IE(8) Virtualization and Passwords
Updated: 29 Jul 2010 | 14 comments
This issue has been solved. See solution.
Passwords entered via an autorun virtualized IE(8) are stored outside the layer on Vista Home Premium SP2. Is this a feature or a flaw?
Though it's not marketed as a security tool, I've been using SWV for sandboxing, and I'm wondering what can break the box.
Tags: Browser, IE, IE8, Internet Explorer, Leak, Leaky, Sandbox, Sandboxes
discussion Filed Under:
Comments
Where the passwords being
Where the passwords being stored? You may have an exclude set up for that location.
If a forum post solves your problem please flag is as the solution
Erm... The usual location.
Erm... The usual location. Sorry, I'm clueless where this is concerned. I haven't changed anything as to passwords, and I'm pretty sure they're not saved in either My Documents or Desktop. Which are my only excludes.
SWV 6.1 is fresh and unaltered, save for the inclusion of Kaspersky Antivirus's kav.exe and Windows Defender's MSASCui.exe to the ProgramIgnoreList.
Since the first post, a program, while being single captured into a new layer, managed to set its publisher's website as IE homepage. (In the base.)
Doesn't sound like you have
Doesn't sound like you have your IE8 properly virtualized, that shouldn't happen, how did you capture it?
If a forum post solves your problem please flag is as the solution
Actually, it isn't just IE8.
Actually, it isn't just IE8. As it turns out, things are leaking all over.
A program, which was single captured into a layer, needed some adjustments that required a re-install. After deleting the layer, and single capturing a fresh install, upon program launch it went straight into the main interface, skipping the standard first-run configuration dialogue. Obviously, the settings got into the base somehow.
Also, a FlexLM folder (which ought to be in a layer) has been persisting (though empty) in C:\ If it's deleted, it'll pop up again eventually. (I have no FlexLM dependent software in the base, so that's not where it's coming from.)
As to IE8, it's running in a layer via iexplore.exe autorun - IE itself is a regular install in the base, not in a layer.
that's strange. I haven't
that's strange. I haven't played around much with these scenarios on a non-XP machine so I want to look at this but won't have time till next week. If I haven't replied by Wensday bump the thread to remind me.
If a forum post solves your problem please flag is as the solution
It would seem
the data mentioned previously - passwords stored by IE8 while it's autorun in a layer - are not somehow copied from the layer as much as they by-pass it completely.
After running IE from the base and deleting the passwords, they will be gone when running IE from its layer.
Don't think it's me.
Did a fresh Vista Home Premium SP2 Install from generic Microsoft OEM disk. Without any additional software installed - same result.
I'd appreciate it if someone could confirm SWV (most recent version 6.1, controlled through Admin) doesn't capture settings, in particular passwords, when IE8 is autorun in a layer on Vista (32bit, Home Premium).
Global Capture - Same Result.
New Layer\Application\Global Capture, started up a fresh, unconfigured IE8, did the first-run configuration wizard, closed IE8, gave it a few seconds to terminate, then closed the Global Capture. Deleted the layer, restarted IE8, no first-run wizard, all configurations as set during Global Capture. I stress, this is on a fresh, Microsoft dvd installation of Vista Home Premium SP2. Only thing non-standard of note is deactivated UAC.
Ironically, many of the keys involved did pop-up in the Layer's registry after autorunning IE and Internet Options\Advanced\Reset-ting IE8's configuration to default. (These keys had not been captured into the Layer originally. Still, restarting IE8 (autorun), doing the first-run wizard and eventually deleting the Layer, produced the same results: settings persisted in the base.)
Saw similar results (persisting registry keys) with 2 other software installs captured globally.
As per request
Bump
I'm not seeing this behavior
I'm not seeing this behavior at all but I don't have any Vista home VMs, however that shouldn't make any difference at all.
Everything I do with IE8 running in a layer, including passwords, get saved to the layer and not to the base.
I'm using SWV SP1 and I tested on XP Pro, Vista Ult SP2 and Win7 Ult.
If a forum post solves your problem please flag is as the solution
Baffling. I'm on an
Baffling. I'm on an unconfigured system and it's leaking.
I'm running SWV 6.1 MP1 HF1, I'll try SP1. Who knows.
As to Vista Home, over on Wilders Security,* Gene Kupfer told me SWV 6.1 SP1 worked fine on Premium SP1. Again, I'm on SP2, maybe it's related to that.
* http://www.wilderssecurity.com/showthread.php?t=255443
Think there actually is a SWV
Think there actually is a SWV 6.1 MP1 HF1 and Vista Home Premium SP2 issue. After upgrading to SWV SP1, IE now clean upon reseting its autorun Layer.
Thanks for looking into it.
:)
weird. We never test on home
weird.
We never test on home premium but we test home basic, pro and ultimate so you would think we would have hit this.
If a forum post solves your problem please flag is as the solution
Maybe Vista SP2 broke the
Maybe Vista SP2 broke the camel's back, I don't know. I read somewhere Microsoft at times roadtests new technology for new products in updates to old ones. Perhaps some parts of Windows 7 got into SP2 somehow and caused a conflict.
If I remember correctly, one of SWV 6.1 SP1's primary objectives was to make it W7 compatible. It might explain why the issue's been resolved. Why it would only manifest in Premium, again, I don't know.
Might be worth trying to get an OEM Premium SP2 installation, to see what happened. If it doesn't pop up then either, I'd be glad to furnish you with any details that will identify what caused SWV to break. My email's in your database. Feel free to use it, should you decide to go bug hunting.
Would you like to reply?
Login or Register to post your comment.