Slashdot Log In
Microsoft Research Builds 'BrowserShield'
Posted by
ScuttleMonkey
on Tue Sep 05, 2006 04:21 AM
from the security-you-can-trust-of-course dept.
from the security-you-can-trust-of-course dept.
SteelyBen writes "Researchers at Microsoft have completed work on a prototype framework called BrowserShield that promises to intercept and remove, on the fly, malicious code hidden on Web pages, instead showing users safe equivalents of those pages. The BrowserShield project, an outgrowth of the company's 'Shield' initiative, could one day even become Microsoft's answer to zero-day browser exploits such as the WMF (Windows Metafile) attack that spread like wildfire in December 2005."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Just what we need (Score:5, Funny)
Re:Just what we need (Score:5, Interesting)
In the first case: why not ship the actual updates? Otherwise, how would they guarantee that Grandma will update the signatures? Maybe they will need another layer between the new layer and the Tubes, so that the new new layer will rewrite the pages in case the old new layer is not updated. This is not very sensible...
On the other hand, if they host the layer on their side, clearly I am not interested in sharing this information with MS. Either way, I don't see how it will work.
Parent
Re:Just what we need (Score:5, Interesting)
Sometimes, in the short term, fixing a bug is harder than making sure that it won't be exploited 95%+ of the time. This could be due to architecture/legacy issues, not having resource(s) who know that code base, or the fixer not knowing the code. By using signatures, you're seperating the person that writes the signature from knowing any of the code for the underlying product. Its probably much quicker since they don't have a steep learning curve, can rapidly generate signatures, and its both a cheaper and faster solution. That's not to say its good long term, but considering why IE is slow to fix bugs (MS had haulted development) this has the benefit of being independant and much easier to maintain.
On implementation, Vista will have auto-updates on be default. From their work towards making Windows far more modular, they can probably now stop services, patch, and restart them seemlessly instead of requiring a reboot. If it was proxy based, any browser could use it and we'd likely see a Google proxy too, since the data would be quite valuable and power users would naively trust Google more than Microsoft.
Parent
Re:Just what we need (Score:4, Informative)
"Correct"? Probably not. Convenient? Absolutely.
AM is one of the very few modern shareware programs I not only paid for, but paid early and promote often. And no, I'm not involved, just an incredibly happy customer (and boy do the Mac blockers have a long way to go in comparison).
Parent
That's not even the real danger... (Score:4, Interesting)
What happens when you mix this with Digital Restrictions Management that goes down to the hardware level? What I'm getting at is, what if it's not malicious code that is being replaced by a "safe equivalent", but perhaps a controversial story on a news website, or an important email between governments?
In the future, he who controls the computers controls the world. Digital Restrictions Management will one day give just a few computer companies control over every internet-connected computer in the world.
Some people will respond to this with "ahh.. I'll just use a firewall". Those people do not realise that firewalls will contain DRM, too.
Parent
Re: (Score:3, Insightful)
And quite frankly, there are far easier ways of implementing such a sinister plot in a much more comprehensive fashion.
Re: (Score:3, Insightful)
The answer is: absolutely nothing.
What I'm getting at is, what if it's not malicious code that is being replaced by a "safe equivalent", but perhaps a controversial story on a news website, or an important email between governments?
The technology will not patch plain text content, it'll patch vulnerabilities. Of course this is obvious to most people worth a damn out there, but you get modded up anyways.
Re: (Score:3, Insightful)
Re:That's not even the real danger... (Score:4, Insightful)
What can I say except I'd hate to live in your isolated little made up "omg MS is coming to get me" world.
No matter what the society turns to be, there'll be always people to build inexplicably complex and ridiculous conspiracy theories that all link to the same "ultimate" enemy. Does it make you feel smarter that you saw this intricate plan of Microsoft to ban your blog noone gives a damn about either way?
But it's really not that cool to throw unsubstantiated FUD around as it used to be. We call it trolling, and it's mostly unwelcome.
Parent
zero-day browser exploits (Score:5, Insightful)
Re:zero-day browser exploits (Score:5, Informative)
The research group tested BrowserShield against eight IE patches released in 2005 and found that BrowserShield--when used in tandem with standard anti-virus and HTTP filtering--would have provided the same protection as the software patches in every case
There were far more than 8 patches in 2005. How were these 8 selected? Were they of a specific type? Without such details, it's hard to form an opinion about this 'BrowserShield' thingie. For all we know, they selected the most convenient 8 to prove their point.
