Microsoft tests Windows Defender AV version in sandbox – Security – Software

Microsoft is currently testing an enhanced security feature of its integrated anti-malware utility for Windows 10, Defender, which will see the program run in isolation from the rest of the operating system.

Traditionally, anti-malware programs must operate with elevated privileges to reach and scan all parts of a computer and its operating system for malicious code.

However, this full system access position often means that anti-malware programs themselves become targets of attack, said Mady Marinescu and Erica Avena of the Windows Defender technical team.

"Security experts working inside and outside Microsoft have already identified ways that an attacker can take advantage of the vulnerabilities of Windows Defender Antivirus content scanners that could allow the attacker to access the Internet." "arbitrary code execution," said the pair.

Sandboxing is a technique that protects other parts of the computer system in case of compromise of a program.

Although sandboxing was desirable for high-value targets such as Windows Defender, its implementation was a technical challenge for Microsoft, as process isolation could result in performance degradation.

Microsoft claims to have achieved sandboxing by overlaying antivirus inspection processes into processes that must absolutely work with full system privileges and others that can be isolated, with minimal interaction between them.

This effort was praised by Tavis Ormandy, Google Project Zero's security researcher, who on social media m said it was "amazing" and "game changing".

Ormandy once discovered vulnerabilities in Windows Defender, including a bug last year that allowed the execution of arbitrary code remotely via the x86 emulation layer of the anti-malware program.

Participants in the Microsoft Windows Insider early adopter program will be the first to test sandboxing for the anti-malware tool.

Users of Windows 10, version 1703 or later can also use the command setx / M MP_FORCE_USE_SANDBOX 1 which will allow sandboxing after rebooting their computers.