Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Prior to releasing Windows 8, Microsoft claimed that all WinRT apps are cleanly removed from your computer after uninstalling them, and that WinRT apps should not interfere with other running applications, because they are ran in a "sandboxed" environment. Microsoft has also claimed numerous times on Channel9 that Windows 8 apps are not ran in a VM. So my question is; are these claims accurate? If the application is not running inside of a VM, how is it possible to protect the system against malicious code at runtime, assuming the attacker was able to bypass the screening process of the Windows Store system? Microsoft allows "native code" in WinRT apps, so wouldn't it be possible (using hand-coded assembly or some odd pointer manipulation trick to call functions outside of the sandboxed environment and interfere with the rest of the system, if it's really "native code" and not some VM?

share|improve this question

closed as not constructive by HackToHell, Diogo, avirk, Indrek, Hennes Oct 27 '12 at 17:19

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

2 Answers 2

up vote 2 down vote accepted

Don't confuse a sandbox with a VM. They're different things. And while you can isolate things with a VM they're not in itself a security measure.

Basically in a sandbox you restrict what an application can do. E.g. arbitrary filesystem access is out. Furthermore they likely restrict an app to where it can write (its own happy place in the file system) and where it can read (the same, and selected locations, e.g. Pictures, if enabled). You can monitor calls that are made that are potentially unsafe and reject them or apply additional restrictions.

There are doubtless flaws in that system allowing it to be bypassed, as happened to any other sandbox out there too. There is also a host of defense-in-depth mechanisms that will make it harder to do anything useful as an attacker even if you breach the sandbox. None of this is new, by the way.

share|improve this answer

Nothing is secure, it's just a matter of time viruses will start to appear on Windows RT, a best case scenario would be that Microsoft pushes out security updates so fast(and users actually install them) that it's not worth the effort to make malware for it(this is more or less the case for Linux distro's).

share|improve this answer
    
Since only 3rd party Store apps (that have to be approved by MS) and not Desktop apps can be installed on RT, I would guess that the platform may not be as virus-ridden due to its locked down nature. –  Karan Oct 28 '12 at 1:03
    
@Karan - There have been malicious files on both the Apple and Google application store. So what you claim isn't really all that true. –  Ramhound Oct 28 '12 at 3:02
    
@Ramhound: When I say "may not be as virus-ridden [as normal Windows]", that doesn't mean "completely virus free". I chose my words carefully. –  Karan Oct 28 '12 at 3:04

Not the answer you're looking for? Browse other questions tagged or ask your own question.