July 2007 - Posts

Practical Windows Sandboxing – Part 3
The third tool we need in order to create a sandboxed app is a desktop. We've said in many places that the desktop is a security boundary. Unfortunately, there's little real security within a desktop – and this isn't something unique to Windows – the Read More...
Posted 31 July 07 03:04 by david_leblanc | 3 Comments   
Practical Windows Sandboxing, Part 2
Once you have a process in a restricted token, the next tool you can use to limit what it can do is a job object. Like restricted tokens, these shipped in Windows 2000. A job object is similar to how ulimits work on UNIX(ish) OS's, but don't do some of Read More...
Posted 30 July 07 06:53 by david_leblanc | 3 Comments   
Logon ID SIDs
I've mentioned logon ID SIDs a couple of times, but they're fairly arcane. I first ran into them when I was exploring just what was in a process token, and a group SID came up that I wasn't familiar with. Here's how a SID is defined: typedef struct _SID Read More...
Posted 29 July 07 12:02 by david_leblanc | 1 Comments   
Practical Windows Sandboxing – Part 1
I've written more than once about how interesting restricted tokens are – the earliest article was on Mark Edward's Windows Security web site. Unless it's been taken down recently, the article and source code are still there. In the nearly 8 years since Read More...
Posted 27 July 07 07:16 by david_leblanc | 0 Comments   
Security Dependencies Follow-up
Someone asked how dependencies should be handled if you're depending on another team at the same company. As you may well imagine, this is a very common issue here – for example, a bunch of apps we ship use SharePoint as a platform, which in turn uses Read More...
Posted 26 July 07 04:45 by david_leblanc | 0 Comments   
Process Tokens and Default DACLs
I ran up on something the other day that isn't very well documented in one place. When you're dealing with restricted tokens, and in a few other limited scenarios, the default DACL on the process token becomes important. We can look at the default DACL Read More...
Posted 26 July 07 03:37 by david_leblanc | 1 Comments   
Security Dependencies
There's been an interesting little tempest in a teapot going on WRT IE and Firefox. I in general don't pay a whole lot of attention to the browser vuln du jour, but this one caught my eye - http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9027718&intsrc=news_ts_head Read More...
Posted 24 July 07 01:09 by david_leblanc | 3 Comments   
Page view tracker