Microsoft Creates Sandbox for Windows Defender
29.10.2019 securityweek Safety

Microsoft announced on Friday that Windows Defender, the antivirus application shipped with the company’s operating systems, can now run in a sandbox, and the tech giant claims it’s the first product of its kind to have this capability.

Microsoft has admitted that both its own employees and external researchers have identified vulnerabilities in Windows Defender, and given that it’s a program that runs with high privileges it can be an attractive target for malicious actors.

By allowing Windows Defender to run in a sandbox, Microsoft aims to increase the application’s resistance to attacks, particularly on the latest version of Windows 10, which includes significant protections and on which privilege escalation from a sandbox should be much more difficult.

Running the antivirus application in a sandbox should ensure that if it becomes compromised, the attacker’s actions are restricted and the rest of the system remains protected.

“Putting Windows Defender Antivirus in a restrictive process execution environment is a direct result of feedback that we received from the security industry and the research community,” Microsoft said in a blog post. “It was a complex undertaking: we had to carefully study the implications of such an enhancement on performance and functionality. More importantly, we had to identify high-risk areas and make sure that sandboxing did not adversely affect the level of security we have been providing.”

In order to build a sandbox for Windows Defender, Microsoft said it had to overcome several challenges.

The company has created two layers: one for components that can be sandbox and one for components that require full privileges on the system. In order to avoid a negative impact on performance, interaction between these layers needs to be minimal and it needs to take place at key moments.

Microsoft also had to figure out a way to reduce the usage of resources while ensuring that the level of security provided by Windows Defender is not decreased.

The sandboxing feature will be rolled out gradually to insiders running Windows 10 version 1703 or later. Users can also manually enable it by setting a certain environment variable (setx /M MP_FORCE_USE_SANDBOX 1).

The company is encouraging members of the community to test out the new sandboxed Windows Defender and provide feedback. Microsoft says it’s already working on additional anti-tampering mechanisms for Windows Defender.