Following a rather high-profile failure for Windows 10’s Edge browser at Pwn2Own which we reported on earlier this week, Microsoft has come back out of its corner with fighting talk of tightening the browser’s sandbox security.
New changes are coming with the Creators Update for Windows 10 which will considerably bolster the strength of said sandbox when the upgrade arrives next month.
For the uninitiated, a sandbox simply means running something isolated from the rest of the system – in its own little self-contained ‘box’ – with the intention being to ensure that an attack on that software can’t be further leveraged to reach the user’s PC at large.
So what’s Microsoft doing to ensure better security? First off, the Edge team has reduced the ‘attack surface’ of the browser’s sandbox, minimizing the amount of code available for an attacker to attempt to exploit, and fine-tuning Edge’s sandbox to be a “much tighter fit to the functional needs of the software”.
Microsoft explains in a blog post: “That is a lot of work, which is why this is not how the UWP [Universal Windows Platform] works. But because web browsers are among some of the most threatened software there is, it is worth it in this case.”
The firm also made it clear that the browser’s Flash app container has undergone a similar process of hand-tuning to tighten it up, because as you’re probably aware, Flash is an often-used attack vector.
- These are the best gaming mice you can buy in 2017
Going for brokers
Microsoft further talked about improved countermeasures regarding Edge’s ‘brokers’ – code which allows access to resources on the PC when necessary (such as granting access to a specific file on the computer – and only that file – if you’re uploading it via the browser).
Hacking a broker is a potential method of being able to escape from the sandbox, and the firm noted that the aforementioned tightening of the sandbox cut off access to many brokers, leaving less opportunity for exploits – and furthermore, a number of fresh exploit mitigation technologies have been applied to said brokers.
The net result being that escaping the sandbox by exploiting a broker interface is a much less likely prospect.
With all these measures and some further tweaking, Microsoft is claiming that Edge’s tighter sandbox has a ‘significantly’ reduced attack surface.
The software giant said: “While attack surface reduction does not guarantee that an attacker cannot escape the sandbox, it does dramatically reduce the opportunities for attack, much like reducing the number of windows and doors in a fortress.”
As already mentioned, when it came to the Pwn2Own hacking extravaganza, Microsoft Edge proved to be the least secure browser, being exploited five times – a long way off first-place Chrome which kept a clean sheet from attackers.
That’s probably why Microsoft is keen to talk up security right now, and besides, it’s something which the company hasn’t shied away from doing in the past with Edge.
Via: On MSFT
- These are the best laptops for college students to use
