2

The idea of having a fast, disposable VM at the palm of my hand appeals to me very much. It makes adding an extra layer of security to any thing I want to do so easy - just launch the sandbox application in a matter of seconds and you're done. Of course, that is considering the VM actually does the job it's supposed to do...

A little disclaimer beforehand - I've read the article Beware the perils of Windows Sandbox at Magnitude8, describing how the Windows Sandbox comes with a NAT pre-enabled and thus any malware running on the guest would still get a direct access to your intranet, which is already a large problem. But for the purpose of this question, let us just consider the host-guest scenarios.

Windows Sandbox claims to "achieve a combination of security, density, and performance that isn't available in traditional VMs", by leveraging a different approach to memory and disk management. If I understand things correctly, everything that in theory can be safely shared between the host and the guest, gets shared. According to the official documentation, the Sandbox shares both the host's immutable system files, as well as the physical memory pages.

Despite that, Microsoft seems to remain confident that their solution is secure as implied by one of bullet points mentioned in the Sandbox overview:

Secure: Uses hardware-based virtualization for kernel isolation. It relies on the Microsoft hypervisor to run a separate kernel that isolates Windows Sandbox from the host.

This obviously raises a lot of questions, because at the first glance, all this resource sharing should increase the attack surface greatly, leaving more space for exploits to be found. Also, even the most sophisticated technology, which changes only the implementation and not the design, does ultimately make the discovery of an exploit only more time and resource consuming, but not less possible, doesn't it?

So, my question is

Would you consider Windows Sandbox to be a viable alternative to conventional VM solutions in terms of security, or do the shortcuts used to achieve the performance undermine the VM's core principles too much? Or am I just not understanding the technology and all of what the Sandbox is doing is technically safe?

An extra question: Does the situation change when we're talking about a web-based attack, such as opening a malicious site in a browser from within the Sandbox, or does it come down to the same situation as running an infected executable? (disregarding the extra layer of sandboxing done in the browser itself)

1
  • 1
    i request you to keep the question short and precise to the point next time. Jun 1 '20 at 10:47
0

Would you consider Windows Sandbox to be a viable alternative to conventional VM solutions in terms of security

Because sandbox serves different purpose than virtual machines, sandbox can not replace virtual machines. One simple difference can be all the changes done are lost in window's sandbox once the machine is done with. Virtual machine generally encompasses the features of sandbox and more.

or do the shortcuts used to achieve the performance undermine the VM's core principles too much?

The Window's sandbox also uses hypervisor tech so essentially it seems not very different in implementation than other hypervisors out there, only key difference is the operation on virtual machine(window's sandbox here) are lost after it is shutdown.

Does the situation change when we're talking about a web-based attack, such as opening a malicious site in a browser from within the Sandbox, or does it come down to the same situation as running an infected executable? (disregarding the extra layer of sandboxing done in the browser itself)

It may help with certain situations but not all attacks are same, Question is very wide to answer.

One typical situation assumed is when you have a session running and site is vulnerable to XSS, in such scenario sandbox has no role to play.

1
  • 2
    While a sandbox differs from a VM, the Windows Sandbox is a VM, as mentioned in this article: "At its core Windows Sandbox is a lightweight virtual machine...". However, unlike conventional VMs, the Sandbox takes quite a few shortcuts to reduce the memory and disk requirements and increase the performance. My question was about how much those shortcuts affect the security of the Sandbox, compared to the conventional VMs. Jun 1 '20 at 12:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.