8

How would applying hypervisor (e.g. xen) principles in the development of a web browser offering isolated browser tabs (virtual machines) improve or reduce security of existing web applications (good or badly coded).

A web app in this context would be a tab, with a cross origin policy using a whitelist approach and jailing the tab (unix jails), in a parent window jail which is a writable copy of the core browser. The actual browser itself could be read only and implement a signature check on boot.

Cross origin policy would simply be a manifest file which whitelists allowed resources such as images, javascript, css, fonts etc.

The concept would be to share nothing and closing the browser window would total remove any traces. All tmp files are stored in the jail. This should protect against vulnerabilities in the browser implementation being exploited after a window/tab close.

Theoretically this concept could be expanded to allow for window addons/plugins for things like Tor, making anonominity and privacy available to mainstream users.

2 Answers 2

5

Web browsers already try to isolate tabs from each other. Chrome pioneered the principle of "one process per tab" and other browsers followed. This kind of isolation was meant for reliability more than security: when one tab crashes, e.g. because of a bug in a plugin, prevent the whole browser process from dying as well.

Using VM techniques, be they Unix-level jails or even full-blown hypervisors, can help in the case of a tab being subverted: through some security hole, an attacker manages to run his own malicious code in your browser. The VM will then try to contain that attack. Note that the problem has far-reaching consequences: for instance, a Web browser must be able to read local files, in order to support Web sites which ask for upload of a local file. When complete isolation is enforced, functionality is decreased.

If you want complete isolation, see Qubes OS: this is a Linux-based operating system which launches small VM for individual applications (or group of applications) and would allow you to run several browser instances which cannot see each other.

The problem, though, is that you usually don't want complete isolation, and hostile full-process hijacking is rare. Browsers already apply some sort of isolation which does not use hypervisors, but is (usually) effective. Security issues don't come from the breaking out of a tab process, but from the communication channels which are maintained between tabs by the browser in order to implement required functionality. The Same-Origin Policy is an important concept which is part of the issue: the SOP incarnates the security model which the browser enforces, and most security issues with Web browsers are due to the fuzziness with which the SOP boundaries are defined.

To make an analogy, consider a brick wall with a door in it. Using hypervisor technology would be akin to reinforcing the wall and the door frame with steel. This is not bad, but won't help very much if the real problem is that the door is not locked. When trying to enforce isolation between browsing instances, the really hard thing is to define precisely what may be shared and what should not; hypervisors operate at a lower level and are just tools to enforce a policy, but the policy must first be defined.

2
  • Furthermore there are already ways to force a browser to be isolated ( Sandboxie for instance ) from the system to some degree.. OS X and Linux have their own ways to implement this behavior also.
    – Ramhound
    Aug 15, 2013 at 15:49
  • 1
    Actually, Internet Explorer 8 came out with process isolation first. Google Chrome came out with it shortly after (probably because they weren't expecting Microsoft to release anything like that). Microsoft was talking about it here: blogs.msdn.com/b/ie/archive/2008/03/11/…. Well before the first version of Google Chrome was released.
    – cmorse
    Aug 21, 2013 at 20:00
1

Credit to @Thomas Pornin & @Ramhound,

Browser based VM's already have a few implementations (Headless browsers). I was unaware at the time of writing the question that Chrome had already taken this leap.

Concept implementations:

Alternative concepts:

Critiques:

  • VM's (e.g. Virtualbox) are especially resilient to attacks as it has a much larger attack surface, and generally doesn't assume malicious guests.
  • ....

Please add to this list in the comments and I will update the answer.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.