DIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOXMark Vincent Yason
IBM X-Force Advanced Research
yasonm[at]ph[dot]ibm[dot]com@MarkYason(v3)

IBM Security Systems | © 2014 IBM Corporation

AGENDA Introduction

 Sandbox Internals
 Sandbox Limitations/Weaknesses

 Sandbox Escape Sandbox Escape Demo Conclusion

DIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOXIBM Security Systems | © 2014 IBM Corporation

DIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOXINTRODUCTION

IBM Security Systems | © 2014 IBM Corporation

INTRODUCTION Purpose: Answer important questions on EPM
sandbox implementation and EPM sandbox security
 Research is based on IE10 update KB2817183 (April2013) running on Windows 8 (x64), but still mostly
applies to IE10 and IE11 patch KB2909921 (February2014) More details can be found in the companion white
paper

DIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOXIBM Security Systems | © 2014 IBM Corporation

DIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOXSANDBOX INTERNALSIBM Security Systems | © 2014 IBM Corporation

INTERNALS > ARCHITECTURE

DIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOXIBM Security Systems | © 2014 IBM Corporation

INTERNALS > RESTRICTIONS > APPCONTAINER
 EPM is mainly sandboxed via AppContainer

 IE’s AppContainer name:– “windows_ie_ac_<nnn>”
 IE’s AppContainer capabilities:– Default: internetExplorer, internetClient,sharedUserCertificates, (+3 more)– Additional if “private network access” is on:
privateNetworkClientServer,
enterpriseAuthentication
DIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOXIBM Security Systems | © 2014 IBM Corporation

INTERNALS > RESTRICTIONS > APPCONTAINER > LOWBOXTOKEN AppContainer processes are assigned a Lowbox token
 Lowbox token:– TOKEN_LOWBOX (0x4000) set in the token flags– Low Integrity– Package/AppContainer SID– Capability SIDs
– Lowbox Number Entry• Links the token with an AppContainer number(also called Lowbox number/ID) which is used in
AppContainer restriction/isolation schemes
DIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOXIBM Security Systems | © 2014 IBM Corporation

INTERNALS > RESTRICTIONS > APPCONTAINER > LOWBOXTOKEN > ILLUSTRATION
 IE EPM process tree in Process Explorer
 IE EPM AppContainer and Capabilities

DIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOXIBM Security Systems | © 2014 IBM Corporation

INTERNALS > RESTRICTIONS > APPCONTAINER > SECURABLEOBJECTS Securable objects need to have an additional ACE for
any of following to allow AppContainer processaccess:– The AppContainer– ALL APPLICATION PACKAGES– Capability that matches one of the AppContainer’s
capabilities
 Prevents access to personal user files (e.g.:)– C:\Users\<UserName>\Documents,Pictures,Videos
DIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOXIBM Security Systems | © 2014 IBM Corporation

INTERNALS > RESTRICTIONS > APPCONTAINER > SECURABLEOBJECTS > APPCONTAINER-SPECIFIC LOCATIONS AppContainer-specific locations are available for data
storage File System:– %UserProfile%\AppData\Local\Packages\<AppContainer Name>\AC Registry:– HKCU\Software\Classes\Local Settings\
Software\Microsoft\Windows\CurrentVersion\
AppContainer\Storage\<AppContainer Name>DIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOXIBM Security Systems | © 2014 IBM Corporation

INTERNALS > RESTRICTIONS > APPCONTAINER > SECURABLEOBJECTS > APPCONTAINER & ALL APP. PACKAGES ACEDIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOXIBM Security Systems | © 2014 IBM Corporation

INTERNALS > RESTRICTIONS > APPCONTAINER > SECURABLEOBJECTS > OTHER IE-ACCESSIBLE LOCATIONS
 Access to browser-related data located outside the
AppContainer-specific locations is possible via theinternetExplorer capability (S-1-15-3-4096) ACE
 Examples:– %UserProfile%\AppData\Local\Microsoft\Feeds (R)– %UserProfile%\Favorites (R/W)– Few subkeys of HKCU\Software\Microsoft\
Internet Explorer (R and R/W)

DIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOXIBM Security Systems | © 2014 IBM Corporation

INTERNALS > RESTRICTIONS > APPCONTAINER > SECURABLEOBJECTS > INTERNETEXPLORER CAPABILITY ACEDIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOXIBM Security Systems | © 2014 IBM Corporation

INTERNALS > RESTRICTIONS > APPCONTAINER > OBJECTNAMESPACE ISOLATION Created named objects will be inserted into aseparate AppContainer-specific object directory:– \Sessions\<Session>\AppContainerNamedObjects\<AppContainer SID>

 Prevents named object squatting
DIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOXIBM Security Systems | © 2014 IBM Corporation

INTERNALS > RESTRICTIONS > GLOBAL ATOM TABLE
RESTRICTIONS
 Querying and deleting global atoms are limited to
atoms created or referenced by processes running inthe same AppContainer– AppContainer references are tracked using
AppContainer numbers
 Query restriction is lifted if ATOM_FLAG_GLOBAL flagis set in the atom

 More information can be found in Tarjei Mandt’s
presentation "Smashing the Atom: Extraordinary
String Based Attacks”
DIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOXIBM Security Systems | © 2014 IBM Corporation

INTERNALS > RESTRICTIONS > APPCONTAINER > UIPIENHANCEMENTS UIPI was introduced in Windows Vista to mitigate
shatter attacks
 UIPI prevents lower-integrity processes from sending
write-type window messages and installing hooks inhigher-integrity processes
 In Windows 8, Win32k additionally blocks write-typemessages across AppContainers– Done by comparing AppContainer numbers– AppContainer number 0 is given to nonAppContainer processes
DIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOXIBM Security Systems | © 2014 IBM Corporation

INTERNALS > RESTRICTIONS > APPCONTAINER > NETWORKISOLATION
 AppContainers require certain capabilities for
network access:– internetClient, internetClientServer: Connect to and receive
connections from Internet and public network endpoints– privateNetworkClientServer: Connect to and receive
connections from private (trusted intranet) network endpoints

 By default, IE’s AppContainer only has theinternetClient capability– Access to trusted home and corporate intranets
are blocked
DIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOXIBM Security Systems | © 2014 IBM Corporation

INTERNALS > RESTRICTIONS > UNAPPLIEDRESTRICTION/ISOLATION MECHANISMS
 Unapplied restriction/isolation mechanisms:– Restricted Tokens– Job Object Restrictions– Desktop and Window Station Isolation
 Makes some forms of attacks still possible– Mostly relating to disclosure of some types ofpotentially sensitive or personal information– Discussed later in Sandbox
Limitations/Weaknesses
DIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOXIBM Security Systems | © 2014 IBM Corporation

INTERNALS > RESTRICTIONS > UNAPPLIEDRESTRICTION/ISOLATION MECHANISMS > ILLUSTRATION
 IE EPM job object (in Process Explorer) IE EPM open handles to the default desktop and thedefault window station (in Process Explorer)

DIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOXIBM Security Systems | © 2014 IBM Corporation

INTERNALS > IE SHIMS (COMPATIBILITY LAYER)
 Used for running binary extensions in a lowprivileged environment Used for supporting certain functionalities that needbroker assistance Used for applying elevation policies to launch-type
APIs (WinExec, CreateProcess, CoCreateInstance, …)

 Done via API hooking (Import Address Table
patching)
DIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOXIBM Security Systems | © 2014 IBM Corporation

INTERNALS > IE SHIMS (COMPATIBILITY LAYER) > ILLUSTRATIONDIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOXIBM Security Systems | © 2014 IBM Corporation

