Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Windows Microsoft Security IT

Microsoft Announces Windows Sandbox, a Desktop Environment For Running Applications in Isolation (betanews.com) 116

Posted by msmash from the nifty-features dept.
Microsoft has officially unveiled "Windows Sandbox," a feature that was expected to be unveiled next year. Windows Sandbox, the company says, creates "an isolated, temporary desktop environment" where users can run potentially suspicious software. From a report: Windows Sandbox is an isolated desktop environment which functions much like a virtual machine; any software installed to it is completely sandboxed from the host operating system. Aimed at businesses, enterprises and security-conscious home users, Windows Sandbox will be part of Windows 10 Pro and Windows 10 Enterprise. It is not clear exactly when the feature will debut, but it could make an appearance in Windows 10 19H1 next year.

The company touts the following features of Windows Sandbox in a detailed blog post introducing the new feature:
Part of Windows -- everything required for this feature ships with Windows 10 Pro and Enterprise. No need to download a VHD!
Pristine -- every time Windows Sandbox runs, it's as clean as a brand-new installation of Windows.
Disposable -- nothing persists on the device; everything is discarded after you close the application.
Secure -- uses hardware-based virtualization for kernel isolation, which relies on the Microsoft's hypervisor to run a separate kernel which isolates Windows Sandbox from the host.
Efficient -- uses integrated kernel scheduler, smart memory management, and virtual GPU.
This discussion has been archived. No new comments can be posted.

Microsoft Announces Windows Sandbox, a Desktop Environment For Running Applications in Isolation More

Microsoft Announces Windows Sandbox, a Desktop Environment For Running Applications in Isolation

Comments Filter:

  • Sandboxie (Score:5, Informative)

    by Anonymous Coward on Wednesday December 19, 2018 @10:53AM (#57830062)

    Or use Sandboxie, which has been out for over a decade.

    https://www.sandboxie.com/

  • The expected work-around.... (Score:3, Insightful)

    by Anonymous Coward on Wednesday December 19, 2018 @10:55AM (#57830070)

    Of course "bad guys" will figure out some way to detect that they are running inside a pristine sand-box and behave differently, ie, non-malicious. The user/tester runs that application, nothing bad happens, certifies that it is safe and releases it to the rest of the business population. Once it's out in the open the application acts maliciously and does it's dirty work.

    • Re:The expected work-around.... (Score:5, Informative)

      by ctilsie242 ( 4841247 ) on Wednesday December 19, 2018 @11:22AM (#57830304)

      This is already done. A lot of malware checks for drivers and won't run if it sees a VMWare driver, 3 CPU cores, or an oddball amount of RAM. This is a good thing, in a way, if one uses VMs for partitioning tasks (for example QuickBooks goes into its own virtual machine, so it is isolated and protected from malware for the most part. You can also add encryption, either in the VM via BitLocker or store the VM files somewhere secure (VeraCrypt volume), to ensure better protection when the machine isn't in use.

      I'm hoping Microsoft starts moving more towards a QubesOS model.

      • Re:The expected work-around.... (Score:5, Interesting)

        by Seven Spirals ( 4924941 ) on Wednesday December 19, 2018 @11:47AM (#57830460)
        Your solution is a good one, but it's a lot of hassle. QubesOS has it all streamlined, but using paravirt with Xen is a bit of a misfit when I've used it. I'd rather see a solution built around LXC or OpenVZ. However, I guess there already are some efforts in this direction that have made progress. I suppose it's mostly a matter of preference in terms of what method to implement the key is making sure no trace is left for the bad guys to follow.

        • using paravirt with Xen is a bit of a misfit when I've used it

          Xen pvh2 is almost done, and should remove the last technical reasons to use paravirt.

          • Sweet, that made me go refresh my Xen news buffer. Lots of cool developments and the near-arrival of pvh2 is definitely one of them.

    • There will be ways to detect gmtge sandbox, the ms sandbox isnâ(TM)t a pristine installation, itâ(TM)s on top of your current system

  • True browser sandboxing yet with this feature? (Score:5, Insightful)

    by Seven Spirals ( 4924941 ) on Wednesday December 19, 2018 @10:57AM (#57830092)
    I want every single tab I open to be like a baby finding itself in a brand new world every time. I want no cookies to cross reference (yes, I am willing to login every time). I wish for no resources available for Javascript trying to find clever ways to spy and screw with things outside of that "sandbox". I want that tab to feel like it's running on a computer that was just whisked into existence for that one task only. When I close that tab I want (at least on the local system) for it to be like that never happened. Don't leave cache files, ghost cookies, cookies, or alter the system in one single goddamn binary bit that can be tracked later on. I know "private browsing" claims to do a lot of these things, but then you find out later that it really doesn't or that there is some tracking. However, I gotta say, my current method works pretty well. I just keep a bookmarks file that I occasionally import/export when needed. Then I use 'srm' (secure rm) to wipe every file and directory that the browser altered when it was running (inside of a jail, usually). It's not that I have all kinds of stuff to hide, I just hate being spied on by automated "eyes".

