sandboxes: no thy limit

on YouTube ↗58m

" summary

Windows application sandboxes (examining Sandboxie, Adobe ReaderX and Chrome) have architectural limits: kernel bugs let sandboxed renderers escalate to SYSTEM via font parsing exploits and a user‑mode CSRSS flaw lets a low‑integrity process inject keystrokes and files into the host. Live demos include a kernel exploit that migrates to wininit and a CSRSS exploit that performs remote keystroke injection and uploads files. Chrome requires more chaining so type A sandboxes break far easier.

AI-written summary · about

" chapters (26)

1. 0:00Introduction
2. 1:17Agenda
3. 1:52What is a sandbox
4. 2:42Types of sandbox
5. 4:26OS internals
6. 5:39Type A Sandbox
7. 8:08Type B Sandbox
8. 9:13Master vs Slave
9. 10:54Object Integrity Levels
10. 12:50Resistance to malicious slaves
11. 14:06Adobe Reader
12. 15:33Chrome
13. 16:15Chrome Browser
14. 16:48Pinkie Pie
15. 17:56syscall filter
16. 20:59how it works
17. 22:19exploit
18. 25:26serious problem
19. 27:00user mode exploits
20. 28:32LPC ports
21. 29:08Adobe Reader vs Chrome
22. 29:44PDF brute force
23. 30:46CS RSS vulnerability
24. 32:07CS RSS exploit
25. 41:08Defense indepth
26. 52:03Conclusion

" related talks

• 41mThinking Outside the Sandbox - Violating Trust Boundaries in Uncommon WaysBrian Gorenc, Jasiel Spelman · Black Hat USA 2014
• 45mThe Windows Sandbox ParadoxJames Forshaw · nullcon Goa 2019
• 43mThe Most Secure Browser? Pwning Chrome from 2016 to 2019Zhen Feng, Gengming Liu · Black Hat USA 2019
• 40mDigging for IE11 Sandbox Escapes Part 2James Forshaw · Black Hat USA 2014
• 57mDigging for IE11 Sandbox Escapes Part 1James Forshaw · Black Hat USA 2014
• 01h 25mSandboxing a Linux ApplicationMartin Ertsås · ACCU 2022
• 49mChrome Browser Exploitation: from zero to heap sandbox escapeMatteo Malvica · NDC Security 2025
• 50mLinux Security and How Web Browser Sandboxes Really WorkPatricia Aas · NDC Oslo 2017