Chrome taking it to the next level

View previous topic View next topic Go down

Chrome taking it to the next level

Post by Guest on 6/5/2012, 23:25

Chromium, now rendering in Untrusted sandboxes (even more restrictive than Untrusted) in WIndows 7 cheers

Sandboxie now respecting Chrome's Low rights containes (and yes the new Untrusted ones) cheers

SSJ100 everything okay on your self proclaimed security forum?

I can't find the remove membership option, where can I find that lol!

Guest
Guest


Back to top Go down

Re: Chrome taking it to the next level

Post by wat0114 on 8/5/2012, 07:52

Kees1958 wrote:Chromium, now rendering in Untrusted sandboxes (even more restrictive than Untrusted) in WIndows 7 cheers

Sandboxie now respecting Chrome's Low rights containes (and yes the new Untrusted ones) cheers

SSJ100 everything okay on your self proclaimed security forum?


Hi kees,

how are you doing these days? Smile A question I have for you: is Chromium's sandbox still based on the explanation from the below link?

-http://dev.chromium.org/developers/design-documents/sandbox

wat0114
Advanced Member
Advanced Member

Posts : 152
Join date : 2010-05-11

View user profile

Back to top Go down

Re: Chrome taking it to the next level

Post by Guest on 8/5/2012, 11:04

Yep same design design, only implementation enhancements. Win 7 there is System, High, Medium, Low and Untrusted.

Now Chrome uses medium (broker), shared services on LOW (GPU, flash, PDF) and renderer tabs in Untrusted. When you have Chrome's flash/pdf the call to this dll is not visible via medium Rundll32 anymore ????, so broker seems to be only medium level instance.

I am okay, allthough I will be executed soon

Guest
Guest


Back to top Go down

Re: Chrome taking it to the next level

Post by ssj100 on 8/5/2012, 12:22

Hi Kees, nice to see you around! I would feel bad removing an old "friend" from this forum haha. You sure you want this?

Forum is as quiet as usual, which is nice, since I'm quite busy with "life" these days.

Nice to see that Chrome is "taking it to the next level". I still use Firefox myself, perhaps mostly out of habit. Anyway, it's nice to see freeware software (browsers) pushing each other to improve - it's all good for end users like ourselves!

_________________
Sandboxie + LUA + SRP + DEP + SuRun
Windows Firewall + NAT Router + IPSec (on-demand)
VirtualBox (on-demand)
Drive SnapShot (on-demand)
avatar
ssj100
Administrator
Administrator

Posts : 1389
Join date : 2010-04-14

View user profile http://ssj100.fullsubject.com

Back to top Go down

Re: Chrome taking it to the next level

Post by wat0114 on 8/5/2012, 19:10

Kees1958 wrote:Yep same design design, only implementation enhancements. Win 7 there is System, High, Medium, Low and Untrusted.

Now Chrome uses medium (broker), shared services on LOW (GPU, flash, PDF) and renderer tabs in Untrusted. When you have Chrome's flash/pdf the call to this dll is not visible via medium Rundll32 anymore ????, so broker seems to be only medium level instance.

Thanks kees! Like ssj, I also use Firefox (Waterfox, actually) running @ low IL thanks to m00nbl00d's help Smile w/NoScript plug-in.

I am okay, allthough I will be executed soon

Uh-ohh,... Shocked

wat0114
Advanced Member
Advanced Member

Posts : 152
Join date : 2010-05-11

View user profile

Back to top Go down

Re: Chrome taking it to the next level

Post by Guest on 8/5/2012, 23:24

Don't worry the bad guy had to pay for the ice cream to be awakened again.

After the ice cream, they catched me again, this time they hanged me. bounce

Guest
Guest


Back to top Go down

Re: Chrome taking it to the next level

Post by ssj100 on 9/5/2012, 03:18

wat0114 wrote:Like ssj, I also use Firefox (Waterfox, actually) running @ low IL thanks to m00nbl00d's help Smile w/NoScript plug-in.
What are the advantages (and disadvantages, if any) of Waterfox? I still use NoScript too - can't surf without it!