INTERNALS > ELEVATION POLICIES Determines how processes/COM servers will belaunched:– 0: Prevent launch– 1: Launch in Low/AppContainer– 2: Launch in Medium with prompt– 3: Launch in Medium without prompt
 Stored in HKLM\Software\Microsoft\Internet
Explorer\Low Rights\ElevationPolicy\<GUID>
 Consulted by IE Shims (sandboxed context) and User
Broker Object (broker context)
DIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOXIBM Security Systems | © 2014 IBM Corporation

INTERNALS > ELEVATION POLICIES > ILLUSTRATIONDIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOXIBM Security Systems | © 2014 IBM Corporation

INTERNALS > IPC
 Used by the sandboxed and the broker process tocommunicate
 Two types of IPC mechanism used:– Shared Memory IPC• Inter-process messages• Data Sharing– COM IPC
• Broker COM Object calls

DIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOXIBM Security Systems | © 2014 IBM Corporation

INTERNALS > IPC > SHARED MEMORY IPC
 Used for inter-process messages and sharing data 3 shared memory sections are used forcommunication:– IsoSpaceV2_Scope<Trusted,LILNAC,Untrusted>– Shared memory sections are internally called“Spaces”– Data communicated/shared are called “Artifacts”
 Broker and sandboxed process are notified ofmessage availability via messaging events
DIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOXIBM Security Systems | © 2014 IBM Corporation

INTERNALS > IPC > SHARED MEMORY IPC > SPACES,CONTAINERS AND ARTIFACTS (ILLUSTRATION)

DIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOXIBM Security Systems | © 2014 IBM Corporation

INTERNALS > IPC > COM IPC
 Used for broker COM object calls– Calls to User Broker Object– Calls to Known Broker Objects
 Bootstrapped using the Shared Memory IPC– Marshaled IEUserBroker interface of the User
Broker Object is stored by broker in an Artifact– Artifact ID is passed to the sandboxed process via
the “CREADAT” switch

DIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOXIBM Security Systems | © 2014 IBM Corporation

INTERNALS > IPC > ILLUSTRATIONDIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOXIBM Security Systems | © 2014 IBM Corporation

INTERNALS > SERVICES
 Services exposed by the broker process to thesandboxed process– Privileged operations– Operations that need to run in the context of thebroker/frame process Detailed list of services are in the companion white
paper

DIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOXIBM Security Systems | © 2014 IBM Corporation

INTERNALS > SERVICES > USER BROKER OBJECT
 Services for launching elevated processes/COM
servers and instantiating Known Broker Objects
 iertutil!CoCreateUserBroker*() are used for retrieving
the IEUserBroker interface
 Example Interfaces and Methods:
Interface (*may change)

MethodNotes

IID_IEUserBroker

WinExec()

Invoke WinExec() in thecontext of the broker{1AC7516E-E6BB-4A69-B63FE841904DC5A6}

IID_IEAxInstallBrokerBroker BrokerGetAxInstallBroker() Instantiate “Internet{B2103BDB-B79E-4474-8424Explorer Add-on Installer”
4363161118D5}
COM object
DIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOXIBM Security Systems | © 2014 IBM Corporation

INTERNALS > SERVICES > KNOWN BROKER OBJECTS Additional services exposed by the broker

 Instantiated via IEUserBroker-> CreateKnownBrokerObject() Example CLSIDs and Interfaces:
CLSID

Interface (*may change) Notes

CLSID_ShdocvwBroker

IID_IShdocvwBroker{9C7A1728-B694-427A-94A2A1B2C60F0360}{A9968B49-EAF5-4B73AA93-A25042FCD67A}
In IE11:{FED6B29E-13A0-48FA8835-093F6F419388}

CLSID_CProtectedModeAPI

IID_IProtectedModeAPI{ED72F0D2-B701-4C53-ADC3F2FB59946DD8}{3853EAB3-ADB3-4BE89C96-C883B98E76AD}

DIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOX

Large number of services.
E.g. handles forwarded
kernel32!CreateFileW(),displaying the Internet
Options dialog box, etc.
Handles the following
Protected Mode API:
IEShowSaveFileDialog(),
IESaveFile(), …
IBM Security Systems | © 2014 IBM Corporation

