Low Integrity Code Generation - Revision history

Tom: /* VS Code */

2023-03-20T23:40:29Z

‎VS Code

Tom: /* Mandatory Integrity Control (MIC) */

2023-03-13T04:52:59Z

‎Mandatory Integrity Control (MIC)

Tom: /* Mandatory Integrity Control (MIC) */

2023-03-13T02:26:15Z

‎Mandatory Integrity Control (MIC)

Tom: /* Problems */

2023-03-13T02:20:42Z

‎Problems

Tom: /* Problems */

2023-03-13T02:14:17Z

‎Problems

Tom: /* Mandatory Integrity Control (MIC) */

2023-03-13T02:12:20Z

‎Mandatory Integrity Control (MIC)

Tom: /* Problems */

2023-03-13T00:57:04Z

‎Problems

Tom: /* Problems */

2023-03-13T00:55:35Z

‎Problems

Tom: /* Problems */

2023-03-13T00:54:49Z

‎Problems

Tom: /* Mandatory Integrity Control (MIC) */

2023-03-13T00:22:02Z

‎Mandatory Integrity Control (MIC)

@@ Line 66: / Line 66: @@
 Process:
 # Open https://vscode.dev/
-# Create or Select a folder and give permission (subtle - the permission dialog is not clear on what happens here)
+# Create or Select a folder and give permission (subtle - the permission dialog is not clear on what happens here - it is clear that the grant survives until all tabs closed.)
+#
+#

@@ Line 28: / Line 28: @@
 Every token is tied to a logon session. Any time a user logs in, a new token is generated and then applied to any process that user spawns during its logon lifecycle. When a local administrator logs in, two separate logon sessions are created: one for the unelevated token (medium integrity level) and one with the elevated token (high integrity level). These logon sessions are bound to one another and are referred to as a “split token".<ref>Jonathan Johnson ''Better know a data source: Process integrity levels'' https://jsecurity101.medium.com/better-know-a-data-source-process-integrity-levels-8338f3b74990</ref>
-Low Integrity is similar to "[[Mark of the Web]]" as it is only applied to files of unknown origin, mostly from the web.<ref>Outflank, ''Mark-of-the-Web from a red team’s perspective'' (2020-03-30) https://outflank.nl/blog/2020/03/30/mark-of-the-web-from-a-red-teams-perspective/</ref> The "[[Mark of the Web]]" is added as an alternate data stream in NTFS.
+Low Integrity is similar to "[[Mark of the Web]]" as it is only applied to files of unknown origin, mostly from the web.<ref>Outflank, ''Mark-of-the-Web from a red team’s perspective'' (2020-03-30) https://outflank.nl/blog/2020/03/30/mark-of-the-web-from-a-red-teams-perspective/</ref> The "[[Mark of the Web]]" is added as an alternate data stream in NTFS. That means that the [[Mark of the Web]] is lost if the file is copied outside of NTFS.
 The history of MIC is from the Biba Model, a formal state transition system of data security policies designed to express a set of access control rules in order to ensure data integrity. Data and subjects are ordered by their levels of integrity into groups or arrangements. Biba is designed so that a subject cannot corrupt data in a level ranked higher than the subject's and to restrict corruption of data at a lower level than the subject's. The Biba model was created to thwart a weakness in the Bell-LaPadula Model. The Bell-LaPadula model only addresses data confidentiality (Mandatory Access Control) and not integrity control.