_________________
Sandboxie + LUA + SRP + DEP + SuRun
Windows Firewall + NAT Router + IPSec (on-demand)
VirtualBox (on-demand)
Drive SnapShot (on-demand)
avatar
ssj100
Administrator
Administrator

Posts : 1389
Join date : 2010-04-14

View user profile http://ssj100.fullsubject.com

Back to top Go down

Re: Chrome taking it to the next level

Post by wat0114 on 9/5/2012, 06:08

ssj100 wrote:
What are the advantages (and disadvantages, if any) of Waterfox? I still use NoScript too - can't surf without it!

According to the FAQ's in ther link, mainly performance, although I'm admittedly hard pressed to notice any difference.

-http://waterfoxproject.org/faq/

NoScript is great. I had previously given up too easily on it, but it is fine-tuned nicely for me and of course I keep the whitelist handy just in case.

wat0114
Advanced Member
Advanced Member

Posts : 152
Join date : 2010-05-11

View user profile

Back to top Go down

Re: Chrome taking it to the next level

Post by ssj100 on 9/5/2012, 07:00

I see, sounds like a 64-bit version of Firefox.

Yes, NoScript is great indeed. It's like a default-deny Classical HIPS within the browser haha.

_________________
Sandboxie + LUA + SRP + DEP + SuRun
Windows Firewall + NAT Router + IPSec (on-demand)
VirtualBox (on-demand)
Drive SnapShot (on-demand)
avatar
ssj100
Administrator
Administrator

Posts : 1389
Join date : 2010-04-14

View user profile http://ssj100.fullsubject.com

Back to top Go down

Re: Chrome taking it to the next level

Post by Guest on 10/5/2012, 19:48

With Sandboxie now respecting the LOW and UNTRUSTED integrity levels, you must be out of your mind to keep using FireFox when on Vista or Windows7. I guess you security 'insiders/enthousiasts' are still on XP, not on Vista or Windows7 (I trust you both understand the security benefits you acquire of having both the low/untrusted rights policy container of Chrome and the virtualisation sandbox of Sandboxie).

Anyway Noscript functionality is build into Chrome, just use two different profiles (plus incognito) to get the missing allow once functionality, see
http://www.wilderssecurity.com/showthread.php?s=13abb9fbe434ad5b3309e079b858431e&t=323783

Guest
Guest


Back to top Go down

Re: Chrome taking it to the next level

Post by ssj100 on 11/5/2012, 03:58

I'm still on XP, but even if I was on Vista/7/8, I would still be keen on using Firefox.

The main reasons are because I'm just used to Firefox and I really like NoScript. NoScript is not just about allowing or disallowing Java/Flash etc; it also includes features like Anti-XSS protection, Application Boundaries Enforcer (ABE), and ClearClick (anti-clickjacking).
NoScript may also provide additional defenses against web-based attacks such as XSS, CSRF, clickjacking, man-in-the-middle attacks and DNS rebinding, with specific countermeasures which work independently from script blocking.
See here for an example of ABE in action:
http://ssj100.fullsubject.com/t287p15-web-based-keylogger-attack#2304
I don't know if Chrome has this ABE function built into it too - could you test it for us Kees? Browse to this test site which simulates a web-based keylogger:
http://ssj100.fullsubject.com/t287-web-based-keylogger-attack#2268
I understand that "tlu" recently stated that he would never do online banking without NoScript. I have huge respect for tlu (I feel he was the first public internet forum user to really push for LUA + SRP with SuRun on Windows XP), and I suppose it's pleasant to see that such a user appreciates NoScript so much - even more than I do actually. I don't do internet banking (or any online transactions) with NoScript - instead I use a tightly configured sandboxed IE 8 in pretty much its original freshly installed state with all third party toolbars and extensions etc disabled. Specifically for an online banking session, I also use Windows XP's built-in IPSec to conveniently block all internet traffic except communication to my bank's IP address via Port 443 - I don't see how anything can bypass this, no matter which browser I use and even if my system was crawling with data mining malware.