INTERNALS > SERVICES > USER BROKER OBJECT AND KNOWNBROKER OBJECTS > ILLUSTRATIONDIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOXIBM Security Systems | © 2014 IBM Corporation

INTERNALS > SERVICES > BROKER COMPONENTS MESSAGE
HANDLERS
 Broker code that handles IPC messages from thesandboxed process Reachable/callable via the Shared Memory IPC
 Example handlers:– ieframe!CBrowserFrame::_Handle*()– ieframe!CDownloadManager::HandleDownload
Message() Directly/indirectly calls iertutil!IsoGetMessage
BufferAddress() to retrieve the IPC message
DIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOXIBM Security Systems | © 2014 IBM Corporation

INTERNALS > SERVICES > BROKER COMPONENTS MESSAGE
HANDLERS > ILLUSTRATIONDIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOXIBM Security Systems | © 2014 IBM Corporation

INTERNALS > SUMMARY (PUTTING IT ALL TOGETHER)

DIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOXIBM Security Systems | © 2014 IBM Corporation

DIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOXSANDBOX LIMITATIONS/WEAKNESSESIBM Security Systems | © 2014 IBM Corporation

LIMITATIONS
 What can malicious code still do or access once it isinside the EPM sandbox?
 Compatibility and significant development effort are
the most likely reasons for some of the limitations/weaknesses These are current limitations/weaknesses, future
patches or improvements may address some, if not
all of them
DIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOXIBM Security Systems | © 2014 IBM Corporation

LIMITATIONS > FILE SYSTEM ACCESS Can still list and read most files fromsystem/common folders due to the “ALLAPPLICATION PACKAGES” (AAP) ACE– %ProgramFiles%, %ProgramFiles(x86)% and%SystemRoot% AAP ACE in system/common files and folders is forcompatibility with AppContainer-sandboxed apps

 Implication: List installed applications for futureattacks, steal license key files stored insystem/common locations, etc.
DIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOXIBM Security Systems | © 2014 IBM Corporation

LIMITATIONS > FILE SYSTEM ACCESS (CONT.) Few user-specific folders are still accessible due tothe “ALL APPLICATION PACKAGES” or theinternetExplorer ACE– %UserProfile\Favorites (R/W via internetExplorer
ACE) Can also steal EPM cookies and cache files in
AppContainer-specific location– %UserProfile%\AppData\Local\Packages\<AppContainer Name>\AC\InetCache, InetCookies
DIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOXIBM Security Systems | © 2014 IBM Corporation

LIMITATIONS > REGISTRY ACCESS Can still read most system/common keys due to the“ALL APPLICATION PACKAGES” ACE– HKEY_CLASSES_ROOT, HKEY_LOCAL_MACHINE, …
 AAP ACE in system/common keys is for compatibility
with AppContainer-sandboxed applications
 Implication: Retrieve system/general application
configuration/data– HKLM\Software\...\Low Rights\ElevationPolicy– HKLM\Software\...\Windows
NT\CurrentVersion (Registered Owner/Org.)

DIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOXIBM Security Systems | © 2014 IBM Corporation

LIMITATIONS > REGISTRY ACCESS (CONT.) Several user-specific keys in HKCU are still accessible
due to the “ALL APPLICATION PACKAGES” or theinternetExplorer ACE
 Implication: Read potentially sensitive/personal
information– HKCU\Software\...\Explorer\RunMRU– HKCU\Software\...\Explorer\RecentDocs– HKCU\Software\...\Internet Explorer\TypedURLs

DIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOXIBM Security Systems | © 2014 IBM Corporation

LIMITATIONS > FILE SYSTEM/REGISTRY ACCESS AND RESTRICTEDTOKENS EPM could potentially further lockdown access touser-specific locations (HKCU and %UserProfile%)using a restricted token
 Lockdown would mean brokering access to locations
that the EPM-sandboxed process would normally has
direct access to, e.g.:
 AppContainer-specific locations
 Those that have an internetExplorer capability ACE
DIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOXIBM Security Systems | © 2014 IBM Corporation

