Sandboxes: Understanding and Exploiting Application Security Limitations
Explore the vulnerabilities and attack surfaces of application sandboxes in this 58-minute OWASP Foundation conference talk. Delve into the decomposition of popular sandboxes like Google Chrome, Adobe ReaderX, and Sandboxie from a pen-tester's perspective. Examine the limitations and implementation details of various sandbox technologies, and witness live demonstrations of sandbox breakout techniques using kernel and user mode exploits. Gain insights into potential malware strategies and lesser-known exploit vectors. Cover topics including sandbox types, OS internals, object integrity levels, syscall filters, user mode exploits, LPC ports, and defense-in-depth strategies. Enhance your understanding of application security and the importance of robust sandbox implementations in thwarting potential attacks.