Furthermore, contrary to popular belief, NoScript is also very convenient to use/manage for everyday browsing. It has been refined over many years and development/maintenance is still very active.

I don't think I have any Chrome-based software on my computer - I like to keep the number of programs installed to a minimum - even if you uninstall a program as cleanly as possible, it is still likely that some registry alterations or some "junk" file(s) would remain. This is probably not a good reason to not install Chrome though! I've also read about privacy issues/breaches from Google (Chrome) - obviously they aren't a big deal, since I think users like m00nbl00d and yourself are promoting the use of Chrome.

Anyway, given that I'm on XP, my understanding is that I wouldn't get any of the security benefits of the low/untrusted rights policy container of Chrome. However, can you remind me (and others) what exactly are the benefits of this when running Vista/7 in a limited/standard user account?

_________________
Sandboxie + LUA + SRP + DEP + SuRun
Windows Firewall + NAT Router + IPSec (on-demand)
VirtualBox (on-demand)
Drive SnapShot (on-demand)
avatar
ssj100
Administrator
Administrator

Posts : 1389
Join date : 2010-04-14

View user profile http://ssj100.fullsubject.com

Back to top Go down

Re: Chrome taking it to the next level

Post by wat0114 on 11/5/2012, 05:14

Kees1958 wrote:With Sandboxie now respecting the LOW and UNTRUSTED integrity levels, you must be out of your mind to keep using FireFox when on Vista or Windows7. I guess you security 'insiders/enthousiasts' are still on XP, not on Vista or Windows7 (I trust you both understand the security benefits you acquire of having both the low/untrusted rights policy container of Chrome and the virtualisation sandbox of Sandboxie).

Anyway Noscript functionality is build into Chrome, just use two different profiles (plus incognito) to get the missing allow once functionality, see
http://www.wilderssecurity.com/showthread.php?s=13abb9fbe434ad5b3309e079b858431e&t=323783

Nope, Win7x64 for well over a year Smile Sandboxie is nice - very nice - but it's 3rd party security, and then I have taken advantage of the integrity levels of Win7 by applying them to Waterfox using chml. m00nbl00d helped me out a lot in this forum Smile Actually, kees, I seem to remember you not too long ago comparing the use of Sandboxie to allowing the cr@* into the toilet, or something along those lines tongue Wink

ssj100 wrote:

Furthermore, contrary to popular belief, NoScript is also very convenient to use/manage for everyday browsing. It has been refined over many years and development/maintenance is still very active.

Agreed, and I never used to feel this way the first few times I used it, but given a chance with a little patience and it can be set up to provide a powerful defense against web-borne malicious scripts.

wat0114
Advanced Member
Advanced Member

Posts : 152
Join date : 2010-05-11

View user profile

Back to top Go down

Re: Chrome taking it to the next level

Post by Guest on 11/5/2012, 12:38

I had specific reasons for critisizing Sandboxie: search for the post and you will see it was some while ago (I think it was before Tzuk provided drop rights if memory serves me right).

- On XP SBIE ran the sandboxed programs Admin elevated
=> Tzuk provided the drop rights option

- On Vista and Windows 7, SBIE did not respect the LOW rights container (or sandbox as Microsoft and Google call it, but it is a container)
=> About a month ago Tzuk changed SBIE to respect the Low rights (and even Untrusted rights of Windows7 and upcoming AppContainer on Win8). We had contact about this and I openly complimented him with this on his forum.

Tzuk takes critism a lot better than the SBIE fanboys (just check the SBIE forum).


Last edited by Kees1958 on 11/5/2012, 20:52; edited 1 time in total

Guest
Guest


Back to top Go down

Re: Chrome taking it to the next level

Post by wat0114 on 11/5/2012, 17:55

No worries kees, just razzin' you Very Happy lol!

