Advanced Desktop Application Sandboxing via AppContainer

[hjlbx]

Little-known feature of Windows 8, 8.1 and 10.

Advanced Application Sandboxing via AppContainer

Whether or not a security soft makes use of this Windows feature is not clear - since it is not openly discussed by security soft vendors.

 

[SHvFl]

Doesn't experimental feature of Chrome has that? Pretty sure it's the same thing. Issue is when you enable it no hooking of any program like an antivirus is possible.
Chrome & AppContainer Tweak

 

[hjlbx]

Doesn't experimental feature of Chrome has that? Pretty sure it's the same thing. Issue is when you enable it no hooking of any program like an antivirus is possible.
Chrome & AppContainer Tweak

To be honest I am not sure.

There is AppContainer and then also Windows Integrity Mechanism.

I do not know if Windows Integrity Mechanism can be used to apply restriction to app executed within AppContainer.

 

[Deleted member 178]

Chrome's sandbox and Windows' sandbox use similar approach;. they profit from the Windows' Integrity mechanism created since Windows Vista. Chrome does it only for webpages and plugins.

AppContainer is another level of integrity introduced in Win8.

Each process has given a Token (containing its informations , integrity level, privileges)

AppContainer differs lightly with those integrity levels in the way that it implements the "Lowbox" token, which assign "capabilities" to the app ; capabilities are areas (internet access, picture/music/etc.. libraries, webcam, microphone, removable storage, etc...) the app may access or not (decided by its dev).

In Win8-10 , a broker check the original token of the process, and if possible, transform it to the Lowbox token.

 

[jamescv7]

AppContainer is one of the subsidiary component for Sandbox and literally they act same to each other; however they operate in such different angle and not so much observe by users much.

Hence it reduce the possible vulnerability risks from the long run.

 

[Deleted member 178]

more infos there :

Research, Develop, Assess, Consult & Educate | Recx: Windows 8 App Container Security Notes - Part 1