@@ Line 28: / Line 28: @@
 Every token is tied to a logon session. Any time a user logs in, a new token is generated and then applied to any process that user spawns during its logon lifecycle. When a local administrator logs in, two separate logon sessions are created: one for the unelevated token (medium integrity level) and one with the elevated token (high integrity level). These logon sessions are bound to one another and are referred to as a “split token".<ref>Jonathan Johnson ''Better know a data source: Process integrity levels'' https://jsecurity101.medium.com/better-know-a-data-source-process-integrity-levels-8338f3b74990</ref>
-Low Integrity is similar to "[[Mark of the Web]]" as it is only applied to files of unknown origin, mostly from the web.<ref>Outflank, ''Mark-of-the-Web from a red team’s perspective'' (2020-03-30) https://outflank.nl/blog/2020/03/30/mark-of-the-web-from-a-red-teams-perspective/</ref>
+Low Integrity is similar to "[[Mark of the Web]]" as it is only applied to files of unknown origin, mostly from the web.<ref>Outflank, ''Mark-of-the-Web from a red team’s perspective'' (2020-03-30) https://outflank.nl/blog/2020/03/30/mark-of-the-web-from-a-red-teams-perspective/</ref> The "[[Mark of the Web]]" is added as an alternate data stream in NTFS.
 The history of MIC is from the Biba Model, a formal state transition system of data security policies designed to express a set of access control rules in order to ensure data integrity. Data and subjects are ordered by their levels of integrity into groups or arrangements. Biba is designed so that a subject cannot corrupt data in a level ranked higher than the subject's and to restrict corruption of data at a lower level than the subject's. The Biba model was created to thwart a weakness in the Bell-LaPadula Model. The Bell-LaPadula model only addresses data confidentiality (Mandatory Access Control) and not integrity control.

@@ Line 54: / Line 54: @@
 Microsoft Internet Explorer could run with low integrity in protected mode starting with Windows Vista.
-Microsoft Edge is based upon Chromium.  [https://techcommunity.microsoft.com/t5/enterprise/mandatory-integrity-control-with-microsoft-edge/m-p/3501127 Eric Lawrence, MFST] 2022-06-15
+Microsoft Edge is based upon Chromium.  [https://techcommunity.microsoft.com/t5/enterprise/mandatory-integrity-control-with-microsoft-edge/m-p/3501127 Eric Lawrence, MFST] 2022-06-15 Chromium (and thus Edge) uses a multi-process model where each process has a particular job (processing HTML/JavaScript, drawing on the screen, the top-level-browser, etc). This improves both security and reliability. Beyond simply running code in a different processes, security is improved by sandboxing each process as much as we can; this will discard capabilities that a process should not need for its job, and help ensure that if an attacker were able to build an exploit against the sandboxed code, that exploit would be stuck inside a sandbox/jail it cannot escape. Setting restricted Windows Integrity Levels is only one mechanism the sandboxing code uses to protect the system-- various other lock-downs are applied as well. You can learn more about the design of the Chromium sandboxes here: https://chromium.googlesource.com/chromium/src/+/lkgr/docs/design/sandbox.md
 Any [[Web App]] that deals with low-integrity data should not be allowed to impact high-integrity functionality. The example used here is VSCode, a Microsoft code generation application, but any [[Web App]] that transitions low-integrity input to high-integrity output would have the same issues.

@@ Line 58: / Line 58: @@
 Chromium (and thus Edge) uses a multi-process model where each process has a particular job (processing HTML/JavaScript, drawing on the screen, the top-level-browser, etc). This improves both security and reliability.
-Beyond simply running code in a different processes, however, we can improve security by sandboxing each process as much as we can; this will discard capabilities that a process should not need for its job, and help ensure that if an attacker were able to build an exploit against the sandboxed code, that exploit would be stuck inside a sandbox/jail it cannot escape.
+Beyond simply running code in a different processes, security is improved by sandboxing each process as much as we can; this will discard capabilities that a process should not need for its job, and help ensure that if an attacker were able to build an exploit against the sandboxed code, that exploit would be stuck inside a sandbox/jail it cannot escape.
-Setting restricted Windows Integrity Levels is only one mechanism the sandboxing code uses to protect the system-- various other lockdowns are applied as well. You can learn more about the design of the Chromium sandboxes here: https://chromium.googlesource.com/chromium/src/+/lkgr/docs/design/sandbox.md
+Setting restricted Windows Integrity Levels is only one mechanism the sandboxing code uses to protect the system-- various other lock-downs are applied as well. You can learn more about the design of the Chromium sandboxes here: https://chromium.googlesource.com/chromium/src/+/lkgr/docs/design/sandbox.md
 Any [[Web App]] that deals with low-integrity data should not be allowed to impact high-integrity functionality. The example used here is VSCode, a Microsoft code generation application, but any [[Web App]] that transitions low-integrity input to high-integrity output would have the same issues.