I think there's a number of different, yet highly effective, ways of securing the browser, and not really one is necessarily better than hte other, just whatever is up to the individual's prefernces Smile

wat0114
Advanced Member
Advanced Member

Posts : 152
Join date : 2010-05-11

View user profile

Back to top Go down

Re: Chrome taking it to the next level

Post by Guest on 11/5/2012, 18:33

[quote="ssj100"]I'm still on XP, but even if I was on Vista/7/8, I would still be keen on using Firefox.[/quote]
Good on XP there is not much difference

[quote="ssj100"]
The main reasons are because I'm just used to Firefox and I really like NoScript. NoScript is not just about allowing or disallowing Java/Flash etc; it also includes features like Anti-XSS protection, Application Boundaries Enforcer (ABE), and ClearClick (anti-clickjacking).
[quote]NoScript may also provide additional defenses against web-based attacks such as XSS, CSRF, clickjacking, man-in-the-middle attacks and DNS rebinding, with specific countermeasures which work independently from script blocking.[/quote]
See here for an example of ABE in action:
http://ssj100.fullsubject.com/t287p15-web-based-keylogger-attack#2304
I don't know if Chrome has this ABE function built into it too - could you test it for us Kees? Browse to this test site which simulates a web-based keylogger:
http://ssj100.fullsubject.com/t287-web-based-keylogger-attack#2268
[/quote]

lol! Firefox needs Noscript to get on par with IE and Chrome lol!

Chrome and IE are way ahead in XSS protection than FF, furthermore IE has some settings which are easily accessible with group policy editor (I never understood why Mickeysoft did not has a safe-option for IE on Home user versions) which help mitigate scripting and binary intrusions. The so called 'web based keylogger' is nothing more than a weak secured page (meaning both encrypted and plain data is displayed). Yes IE and Chrome do provide a warning on 'mixed' content. Duhh.

[quote="ssj100"]
Anyway, given that I'm on XP, my understanding is that I wouldn't get any of the security benefits of the low/untrusted rights policy container of Chrome. However, can you remind me (and others) what exactly are the benefits of this when running Vista/7 in a limited/standard user account?[/quote]

lol! I hope you ask this question for others and not for yourself lol!
On XP you are basically using three levels System/Admin, Standard User and Guest. In effect the Guest is not used in the normal scheme (most people have it disabled). So in practise there are two levels of security (high and medium).

On Vista/Windows 7 besides these High (Installer/System/Admin) and Medium (Limited/Standard User) levels there is also a level called Low and Untrusted. UAC protection scheme allows side by side infection (a medium process token is allowed to change objects of another medium level token, but a medium can't touch high level).

So adding a third and a fourth level, puts all the browser processes in a container (Low rights for out of processes shared objects like flash and PDF and Untrusted for html rendering and javascript processing). Meaning everything in the browser can't touch the medium level processes (of the limited user). cheers

Guest
Guest


Back to top Go down

Re: Chrome taking it to the next level

Post by ssj100 on 12/5/2012, 00:36

Kees1958 wrote:Chrome and IE are way ahead in XSS protection than FF, furthermore IE has some settings which are easily accessible with group policy editor (I never understood why Mickeysoft did not has a safe-option for IE on Home user versions) which help mitigate scripting and binary intrusions. The so called 'web based keylogger' is nothing more than a weak secured page (meaning both encrypted and plain data is displayed). Yes IE and Chrome do provide a warning on 'mixed' content. Duhh.
That wasn't what I was asking Kees. I am well aware that IE (and probably all other browsers) display a "warning" message on "mixed" content - you just have to read the links I gave you to see that even IE 6 displays this. What I was asking was whether Chrome (by default) has built in mechanisms to allow the user to safely type in their credentials into a web page despite "mixed" content being present (where part of the "mixed" content contains malicious logging HTTP code). As far as I understand, with NoScript ABE, the following ruleset blocks this potentially malicious HTTP code, while still allowing the safe HTTPS content:


Does Chrome have this built-in protection? And again, you can test whether it does by visiting that site I linked. A successful test would look like this:



Of course, without NoScript's ABE component, Firefox by default also displays a "warning" message:

This is nothing special - even IE 6 has this.

