A company called Trustware, who has recently been nominated one of the 10 hot start-ups of 2006 by Microsoft, developed an application-level virtualization tool for Windows. This app, called BufferZone, promises to fight malware virtualizing I/O operations, so that the OS and user’s data will be safe. Another cool advantage of this technology is that it doesn’t require any user interaction. SecurityFocus published an interview with Eyal Dotan, creator of the tool, where he discusses the architecture, advantages of this design, performance, and how this method could be applied to servers running Windows or be ported to other OSs.
Application-Level Virtualization for Windows
About The Author
Follow me on Twitter @thomholwerda
2006-07-18 12:56 ameMagius
Please read the linked interview. BufferZone does much more than *nix jails.
2006-07-18 2:33 amsolid_liq
Ok, I retract my earlier statement. It does do more than chroot jails. I suspect this would be much easier to implement on Linux than it was on Windows, though. With Linux, you don’t need to worry about virtualizing a registry, and you have full access to the kernel source code. In fact, this could probably mostly be implemented in Linux with FUSE (Filesystem in Userspace). Some of it would still have to be implemented with kernel modules (preventing access to loading kernel modules, etc). Overall, I think it’s a really good idea. I have now put a link to this article on my personal homepage.
There is a very simple solution to security already used in Intel CPUs: ring security.
The same security mechanism could be applied to applications: each application runs within a ring. If an application’s ring value is raised, the application could not touch resources belonging in a lower ring.
Applications that are ‘dangerous’ could run on a higher ring than the normal, thus not allowed to touch anything, even the current user’s data.
2006-07-18 9:56 pmWes Felter
Usually this is called multi-level security (MLS). The military loves it, but I suspect it’s not well suited to desktop environments.
2006-07-18 10:18 pmeMagius
The primary benefit that BufferZone (et al) offer over this approach is that applications running in the secure zone do not need to be modified. They can still read and even write to the registry, for example, but the changes they make are visible only to them.
In some ways this is analagous to technologies like DeepFreeze, except that BZ allows for per-application settings and does not rely on rebooting.
Interesting that MS would throw them a bone in light of their recent announcement to buy Softricity.
Even more interesting is that at the recent SMS conference, during the keynote, they mocked the I/O filter driver method in an attempt to bolster their Softricity story. The even bigger irony there is that Altiris’ Software Virtualization Solution (SVS) won best product at the show.
SVS is also free for personal use. Check this page out, particularly the quite level-headed debate about SVS vs. Softricity.
Personally, I love SVS. If someone hasn’t tried a product like SVS or BufferZone – they absolutely need to kick the tires. It doesn’t sound like much at first, but one you use it you wonder how you lived without it!
Looking at the info on both Bufferzone and SVS mentioned by Pedantic I wonder if using the free Sandboxie http://sandboxie.com/ will be just as good a protection against malware as these commercial offerings.
I’ve been using it for a while now, also tested it on a virtual pc, surfing shady sites and running other programs in it, and it kept Windows clean.
Which are the other 9 hot startups of 2006?
Isn’t this a Windows version of chroot jails in *nix? Why would I want to port it to *nix when *nix already has an old tried and true solution?