Parent
I made a similar product once. (Score:5, Insightful)
Innovation at its finest I suppose.
Re: (Score:3, Interesting)
-Craig Mundie, Microsoft CTO [zdnet.com]
Solve the problem, don't patch it (Score:5, Insightful)
Hold on a second... (Score:5, Insightful)
modular code? (Score:3, Insightful)
About inspecting the script for malicious run-time behavior, I
Re: (Score:3, Insightful)
Re: (Score:3, Interesting)
Except that for each layer of holey software, there are new off-ramps to to the operating system. Such exploits won't care about getting to the browser, since they can just exploit the 'software shield' and get to the operating system to do their damage via that vector.
No, I think this just creates more opportunity for system exploits, especially if MS grafts the so-called
Re:Hold on a second... (Score:4, Insightful)
Yes, much like you would run a firewall to protect 'poorly written software that is security-hole ridden'. Sometimes writting software to catch the exploits is easier and takes less maintenance completely eliminating each and every little bug.
Parent
Re: (Score:3, Insightful)
You write firewalls to have control over the access to your software. No firewall will protect you from sql injection, from buffer overflows, so on and so forth. The point of view they have taken on this matter is imho a flawed one: here's a bad code, we won't fix it,
Didn't this already exist? (Score:5, Funny)
"Invents?" (Score:3, Informative)
Why bother!? (Score:4, Interesting)
It already exists, and it's called the Proxomitron (Score:5, Informative)
Showing the page anyway? (Score:5, Interesting)
Funny thing, MS (Score:3, Insightful)
Sounds like they've re-invented the sandbox. (Score:5, Insightful)
Great! (Score:5, Funny)
Oh my.... (Score:3, Insightful)
Personally I'm very affraid about MS sniffing my code. Experience shows that it will let tons of lines of malicious code pass, while locking down many good codes out there.
When those people will learn to stop trying to do magic tricks and be serious? A solution to browser flaws already exists and it's not magical at all, but technical: it's called "patch".
Bizarro! (Score:5, Insightful)
Potentially Unsafe Code Samples (Score:3, Funny)
<a href="*.apple.com*"*>*</a> <a href="mailto:/webmaster?Subject=Your%20Site%20Suc
<body*>*Linux*</body> <body>This page cannot be displayed due to faulty programming in the server's OS.</body>
<embed src="*.[^w][^m][^av]"*></embed> <b><u><i><blink>This page contains content created using a pirated version of Windows Media Player. Contact the police.</blink></i></u></b>
Strangling metaphors (Score:3, Funny)
That's like putting a Robin Reliant into a huge metal box to make it as safe as a Volvo. Or something. More coffee...
Re:Strangling metaphors (Score:4, Informative)
Parent
Re: (Score:3, Funny)
Ahh much better now (Score:5, Funny)
I'm sure glad MS is out to make the interweb a better place for everyone.
Magic (Score:3, Insightful)
I'm afraid without more information this sounds too much like magic. "Vulnerability-driven filtering should prevent all exploits (of a flaw) and should not disrupt any exploit free pages."
How is the technology filtering, what is it filtering, and how will it differentiate exploit free from exploit-ridden pages? If it can simply detect them why not just block them?
Microsoft Research has produced amazing technologies in the past and most of their current research is also very promising, in the area of GUI design, security, algorithms and so on. I just hope they are in tune with what Microsoft is already doing in Vista to avoid redundant layers of technology.
Also there's always the danger of Microsoft slapping a technology on IE for pure PR reasons ("haha Firefox has no filter!").
But I believe we have a case of poorly written article here. It's not uncommon that reporters simply have no idea what they are covering and coming up with wrong conclusions on what fundamentaly the shield is.
I'd say wait for the opinion to "mature" a bit on this technology.
Rice's Theorem anyone? (Score:3, Insightful)
Already in anti-virus software (Score:3, Informative)
While this is all well and fine, would it be too much for Microsoft to just patch their bugs?