@@ Line 35: / Line 35: @@
 | Windows SID || Level Name || Description
 |-
-|S-1-16-0 || Untrusted || Anonymous process,, write access is mostly blocked - Seen with Browser
+|S-1-16-0 || Untrusted || Anonymous process, write access is mostly blocked - chromium Render
 |-
-|S-1-16-4096 ||Low || App Containers, Bowsers prevent most write access
+|S-1-16-4096 ||Low || App Containers, Browsers prevent most write access
 |-
 |S-1-16-8192 || Medium|| authenticated user (Normal in UAC)

@@ Line 52: / Line 52: @@
 ==Problems==
-Microsoft Internet Explorer could run with low ingtegrity in protected mode.
+Microsoft Internet Explorer could run with low integrity in protected mode starting with Windows Vista.
 Microsoft Edge is based upon Chromium.  [https://techcommunity.microsoft.com/t5/enterprise/mandatory-integrity-control-with-microsoft-edge/m-p/3501127 Eric Lawrence, MFST] 2022-06-15

← Older revision		Revision as of 00:55, 13 March 2023
Line 61:		Line 61:

	Setting restricted Windows Integrity Levels is only one mechanism the sandboxing code uses to protect the system-- various other lockdowns are applied as well. You can learn more about the design of the Chromium sandboxes here: https://chromium.googlesource.com/chromium/src/+/lkgr/docs/design/sandbox.md		Setting restricted Windows Integrity Levels is only one mechanism the sandboxing code uses to protect the system-- various other lockdowns are applied as well. You can learn more about the design of the Chromium sandboxes here: https://chromium.googlesource.com/chromium/src/+/lkgr/docs/design/sandbox.md
		+
	Any [[Web App]] that deals with low-integrity data should not be allowed to impact high-integrity functionality. The example used here is VSCode, a Microsoft code generation application, but any [[Web App]] that transitions low-integrity input to high-integrity output would have the same issues.		Any [[Web App]] that deals with low-integrity data should not be allowed to impact high-integrity functionality. The example used here is VSCode, a Microsoft code generation application, but any [[Web App]] that transitions low-integrity input to high-integrity output would have the same issues.

← Older revision		Revision as of 00:54, 13 March 2023
Line 51:		Line 51:

	==Problems==		==Problems==
		+
		+	Microsoft Internet Explorer could run with low ingtegrity in protected mode.
		+
		+	Microsoft Edge is based upon Chromium. [https://techcommunity.microsoft.com/t5/enterprise/mandatory-integrity-control-with-microsoft-edge/m-p/3501127 Eric Lawrence, MFST] 2022-06-15
		+
		+	Chromium (and thus Edge) uses a multi-process model where each process has a particular job (processing HTML/JavaScript, drawing on the screen, the top-level-browser, etc). This improves both security and reliability.
		+
		+	Beyond simply running code in a different processes, however, we can improve security by sandboxing each process as much as we can; this will discard capabilities that a process should not need for its job, and help ensure that if an attacker were able to build an exploit against the sandboxed code, that exploit would be stuck inside a sandbox/jail it cannot escape.
		+
		+	Setting restricted Windows Integrity Levels is only one mechanism the sandboxing code uses to protect the system-- various other lockdowns are applied as well. You can learn more about the design of the Chromium sandboxes here: https://chromium.googlesource.com/chromium/src/+/lkgr/docs/design/sandbox.md
	Any [[Web App]] that deals with low-integrity data should not be allowed to impact high-integrity functionality. The example used here is VSCode, a Microsoft code generation application, but any [[Web App]] that transitions low-integrity input to high-integrity output would have the same issues.		Any [[Web App]] that deals with low-integrity data should not be allowed to impact high-integrity functionality. The example used here is VSCode, a Microsoft code generation application, but any [[Web App]] that transitions low-integrity input to high-integrity output would have the same issues.