    • I want every single tab I open to be like a baby finding itself in a brand new world every time. I want no cookies to cross reference (yes, I am willing to login every time). I wish for no resources available for Javascript trying to find clever ways to spy and screw with things outside of that "sandbox". I want that tab to feel like it's running on a computer that was just whisked into existence for that one task only. When I close that tab I want (at least on the local system) for it to be like that never

    • Re:True browser sandboxing yet with this feature? (Score:4, Interesting)

      by Opportunist ( 166417 ) on Wednesday December 19, 2018 @11:18AM (#57830276)

      Have you tried epic browser [epicbrowser.com]?

      • No, but it looks like they have the right idea. I'm just not on Windows very often but I will give it a shot sometime when I am. Thanks for the pointer. After years of just using NoScript and 'rm -rf ~/.mozilla' there has to be some kinda better way. However, my ability to trust a browser at this point will have to be after several test browsing sessions to see what turdlets it leaves afterwards when I examine the filesystem (and registry if it's Windows).

      • Installed and tried it.

        Tested one website to try it out and it broke the website quite comprehensively, with no way to get it to work (no plugins I could disable, no scripts or permissions I could grant to get it to work (as I do when using firefox with ublock and umatrix).

        It also inserts 'epicupdater' into my startup without permission, which I DO NOT like.

        That's just my first impression. Not *that* great.

    • I want every single tab I open to be like a baby finding itself in a brand new world every time.

      So... crying, covered in blood and mucus... What freakin' browser are you running?

      • If the sandboxed processes scream and thrash while covered in goo, that'll just add to my satisfaction that they've been shown their proper place in the world. :-)

    • Re: (Score:2)

      by dargaud ( 518470 )
      Browser fingerprinting techniques can still identify you this way.
      • You're right. However, doing something feels better than just laying down and letting the big-brother corporate feudal lords just monetize my existence at every opportunity. IMO, "Defense-in-Depth" still applies to an individual trying to be left alone, even if their countermeasures aren't 100% effective and they aren't sitting in a missile control silo.

    • Re: (Score:2)

      by jimbo ( 1370 )

      Firefox with Temporary Containers add-on takes you quite far in that direction. Each tab is a new container and all data, except bookmarks, is wiped after closing the tab.

  • Jailbreak (Score:5, Insightful)

    by Scutter ( 18425 ) on Wednesday December 19, 2018 @10:57AM (#57830094) Journal

    I'm putting money on "under 24 hours" before the first proof-of-concept malware is written that can escape the sandbox, followed by years of bug-fixing whack-a-mole before this is anywhere close to secure.

    • This type of technology has been around for a long time. I use to use sandboxie. Where we are working, we are using a solution like this to isolate all Java applications. This is not anything new other than Microsoft is finally offering it.

    • I'm putting money on "under 24 hours" before the first proof-of-concept malware is written that can escape the sandbox, followed by years of bug-fixing whack-a-mole before this is anywhere close to secure.

      But... Edge is faster! Just ask us, or read all the popup ads we send you with every OS update..

      Seriously, ANY operating system software plays whack-a-mole with security holes. MS isn't any exception.

    • Even if someone does break it, I applaud Microsoft for having this in the first place. Running a Web browser in a VM, sandbox, or isolated environment, where it has no access to documents is a step forward.

  • nothing persists

    Except the telemetry sent back to MS.

  • Pristine (Score:3)

    by blavallee ( 729704 ) on Wednesday December 19, 2018 @11:13AM (#57830220) Journal
    Clean as a brand-new installation of Windows.
    I'm sure it will include all the annoying notifications!

  • great in theory (Score:3)

    by fred6666 ( 4718031 ) on Wednesday December 19, 2018 @11:16AM (#57830240)

    but in practice, let say you need to open a file, how does it work? And then save it? Will they allow SMB file transfers between the host and the sandbox? Couldn't viruses spread this way?

    • If this is based on Hyper-V, then probably something like enabling the Guest Service so you can use PS Direct (i.e. not SMB).

      • But how good is the sandbox if the application can access all your files?
        It can still mine bitcoins and waste your CPU/GPU.
        It can still send all your files to some scamers and then encrypt your local copy.
        The only thing is that it won't have admin rights so it won't be able to delete the OS or mess with other users' files. Just like any non-sandboxed application, isn't it?