This will be fun (Score:5, Funny)
from Microsoft Research (Score:4, Interesting)
Just like how AV software isn't the solution to viruses, it's done quite well in protecting many systems. I personally don't understand exactly how this browsershield works, but from what I can grasp, it seems to be an additional check before loading the page into the browser and removing any malicious code. How it detects the malicious code is not clear, but having seen interesting research come out of MSR, I have my faith in these guys to have come up with an interesting solution.
well it's the Microsoft way (Score:5, Insightful)
2. receive complaints
3. do not solve security leaks but instead, build a wall around them
4. go to sleep and forget about 1.
Wrong-Headed! (Score:4, Insightful)
Yep - Microsoft is all in favor of security - so long as it maintains backward compatibility and they don't have to throw anything away.
Bye bye karma (Score:4, Insightful)
First off, I have seen first hand some of MSResearch fairs and they is a lot of great stuff coming out of them. Anything that comes out of those labs is worth at least some thought before you dismiss it.
That aside, stripping nasties using a simple system before they reach a more complex system isn't really a bad idea. All of our mail servers have some sort of filter that does this (granted, more for dumb users). IIS 5 did this using a tool that was later built into IIS 6. Hell, firewalls aren't a much different idea. Most of us already run some sort of proxy software to block popups, scripts, or ads. All MS is proposing here is the equivalent of proximity or similar proxy software.
Do we just hate this idea b/c MS is doing it?
Re: (Score:3, Interesting)
Yes, firewalls do this, but you don't see Mailman building a mail shield to protect its vulnerabilities - they fix them. You don't see Firefox building a web shield to protect its vulnerabilites - they fix them. Etc, etc, etc.
The concept from MS is fine. The implementation, as is typical,
Tryed with anti-virus software. And failed. (Score:5, Interesting)
Well, I thought anti-virus software vendors already failed at similar effort. Every new virus out there first disables all known anti-virus software.
It all boils down to question: how could you tell malicious content from good one??? You would have to resort to signatures. That wouldn't help against 0day exploits in no way, since on that day 0 most signatures are not yet updated.
From the article it sounds more like standard corporate firewall functionality: "block all what looks like HTTP redirect, since that can IE exploit", "block all .exe attachments since that might be Outlook exploit", "block .wmf since that might be IE/Outlook exploit", etc. Nothing new.
Buhahaha! Very funny!! They at Redmond take Windows security very very seriously - they have put best PR people on it!!!
Good luck at identifying that "harmful code," darling!
P.S. And for that "rewrites HTML pages" bit be sure to have M$' lawyers ready. Few content providers would like idea that their pages may be rewritten by the software monopolist.
P.P.S. Would M$ ever learn? How long they intend to have that "ActiveX" crap enabled in their browsers by default?? How many sacrifices they intended to make???
P.P.P.S. On related news from Germany, my employer (about 150 desktops) 1.5 year ago has banned M$IE. Firefox and Opera must be used to access inter/intranets.
Security from MS cannot work (Score:4, Interesting)
It's not that MS is "inapt" or that they can't get their act together, it's simply that computers are computers, people are people and the mix of those is by its very nature unreliable and insecure. No matter how good you make it, there will always be tiny cracks in the security, be it for technical shortcomings or flaws in human nature that can be manipulated by social engineering.
Now, MS is the biggest manufacturer of operating systems. This shield will, invariably, also be present on every PC running their OS. So the first thing you have to defeat, as the attacker, is this shield. Can't get past it, don't bother continuing trying to defeat other security software that may or may not be present. This shield WILL be present!
So every attacker out there WILL have to come up with a cracking scheme. No matter what the cost, no matter how long it takes. It HAS to be cracked.
Thus security from MS cannot be relied on. Not because it is insecure in any way. But because every piece of malware HAS to come with some procedure to circumvent MS security. It will invariably have countermeasures in its arsenal.
It's been done (Score:3, Insightful)
And the MicroSoft implementation seems to be a limited sub-set. It won't even block ads.
Re: (Score:3, Interesting)
I searched a bit. There's a better article here [microsoft.com]. From that artcle:
Also there is a pdf of a paper they have written [microsoft.com]
.
From the abstract of that (I haven't read the whole thing):
Re: (Score:3, Interesting)
Next stop, badware scripts that generate javascript which then goes on to make HTML instead of just generating HTML. I am sure that there will be many levels of potential obfuscation that can only be stopped by using a browser engine to parse/validate the javascript, and at that point wouldn't the browser engine be vulnerable to the same exploits?
Re: (Score:3, Insightful)