McKey – Grey Panthers Savannah

The IE7 team replies – sort of

gpanther — Mon, 23 Oct 2006 12:45:00 +0000

As you might remember Martin McKey very generously offered his readers the chance to post questions which he will ask at the IE7 release party. Well, he went he asked and as I’ve predicted he got a canned response. I felt that this was partially he didn’t insist on it – and I can’t blame him because they had a lot of questions to ask and after all it wasn’t his question – and probably partially because I didn’t phrase the question clear enough (English not being my native language). Actually I suspect that event if he would have insisted he would have got some generic response. So here my question again and I challenge any IE7 technical team member to give me a technical reason (like we couldn’t do X with the current set of APIs) for not implementing the containment wall technology in pre-Vista Windows versions. As I understand it this technology is basically separating IE in multiple processes with each process a specific task (like rendering the page, talking to the net, etc) and each process drops the rights it doesn’t need, meaning that if you find a bug in the rendering code for example, you can’t exploit it in any meaningful because when you execute code in the context of the rendering process, you have almost zero privileges. If this is truly what this technology does, this is entirely possible with current versions of Windows, and I see no reason other than marketing for this move. (Actually I’m not deluding myself into thinking that anybody or anybody from Microsoft for that matter reads my blog, but it’s nice to let some steam out ).

Listen to the whole podcast

Picking the brain of the IE7 team

gpanther — Fri, 13 Oct 2006 11:46:00 +0000

Martin McKey over of at the Network Security Blog is going to meet the IE7 team and is waiting for proposals regarding the questions he should ask them. Here is mine:

First let me give a little background as I see it so that if they choose to answer my question (no offense, but if it is as I suspect, they are limited in their freedom of speech regarding this areas by NDAs and such) they can do so in the correct context. One of the biggest security advantages of IE7 is the so called containment wall, which if I understand correctly uses the x86/x64 architecture and the Windows NT security system to separate in different processes the different tasks the browser has, so that a lower privilege task can’t corrupt the memory of a higher privileged task. I think that this is a very robust solution which should reduce the attack surface considerably and I also can appreciate the work that most have gone into slicing up the application in parts. Now my question would be: is there any real technical reason for which this won’t be available under non-Vista versions of Windows? If possible name at least one API which this feature needs that is not available under non-Vista Windowses.. Because all of the mentioned techniques are available on all version of Windows from Win2K onwards (as for example the DropMyRigths tool written by Michael Howard demonstrates). I’m very curious if and what they’ll respond, but I have several possible scenarios in my mind: (a) I’ve misunderstood the feature and it’s really more or different from what I’ve described (moderately possible) (b) This is a marketing move which incorrectly puts revenue generating in front of security (this is my personal opinion, but I don’t think they will admit to it) or (c) my question won’t be asked at all.

I have a career, not a job – a very true post

gpanther — Thu, 12 Oct 2006 20:10:00 +0000

The Network Security Blog / Network Security podcast is one of my sources of information. Today I’ve found this very true post there.