Furthermore, I wasn't really asking about the default built-in XSS protection of each browser. I was trying to compare NoScript's (Firefox) XSS protection with Chrome's built-in one. I'm no expert on this, but it looks like NoScript is always improving its XSS protection with each newly released version - it makes me think that XSS protection is much more complex than many people think. Anyway, I'm still not convinced that Chrome has all the protective mechanisms of NoScript by default. What about anti-clickjacking? Again, looking at NoScript's changelogs, it seems like its anti-clickjacking protection is continually improved upon with each new version.

Kees1958 wrote:lol! I hope you ask this question for others and not for yourself lol!
On XP you are basically using three levels System/Admin, Standard User and Guest. In effect the Guest is not used in the normal scheme (most people have it disabled). So in practise there are two levels of security (high and medium).

On Vista/Windows 7 besides these High (Installer/System/Admin) and Medium (Limited/Standard User) levels there is also a level called Low and Untrusted. UAC protection scheme allows side by side infection (a medium process token is allowed to change objects of another medium level token, but a medium can't touch high level).

So adding a third and a fourth level, puts all the browser processes in a container (Low rights for out of processes shared objects like flash and PDF and Untrusted for html rendering and javascript processing). Meaning everything in the browser can't touch the medium level processes (of the limited user). cheers
Thanks for the reminder haha. I wasn't actually aware of (or understood) these integrity levels until m00nbl00d posted about it some months ago. As I said, I'm still on Windows XP, and have only used Windows 7 to play with AppLocker (this was about 2+ years ago). I've only used Windows Vista since it exists on other home user's computers that I come across.

Anyway, it sounds like Chrome is basically taking advantage of Windows' own security mechanisms - I like that! What I don't understand is why Limited Users have "medium" level access (that is, processes in a Limited User Account run with "medium" level integrities?) Shouldn't they have low or untrusted levels by default? And because of this, I would have thought that Chrome processes in a Limited User Account should be running with low or untrusted levels by default.

_________________
Sandboxie + LUA + SRP + DEP + SuRun
Windows Firewall + NAT Router + IPSec (on-demand)
VirtualBox (on-demand)
Drive SnapShot (on-demand)
avatar
ssj100
Administrator
Administrator

Posts : 1389
Join date : 2010-04-14

View user profile http://ssj100.fullsubject.com

Back to top Go down

Re: Chrome taking it to the next level

Post by wat0114 on 12/5/2012, 05:33

ssj100 wrote: What I don't understand is why Limited Users have "medium" level access (that is, processes in a Limited User Account run with "medium" level integrities?) Shouldn't they have low or untrusted levels by default?

The restrictive nature of Low IL processes as described in the link below would seem to make it very difficult or impossible to properly run all processes at Low IL.

-http://msdn.microsoft.com/en-us/library/bb625960.aspx-

Not all application programs will run properly in a low-integrity process. A low integrity process does not have write access to most areas under the user’s local profile area of the file system or the registry under HKCU. The inability for a low-integrity process to get write access to the user profile is a good thing if the program is unwanted malicious software. But for applications like Protected Mode Internet Explorer, some redesign may be necessary to get all features of the application behaving correctly.

I guess it depends on how exactly the application needs to influence user space that determines whether or not it can run at Low IL. I think this is why it is necessary to apply Low IL to Firefox' user directories to properly run it at Low IL, so that the browser's Low IL processes can write to the Low IL user space, although I'm not entirely sure this is how it works.

wat0114
Advanced Member
Advanced Member

Posts : 152
Join date : 2010-05-11

View user profile

Back to top Go down

Re: Chrome taking it to the next level

Post by Sponsored content


Sponsored content


Back to top Go down

View previous topic View next topic Back to top

- Similar topics

 
Permissions in this forum:
You cannot reply to topics in this forum