        • Exactly. Put in a "backdoor" (ala VMware tools, memory balloon drivers, or other such stuff that can talk to the host-side) and sooner or later someone will find a way to escape. Virtual machines can be cool and useful but there can be situations where they complicate the security threats you face versus bare metal. Spectre, Meltdown, and lots of side-channel low level CPU flaws have shown us that it's at least possible. If it's possible, then there is always the threat of really nasty exploit giving folks

          • Virtual machines with live migration very often may help cut that down.

            • Well, I know VMware guests which are going to use "Vmotion" will need to migrate between machines with similar CPUs often will "dumb down" the instruction set to whatever they have in common. Are you saying that process or something like it is mitigating things like Spectre? I haven't heard that before, but I suppose it's possible. Since VMware virtualization is a layer between the OS and the CPU, I suppose it's possible to use that to your advantage.

  • Obligatory xkcd (Score:5, Funny)

    by aitikin ( 909209 ) on Wednesday December 19, 2018 @11:16AM (#57830246)
    https://xkcd.com/2044/ [xkcd.com]

  • If this were really a Windows Sandbox, we could stick Windows in it and be so much more safer. I don't think they are shooting high enough here.

  • How much overhead and virtual GPU? (Score:3)

    by Joe_Dragon ( 2206452 ) on Wednesday December 19, 2018 @11:23AM (#57830318)

    On the virtual GPU is it based on your card? or is it some low end basic card?

    • Re: (Score:2)

      by dissy ( 172727 )

      On the virtual GPU is it based on your card? or is it some low end basic card?

      The Windows Kernel Internals descriptions say that 'windows sandbox' is put on top of the previous 'windows containers' software, which basically uses Hyper-V.
      With virtualization options enabled in the CPU, it uses "RemoteFX vGPU"

      I didn't know what RemoteFX was but there was a reference link to here:
      https://docs.microsoft.com/en-us/windows-server/remote/remote-desktop-services/rds-remotefx-vgpu [microsoft.com]

      From the description this is the same virtual GPU sharing used in the remote application part of remote desktop.

      I'm

  • with dodgy adverts on them. I'd run a Linux VM to browse them. Most of my fav abandonware sites started hosting warez though and got shut down (snesorama, I miss you, you're beloved community found me a full version of X-Tom 3D, which I wasn't even convinced existed).

  • Can I run windows in the sandbox? (Score:3)

    by AmazingRuss ( 555076 ) on Wednesday December 19, 2018 @11:55AM (#57830512)

    I'd feel a lot safer...

  • They just invented chroot and containers! (Score:3, Insightful)

    by aglider ( 2435074 ) on Wednesday December 19, 2018 @12:13PM (#57830616) Homepage

    Cool!

    • Nice modpoint whoring and playing the crowd, but no. They haven't done that even remotely. Try again but this time make a reference to KVM.

  • My cat (Score:3)

    by PPH ( 736903 ) on Wednesday December 19, 2018 @12:16PM (#57830630)

    ... thanks you.

  • From Microsoft:

    Integrated kernel scheduler - With ordinary virtual machines, Microsoft's hypervisor controls the scheduling of the virtual processors running in the VMs. However, for Windows Sandbox we use a new technology called "integrated scheduler" which allows the host to decide when the sandbox runs. For Windows Sandbox we employ a unique scheduling policy that allows the virtual processors of the sandbox to be scheduled in the same way as threads would be scheduled for a process. High-priority

  • VMWare (Score:3)

    by darkain ( 749283 ) on Wednesday December 19, 2018 @01:41PM (#57831038) Homepage

    "uses hardware-based virtualization for kernel isolation, which relies on the Microsoft's hypervisor" Hyper-V and VMWare Workstation cannot operate on the same Windows box. This is another case of Microsoft bundling software that forces out competition. As someone in a full VMWare environment, features like this scare me. I don't want to have to hack my windows just to keep my current tool set operational.

  • every time Windows Sandbox runs, it's as clean as a brand-new installation of Windows.

    So it's going to preinstall a whole bunch of crap (Candy Crush Saga, Solitaire Collection, Photoshop elements, etc) I didn't asked for or want?

    A brand new install of Windows 10 is about as pristine as a snow pile in a dog park.

  • default (Score:2)

    by sad_ ( 7868 )

    they should use this as the defaut option to run any windows application, and make it a special option to NOT run in a sandbox.

Slashdot Top Deals

To the systems programmer, users and applications serve only to provide a test load.

Close