LIMITATIONS > CLIPBOARD ACCESS Can still read from and write to the clipboard– No clipboard restriction in the job object– Window station isolation is not implemented
 Caveat: An AppContainer process should be theprocess that is actively receiving keyboard input inorder to access the clipboard
 Implication:– Capture potentially sensitive information and apotential sandbox escape vector
DIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOXIBM Security Systems | © 2014 IBM Corporation

LIMITATIONS > SCREEN SCRAPING AND SCREEN CAPTURE
 Can still send allowed messages (e.g. WM_GETTEXT)
to windows owned by other processes– No UILIMIT_HANDLES restriction in the job object– Desktop isolation is not implemented

 Implication: Capture information fromcontrols/windows of other applications
 Screen capture is another possible information
disclosure attack
DIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOXIBM Security Systems | © 2014 IBM Corporation

LIMITATIONS > NETWORK ACCESS Can still connect to Internet and public network
endpoints– Possible via the internetClient capability Implications:– Communicate and send stolen information to aremote attacker– Use the system to connect to or attack other
Internet and public network endpoints

DIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOXIBM Security Systems | © 2014 IBM Corporation

LIMITATIONS > SUMMARY
 Some types of potentially sensitive or personal
information can still be stolen– Because of the access control list of certain files,
folders and registry keys
– Because of unapplied or unimplemented
restriction and isolation mechanisms

DIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOXIBM Security Systems | © 2014 IBM Corporation

DIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOXSANDBOX ESCAPEIBM Security Systems | © 2014 IBM Corporation

ESCAPE What are the potential vectors for escaping the EPM
sandbox?

DIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOXIBM Security Systems | © 2014 IBM Corporation

ESCAPE > LOCAL ELEVATION OF PRIVILEGE (EOP)VULNERABILITIES Particularly those that result in kernel-mode code
execution
 Multiple kernel attack vectors are available Example (Win32k): CVE-2013-1300– Discovered by Jon Butler and Nils
– Used to escape Google Chrome’s sandbox in
Pwn2Own 2013

DIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOXIBM Security Systems | © 2014 IBM Corporation

ESCAPE > LOCAL ELEVATION OF PRIVILEGE (EOP)VULNERABILITIES > ILLUSTRATIONDIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOXIBM Security Systems | © 2014 IBM Corporation

ESCAPE > POLICY/PERMISSION VULNERABILITIES Permissive write-allowed sandbox policies orresource permissions that can be leveraged tocontrol the behavior of a higher-privileged process Elevation policies that could result in the executionof arbitrary code in a more privileged context
 Example (IE): CVE-2013-3186– Discovered by Fermin Serna– Default elevation policy allows the execution of
msdt.exe in medium without prompt– msdt.exe can be used to execute arbitrary scripts
DIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOXIBM Security Systems | © 2014 IBM Corporation

ESCAPE > POLICY/PERMISSION VULNERABILITIES >ILLUSTRATIONDIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOXIBM Security Systems | © 2014 IBM Corporation

ESCAPE > POLICY CHECK VULNERABILITIES Issues that can cause a policy check bypass

 Example (IE): CVE-2013-4015 (MS13-055)– Bug I discovered in a function used by the User
Broker Object: ieframe!GetSanitizedParameters
FromNonQuotedCmdLine()– Return value of the vulnerable function is
eventually used in an elevation policy check

DIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOXIBM Security Systems | © 2014 IBM Corporation

ESCAPE > POLICY CHECK VULNERABILITIES > CVE-2013-4015
 Mislead ieframe!GetSanitizedParameters
FromNonQuotedCmdLine() by using a tab instead ofa space to delimit app name and arguments:
C:\Windows\System32\cmd.exe\t\..\notepad.exe /c calc.exe– Returns “C:\Windows\system32\notepad.exe” asapplication name
 C:\Windows\system32\notepad.exe has a default
medium without prompt elevation policy But kernel32!WinExec() will execute cmd.exe instead
DIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOXIBM Security Systems | © 2014 IBM Corporation

