Microsoft Creates Sandbox for Windows Defender
Eduard Kovacs | October 29, 2018
Microsoft announced on Friday that Windows Defender, the antivirus application shipped with the company’s operating systems, can now run in a sandbox, and the tech giant claims it’s the first product of its kind to have this capability. Microsoft has admitted that both its own employees and external researchers have identified vulnerabilities in Windows Defender, and given that it’s a program that runs with high privileges it can be an attractive target for malicious actors. By allowing Windows Defender to run in a sandbox, Microsoft aims to increase the application’s resistance to attacks, particularly on the latest version of Windows 10, which includes significant protections and on which privilege escalation from a sandbox should be much more difficult. Running the antivirus application in a sandbox should ensure that if it becomes compromised, the attacker’s actions are restricted and the rest of the system remains protected. “Putting Windows Defender Antivirus in a restrictive process execution environment is a direct result of feedback that we received from the security industry and the research community,” Microsoft said in a blog post. “It was a complex undertaking: we had to carefully study the implications of such an enhancement on performance and functionality. More importantly, we had to identify high-risk areas and make sure that sandboxing did not adversely affect the level of security we have been providing.” In order to build a sandbox for Windows Defender, Microsoft said it had to overcome several challenges.