Windows Defender Becomes First Antivirus To Run Inside a Sandbox (zdnet.com)

An anonymous reader writes: Windows Defender is the first antivirus to gain the ability to run inside a sandbox environment, Microsoft said in an announcement. In software design, a "sandbox" is a security mechanism that works by separating a process inside a tightly controlled area of the operating system that gives that process access to limited disk and memory resources. The idea is to prevent bugs and exploit code from spreading from one process to another, or to the underlying OS.

"We're in the process of gradually enabling this capability for Windows insiders and continuously analyzing feedback to refine the implementation," Microsoft said in a celebratory blog post. Users who can't wait until Microsoft finishes testing the feature can also enable it right now. Support for Windows Defender running inside a sandbox environment has been silently added since Windows 10 version 1703. To enable it right now, Windows 10 users can follow these steps.

Comments

Re:I must be missing something

[E-Rock]

The AV product has to open and test the file. This can be a way for malware to hijack the AV product itself. By running that test in a sandbox, the malware has another hurdle (escaping the sandbox) before it can do anything.

Re:That's cool and all

[jellomizer]

Todays viruses are lot like the ones of old.
Newer OS's tend to use the App Store concept for most of your trusted applications, that reduces viruses. However the realization that real damage doesn't need to be at the root/system level. But on the user level. Because you data is more important then the OS. Sure you may not be able to open up a low number IP Port, but your user account even on Linux systems, is often good enough to cause a lot of damage.
Linux and Mac systems are protected by the fact that they are not used enough by average joe, and most software you get from trusted locations.

It's not really a Sandbox

[rsilvergun]

since it's going to have to leave it's sandbox to scan your file system and it's going to have to have root or near root to do it. That's probably why they're the "first", because it's not a very good idea.

Re:It's not really a Sandbox

[beuges]

You clearly don't understand how the sandbox concept works.

The part outside the sandbox, which does have SYSTEM privileges, no longer examines the contents of the file for malware. It passes it to the part inside the sandbox, which scans the content for malware. If the malware triggers an error in the scanning engine, it cannot be exploited because the scanning engine is in a sandbox and is running with reduced privileges, compared to previously when there was no sandbox and the scanning engine ran as SYSTEM as well.

Re:It's not really a Sandbox

[beuges]

If your engine is only reading a string of bytes, it's not much of an engine. You're probably dealing with something naive that merely looks for known strings or byte sequences out of a dictionary.

A modern anti-malware engine on the other hand, must do a lot more. Once it reads the string of bytes, it needs to examine it to determine what type of data this string of bytes represents. Then, once it knows what type of data it is dealing with, it needs to pass that string of bytes through some sort of parser or analyser to determine if the string of bytes represents a threat _for that data type_.

There have been file format parser exploits in all sorts of applications on all sorts of platforms, so it's not unreasonable to expect that there may be bugs or exploits in the scanning engine itself.

Isolating the engine to run in a sandbox ensures that if any such bug becomes exploitable in the engine, its ability to cause damage is contained to within the sandbox.

Re:It's funny, but...

[Misagon]

No, that's a misconception. Only very few operating systems actually isolate all its tasks fully according to the principle of least privilege.

In most mainstream operating systems, sandboxing is not the default but has to be initiated by the parent process before the process starts, or even voluntarily by the process itself.
Most sandboxing mechanisms were added as afterthoughts, so they do have some kind of quirk that either makes it hard to use or opens up a hole if you are not careful.