like the (malformed) GIF exploits of old.
To keep me safe. #Debian
I usually have to disable Hyper-V so I can run VirtualBox. Does that mean I lose the built in browser on my host O.S. ?
Gathering user data and secretly sending it of to remote servers where it will be used for whatever results in the highest financial gain is sick and should be blocked, but how does running a web browser in a VM prevent the OS from doing all those things?
No.
What is this "virtualizing" the "interface" kerfufelisch nonesense.... no no, my friend. You are severely mistaken. Sand Boxing is NOT "about" virtualizing. Sand boxing is about isolating upper layers from lower layers. This can be achieved by virtualization or through not virtualization. How about that?
NO SIG
If Edge was hitlery it would be caching yoyr credit card and oersonal details into the VM and maybe planting some child pics if they dont like u.
Also.. your Mom
Real solutions:
1) Search, use and learn for your preferred flavor of Linux/Unix/MacOs to surf the web.
2) Install windows (whichever painful edition you want) on virtualbox/kvm (without internet access) on MacOs/Linux/Unix
3) Forget about the vm and enjoy a safe Internet. (This is crucial)
4) Optional * stop playing games on windows: be productive
4.b) Optional: Research for working in wine windows games, choose ONE, play it, beat it, then re-play it backwards. Then GOTO 4.b.
"This my puny human is the way for a long and prosper life. Master Spock"
I tried running all my applications in a sandbox, but then the cat pissed all over them.
Which in English means decryption. WTF is wrong with you people? Being able to accept your own minor failings, especially incredibly trivial little ones, is part of being an adult.
Now where did I say that? What's with the lies over something so trivial?
I wrote what I wrote and not what the strawman in your head is up to.
This is a very old and well understood problem ( http://www.csl.sri.com/users/r... ) and I suggest you learn about the implications instead of frothing at the mouth in denial.
When the VM has been designed without security in mind and with hooks deep into the host at the kernel driver level without separation then an exploit of the VM software can escalate to the host. You don't have to trust me on this - learn about the topic and you'll be able to see that much yourself.
Read the paper to see how it should be and despair that the Virtual Machines we are talking about are nothing like how it should be.
At least someone got the joke.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
strange, that they do not recommend to use a dedicated pc for edge.
Even back then you just had to overflow some badly tested part of the html renderer and that wouldn't be so unlikely if the browser used C style strings. I mean 200 stack allocated chars should be more than enough to hold the contents of a width attribute, right?