Micro-virtualization

Discussion in 'sandboxing & virtualization' started by MrBrian, May 1, 2014.

Thread Status:
Not open for further replies.
  1. MrBrian

    MrBrian Registered Member

    Joined:
    Feb 24, 2008
    Posts:
    6,032
    Location:
    USA
    Last edited: May 1, 2014
  2. MrBrian

    MrBrian Registered Member

    Joined:
    Feb 24, 2008
    Posts:
    6,032
    Location:
    USA
  3. Rasheed187

    Rasheed187 Registered Member

    Joined:
    Jul 10, 2004
    Posts:
    8,036
    Location:
    The Netherlands
    Great thread, there´s a lot of interesting articles on their blog. :)

    I thought this was kinda funny:

    http://anti-virus-rants.blogspot.com/2013/05/more-on-bromium-and-snake-oil.html

    However, I must say that I still can´t completely wrap my head around Bromium´s concept. If it´s really that awesome, why hasn´t M$ come up with something similar to protect the OS? Is it perhaps because of the overhead? It also makes me wonder: is it perhaps possible to use Intel VT (Micro-virtualization) in Application Sandboxes, like Sandboxie for example?
     
  4. MrBrian

    MrBrian Registered Member

    Joined:
    Feb 24, 2008
    Posts:
    6,032
    Location:
    USA
    @Rasheed187: I believe that it's policy-based, so appropriate policies need to be supplied/created for each "task."
     
  5. Rasheed187

    Rasheed187 Registered Member

    Joined:
    Jul 10, 2004
    Posts:
    8,036
    Location:
    The Netherlands
    Now that I think of it, it´s a bit of the same as the Qubes OS, but it´s implemented as a HIPS instead of a whole new OS. Every app (and even every task) is running in its own sandbox. I must say that it sounds like overkill, so I would really like to see a demonstration of Bromium´s tech.

    Also, like I said before, I wonder if Intel VT could be used by a tool like Sandboxie (or Invincea FreeSpace). So instead of them relying on a regular driver, they could rely on the hypervisor. I wonder if that´s technically possible. :)
     
  6. Windows_Security

    Windows_Security Registered Member

    Joined:
    Mar 2, 2013
    Posts:
    3,081
    Location:
    Netherlands
    Chrome also uses micro virtualisation when your CPU facilitates it on Windows, On Chrome OS and Chrome versions for linux it is even developed further.
     
  7. Rasheed187

    Rasheed187 Registered Member

    Joined:
    Jul 10, 2004
    Posts:
    8,036
    Location:
    The Netherlands
    Last edited: May 4, 2014
  8. Gullible Jones

    Gullible Jones Registered Member

    Joined:
    May 16, 2013
    Posts:
    1,461
    I don't know about on Windows, but on Linux Chrome uses an empty chroot, PID namespace, and seccomp filters - basically a policy sandbox for restricting interaction with the kernel. It doesn't actually duplicate any kernel resources AFAIK.

    That said, the empty chroot jail alone should be pretty effective. Breaking out a chroot is much harder when you don't have any external userspace code to do it with.
     
  9. Windows_Security

    Windows_Security Registered Member

    Joined:
    Mar 2, 2013
    Posts:
    3,081
    Location:
    Netherlands
  10. Rasheed187

    Rasheed187 Registered Member

    Joined:
    Jul 10, 2004
    Posts:
    8,036
    Location:
    The Netherlands
    Can you give a bit more info about this?
     
  11. Windows_Security

    Windows_Security Registered Member

    Joined:
    Mar 2, 2013
    Posts:
    3,081
    Location:
    Netherlands
    Native Client uses a processor specific feature called segmentation
     
  12. Rasheed187

    Rasheed187 Registered Member

    Joined:
    Jul 10, 2004
    Posts:
    8,036
    Location:
    The Netherlands
  13. MrBrian

    MrBrian Registered Member

    Joined:
    Feb 24, 2008
    Posts:
    6,032
    Location:
    USA
    See
    Code:
    (direct download) hxxp://www.invincea.com/wp-content/uploads/2014/05/Invincea_tech_throwdown_microvirtualization_050614.pdf
    Edit: I now see that you already found this link in another thread.
     
    Last edited: May 15, 2014
Loading...
Thread Status:
Not open for further replies.