Sandboxing is a popular modern technique used by vendors to minimize the damages that attackers might inflict on a compromised system by restricting the application’s trust boundaries. Sandboxing raises the bar for exploitation because the compromised application is now “contained”, and typically need at least another vulnerability to escape the sandbox container to achieve the same level of system compromise. As a testament of its effectiveness, popular applications that have adopted sandboxing technique include Chrome, Internet Explorer, Firefox and Adobe Reader.
The Microsoft Office is no exception; its sandbox is implemented as the Protected-View feature since Office 2010. At present, there are many excellent sandbox researches for Chrome, Internet Explorer Enhanced Protected Mode and Adobe Reader. However there is no similar research for the Microsoft Office Protected-View sandbox yet. This talk aims to bridge this gap.
With the inclusion of Micrsoft Office applications in Pwn2Own 2017, the time is ripe for an update to a previous talk “Understanding the Microsoft Office 2013 Protected-View Sandbox”. This talk will review the Protected-View sandbox internals and Inter-Process Communication (IPC) mechanism in Office 2016, and also highlight attack vectors to the Protected-View.
