Protected Mode in Vista IE7

Article
02/09/2006

Hi, I’m Mike Friedman. I work on the IE team in the area of security. You may remember me from my previous IE blog post. We here on the IE team have a continuing focus on making web browsing safe from a variety of outside threats. Microsoft Windows Vista introduced an enhanced security model that we were able to build on in Vista's version of IE7. I want to tell you about a new major IE defense-in-depth security feature called Protected Mode. Defense in depth is a security principle that a system should provide multiple layers of defense, in case one layer is ever breached. Protected Mode takes advantage of three key new technologies in Vista's security model:

User Account Control (UAC), which implements the Principle of Least Privilege.

UAC will help users run Vista without requiring administrator privileges to be productive. Administrators can also run most applications with a limited privilege, but have "elevation potential" for specific administrative tasks and application functions.
Mandatory Integrity Control (MIC), a model in which data can be configured to prevent lower-integrity applications from accessing it. The primary integrity levels are Low, Medium, High, and System. Processes are assigned an integrity level in their access token. Securable objects such as files and registry keys have a new mandatory access control entry (ACE) in the System Access Control List (ACL).
User Interface Privilege Isolation (UIPI) blocks lower-integrity from accessing higher-integrity processes. For example, a lower-integrity process cannot send window messages or hook or attach to higher priority processes This helps protect against "shatter attacks." A shatter attack is when one process tries to elevate privileges by injecting code into another process using windows messages.

Internet-facing applications such as browsers are inherently at a higher security risk than other applications because they can download untrustworthy content from unknown sources. IE7’s Protected Mode leverage's Windows Vista’s UAC, MIC and UIPI features to boost browser security. In IE7’s Protected Mode—which is the default in other than the Trusted security zone—the IE process runs with Low rights, even if the logged-in user is an administrator. Since add-ins to IE such as ActiveX controls and toolbars run within the IE process, those add-ins run Low as well. The idea behind Protected Mode IE is that even if an attacker somehow defeated every defense mechanism and gained control of the IE process and got it to run some arbitrary code, that code would be severely limited in what it could do. Almost all of the file system and registry would be off-limits to it for writing, reducing the ability of an exploit to modify the system or harm user files. The code wouldn't have enough privileges to install software, put files in the user's Startup folder, hijack browser settings, or other nastiness.

In Protected Mode IE writes/reads special Low versions of the cache, TEMP folder, Cookies and History:

Cache: %userprofile%AppDataLocalMicrosoftWindowsTemporary Internet FilesLow
Temp: %userprofile%AppDataLocalTempLow
Cookies: %userprofile%AppDataRoamingMicrosoftWindowsCookiesLow
History: %userprofile%AppDataLocalMicrosoftWindowsHistoryLow

When IE runs outside of Protected Mode (the default for the Trusted security zone), it does not cross the security boundary to read the Low versions. However, the Favorites folder is shared between the modes.

In a similar vein insulating higher integrity processes from lower integrity processes, Protected Mode leverages UIPI to block window messages to higher-integrity processes and other forms of lower-to-higher access, to guard against web-based shatter attacks.

Conforming to the security concept of “least privilege,” web browsing and other routine functionality takes place at Low integrity level. Protected Mode does occasionally need to have functions performed at Medium and High integrity levels. For this purpose, Protected Mode uses the security concept of “separation of privilege.” Medium level functions are carried out by a separate User Broker process. High level functions are carried out by a separate Admin Broker process. An example of a function requiring an admin's High rights is the installation of an ActiveX control or a “setup.exe” type of installation. The Admin Broker carries out the ActiveX installation on IE’s behalf. The Admin Broker always gains the user’s consent before acting. An example of a function requiring Medium rights is a SaveAs operation to the user’s user profile folder. Here the medium-level User Broker assists. For most operations the User Broker requires user consent.

Because Low rights is such as restrictive environment, Protected Mode includes compatibility features. These features allow most add-ins to run unaffected. Protected Mode provides a “compatibility layer” that consists of a set of shims that intercept certain system API calls. There’s the File & Registry Shim, which virtualizes file system operations; the CreateProcess Shim, which allows an add-on to launch another process at Medium, with user consent; and the CoCreateInstance Shim, which allows an add-on to launch a COM server at Medium, again only with user consent.

