1 of 10

Module: Sandboxing

Into the Jail

Yan Shoshitaishvili

Arizona State University

2 of 10

Sandboxing Cycle

https://xkcd.com/2044/

3 of 10

In the beginning (computing, circa 1950)...

First, everything ran on bare metal.

​

​

Problem: every process was omnipotent.

4 of 10

The split of OS and userspace (circa 1960)...

Hardware measures were developed to separate "system" and "process" code (1960s).

​

​

​

Problem: processes could still clobber each other.

5 of 10

The rise of virtual memory (circa 1980)...

Hardware measures were developed to separate the memory space of different processes.

​

6 of 10

The rise of in-process separation (circa 1990)...

Separation between the interpreter and the interpreted code.

​

7 of 10

Browser hacking (circa 2000).

  1. Link victim to malicious web page.
  2. Trigger vulnerability.
  3. Wreak havoc all over the victim machine.

​

Known as a "Drive By Download". Popular "traditional" targets:

  • Adobe Flash
  • ActiveX
  • Java Applets

8 of 10

Browser hacking mitigations (circa 2010).

Original solution: eliminate traditional targets.

  • Let's kill Adobe Flash!
  • Why do we even need ActiveX?
  • Java Applets are lame!

​

Turns out that this does not solve the problem. Hackers moved on to:

  • JavaScript engine vulnerabilities.
  • Media codec vulnerabilities.
  • Imaging library vulnerabilities.

9 of 10

The rise of sandboxing (circa 2010)...

Untrusted code/data (i.e., downloaded JavaScript, PNGs, PDFs, etc) should live in a process with almost zero permissions.

​

  1. Spawn "privileged" parent process.
  2. Spawn "sandboxed" child processes.
  3. When a child needs to perform a privileged action, it asks the parent.�

In this module, we will learn about different sandboxing technologies and their weaknesses!

10 of 10

How well does this work?

Sandboxing is extremely effective.

​

In this class, we'll see several strong mitigations that are so effective that a second vulnerability is needed to bypass the mitigation and make the first vulnerability useful.

​

Sandboxes are a strong mitigation:

  • need one set of vulnerabilities to exploit sandboxed process
  • need another set of vulnerabilities to "break out" of the sandbox.