ESCAPE > POLICY CHECK VULNERABILITIES > ILLUSTRATIONDIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOXIBM Security Systems | © 2014 IBM Corporation

ESCAPE > SERVICE VULNERABILITIES Services exposed by higher-privileged processes are alarge attack surface for sandbox escape Example (Reader): CVE-2013-0641– Used in the first in-the-wild Reader sandbox
escape exploit– Buffer overflow in a broker service due to anincorrect output buffer size passed to an API

DIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOXIBM Security Systems | © 2014 IBM Corporation

ESCAPE > SERVICE VULNERABILITIES > ILLUSTRATIONDIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOXIBM Security Systems | © 2014 IBM Corporation

ESCAPE > SUMMARY
 Involves exploiting a weakness in a higher-privileged
code (kernel, other applications, or the broker)
 Permissive policies/permissions and improper
handling of untrusted data are prime examples of
weaknesses that can lead to a sandbox escape Vulnerabilities in the sandbox mechanisms arepotential vectors for sandbox escape– Policy issues, policy checking and broker service
vulnerabilities
DIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOXIBM Security Systems | © 2014 IBM Corporation

DIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOXSANDBOX ESCAPE DEMO
CVE-2013-4015 (MS13-055)

IBM Security Systems | © 2014 IBM Corporation

DIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOXCONCLUSIONIBM Security Systems | © 2014 IBM Corporation

CONCLUSION EPM certainly helps in preventing theft of personal
files and corporate assets from the network
 However, some types of potentially sensitive or
personal information can still be stolen
 EPM can be further improved by combining
AppContainer with other restriction/isolation
mechanisms
 AppContainer is an interesting security feature tofurther look at
DIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOXIBM Security Systems | © 2014 IBM Corporation

MAJOR REFERENCES (COMPLETE REFERENCE LIST IS IN THE
COMPANION WHITE PAPER)


M. Silbey and P. Brundrett, "MSDN: Understanding and Working in Protected Mode Internet
Explorer," [Online]. Available: http://msdn.microsoft.com/en-us/library/bb250462(v=vs.85).aspx



T. Keetch, "Escaping from Protected Mode Internet Explorer," [Online]. Available:
http://archive.hack.lu/2010/Keetch-Escaping-from-Protected-Mode-Internet-Explorer-slides.ppt

Ollie, "Windows 8 App Container Security Notes - Part 1," [Online]. Available:
http://recxltd.blogspot.com/2012/03/windows-8-app-container-security-notes.html



A. Ionescu, "Windows 8 Security and ARM," [Online]. Available:
https://ruxconbreakpoint.com/assets/Uploads/bpx/alex-breakpoint2012.pdf



A. Allievi, "Securing Microsoft Windows 8: AppContainers," [Online]. Available:
http://news.saferbytes.it/analisi/2013/07/securing-microsoft-windows-8-appcontainers/



S. Renaud and K. Szkudlapski, "Windows RunTime," [Online]. Available:
http://www.quarkslab.com/dl/2012-HITB-WinRT.pdf



E. Lawrence, "Understanding Enhanced Protected Mode," [Online]. Available:
http://blogs.msdn.com/b/ieinternals/archive/2012/03/23/understanding-ie10-enhanced-protectedmode-network-security-addons-cookies-metro-desktop.aspx

DIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOXIBM Security Systems | © 2014 IBM Corporation

DIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOX

Thank You!
Mark Vincent Yason
IBM X-Force Advanced Research
yasonm[at]ph[dot]ibm[dot]com@MarkYason

DIVING INTO IE 10’S ENHANCED PROTECTED MODE SANDBOXIBM Security Systems | © 2014 IBM Corporation