Since a Low process lacks the privilege to write to most locations in the file and registry, the File & Registry Compat Shim virtualizes some common file system folders and registry keys. Those file and registry locations are redirected to per-user Low-integrity virtual locations where they can’t affect the real versions. The virtualized file system is in the Temporary Internet Files (TIF)—the same general place IE caches web files. If an add-in attempts to append to an existing file, the shim applies a “copy-on-write” approach, first copying the file to the corresponding virtual location, with the actual append happening only to the virtualized version. If the add-in attempts a file and a real version of a file and a virtualized version both exist, the shim makes the add-in read the virtualized version. The shim does not otherwise affect reads. Registry virtualization works similarly. Note that Vista's UAC virtualization does not apply to Protected Mode; if an add-in attempts to write to sensitive areas will not be redirected and they will just get an Access Denied error.

For example, the Compat Shim virtualizes the UserProfile folder (real location %userprofile%) to the TIF location %userprofile%AppDataLocalMicrosoftWindowsTemporary Internet FilesVirtualized{system drive letter}Users{username}.

An example of a file system location to which an add-in is simply denied access is %userprofile%AppDataRoamingMicrosoftWindowsCookies

As an example of the registry virtualization, the Compat Shim virtualizes the real registry key HKCUSoftware to HKCUSoftwareMicrosoftInternet ExplorerInternetRegistryREGISTRYUSER{SID}Software . (A SID is the user's security identifier.)

An example of a registry location where an add-in is simply denied access is HKCUSoftwareClasses.

The CreateProcess Shim intervenes when an add-in attempts to launch a process using CreateProcess() or equivalent API. The shim presents an “elevation dialog” to the user, asking the user whether they want to run the app at a higher privilege level than IE. If the user assents, the app is allowed to launch at Medium level. If the user says no, the app is not launched. The CoCreateInstance Shim works similarly but kicks in when an add-in attempts to launch a COM server.

To optimize user experience, the registry has Elevation Opt-In Lists for CreateProcess and COM (at HKLMSoftwareMicrosoftInternet ExplorerLow Rights; there's also a per-user version in HKCU). These allow-lists can enable Protected Mode IE to silently launch specified apps or COM servers at elevated privilege levels, among other options. When it’s necessary to launch a non-IE process with admin privileges, you would include the RequestedExecutionLevel marking in the application manifest.

The compatibility layers should allow most legacy add-ons to just work without requiring any modification. Protected Mode provides a set of APIs that new and existing add-ins can make use of to work natively in Protected Mode. For example, IEIsProtectedMode() lets an add-in find out if IE is running in Protected Mode. The IEGetWriteableFolderPath() and IEGetWriteableHKCU() functions find low-integrity locations to which the add-in can write. To save a file outside the TIF so that users and apps can later find the file, an add-in employs a two-step procedure, first calling the IEShowSaveFileDialog() function to get the user's consent and desired user profile location, and then calling IESaveFile() to write to that location. Add-in writers also can create their own broker processes if needed for custom elevated operations.

For further information:

Introduction to the Protected Mode API

Understanding and Working in Protected Mode Internet Explorer

User Account Control White Paper

- Mike

Update: Updated to fix a minor error.

Comments

Anonymous
February 09, 2006
Sounds good. I am glad security has been taken into such great consideration.
Anonymous
February 09, 2006
The comment has been removed
Anonymous
February 09, 2006
The comment has been removed
Anonymous
February 09, 2006
firefox 1.6
Anonymous
February 09, 2006
I don't see much difference from Firefox other than it is a Microsoft product
Anonymous
February 09, 2006
The comment has been removed
Anonymous
February 09, 2006
GUI version of the "sudo" command in *nixes?
Anonymous
February 09, 2006
How will this affect Web info managers like Onfolio, ContentSaver, or NetSnippets? These programs save contents from IE into database files, which can be located anywhere the user specified during installation.
Anonymous
February 09, 2006
The comment has been removed
Anonymous
February 09, 2006
I tested my pages in IE 7 beta 2 preview as the IE team requested and discovered that conditional comments don't work correctly in IE7 or IE6.

