Prior to releasing Windows 8, Microsoft claimed that all WinRT apps are cleanly removed from your computer after uninstalling them, and that WinRT apps should not interfere with other running applications, because they are ran in a "sandboxed" environment. Microsoft has also claimed numerous times on Channel9 that Windows 8 apps are not ran in a VM. So my question is; are these claims accurate? If the application is not running inside of a VM, how is it possible to protect the system against malicious code at runtime, assuming the attacker was able to bypass the screening process of the Windows Store system? Microsoft allows "native code" in WinRT apps, so wouldn't it be possible (using hand-coded assembly or some odd pointer manipulation trick to call functions outside of the sandboxed environment and interfere with the rest of the system, if it's really "native code" and not some VM?
closed as not constructive by HackToHell, Diogo, avirk, Indrek, Hennes Oct 27 '12 at 17:19
As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or specific expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, see the FAQ for guidance.
|
Don't confuse a sandbox with a VM. They're different things. And while you can isolate things with a VM they're not in itself a security measure. Basically in a sandbox you restrict what an application can do. E.g. arbitrary filesystem access is out. Furthermore they likely restrict an app to where it can write (its own happy place in the file system) and where it can read (the same, and selected locations, e.g. Pictures, if enabled). You can monitor calls that are made that are potentially unsafe and reject them or apply additional restrictions. There are doubtless flaws in that system allowing it to be bypassed, as happened to any other sandbox out there too. There is also a host of defense-in-depth mechanisms that will make it harder to do anything useful as an attacker even if you breach the sandbox. None of this is new, by the way. |
|||
|
|
|
Nothing is secure, it's just a matter of time viruses will start to appear on Windows RT, a best case scenario would be that Microsoft pushes out security updates so fast(and users actually install them) that it's not worth the effort to make malware for it(this is more or less the case for Linux distro's). |
|||||||
|