Please open this page in IE to see what I mean: http://rowanw.com/tests/conditional_comments_broke.htm

IE7 only displays half the data it should, while IE6 doesn't return anything. I have used the <comment> tag, because I've used it on a live page combined with conditional comments to make something work in IE6. That particular page doesn't render in IE7.

So have a look at my example page and tell me I made a mistake. I used two separate windows machines with diffierent versions of IE to test this.
Anonymous
February 09, 2006
The "User Account Control White Paper" link doesn't work....
Anonymous
February 09, 2006
@Ron--
Nothing shows in IE6 for me.

I get this is FF 1.5.0.1
This should be visible only in IE 7 or 5
end of ie 6 comment
This should be visible only in IE 6 or 5
end of ie 7 comment

I'm not a webdeveloper, but shouldn't this work in ff as people always try to tell me that ff follows all the standards (which I find hard to believe)?

My guess is that I should only see one of the texts in IE6 and one of the texts in ff or both.. I dunno. :-)
Anonymous
February 09, 2006
Lordmike, the <comment> tag is not part of the recommendation by W3, it's IE propietary HTML. That's why any browser except IE will ignore that tag.

Maybe it should be removed from IE7 to make my life easier?
Anonymous
February 09, 2006
@Ron--
Aha ok!
It should be removed completely if it's not part of W3C recommendation.
Why I think this is because if IE use it too much, then W3C will one day make one of its own and calling it something else and will then render <comment> non-standard completely.
They have done this before... or so I've read on this blogg.

What else can you use to do what you want?
Anonymous
February 09, 2006
Firefox, Opera, Safari, Konquerer, even IE7, but working between IE6 and IE7 will prove to be difficult.
Anonymous
February 09, 2006
is it better than mozilla firefox? if so, in what way?
Anonymous
February 10, 2006
It might be good to make the translation function installed in TOOL.

E-Mail h-h-a-y@mvd.biglobe.ne.jp
Anonymous
February 10, 2006
@Ravi--
Well FF wont work in protected mode, only IE will work that way. Meaning IE will be more secure on Vista then any other browser.
Anonymous
February 10, 2006
Well, I was wondering a few weeks back when I heard of the protected mode and I was wondering if any other software applications can place themselves in Protected Mode also? As a sort of, kind of software developer in C++, I was wondering if I could create a program that didn't need all kinds of access and could use the sandbox (protected mode) while connecting to the Internet to protect the user from themselves and protect the user from my program because I don't have a lot of security experience.

I also ask because it would be something that Opera or Mozilla may want to take advantage of when Vista comes out. I don't know how Mozilla would take advantage of the new systems, but they could probably be working on it, doubt it as I haven't heard anything and the tools for Vista have been out for quite a while. Could be on Bugzilla but I rarely check that.

I should also note that I didn't read the above whitepapers as I'm tired (which isn't a good excuse, I'm just lazy).
Anonymous
February 10, 2006
The comment has been removed
Anonymous
February 10, 2006
"The compatibility layers should allow most legacy add-ons to just work without requiring any modification."

This seems like a dangerous attitude. It seems to me (and this isn't meant to be rude) that you've assumed you can plug all the possible holes with your three pronged approach but that barring the rules imposed by those specific changes, ActiveX still runs pretty much the same as always. It seems to me that a keyboard recorder or an annoying control that launches dozens of new IE windows (in the same process) would still run just fine. Maybe the approach shouldn't be tilted as heavily toward keeping current software running in this case.

Lastly, I have to ask you if you honestly believe webmail newbie grandparents or a child desperately trying to download a game all his friends have would know or care about access levels. In the case of the former, they'll probably just type in their password (if indeed one's required) without understanding the dialog at all. In the case of the latter, if clicking ok is all that’s required, consider it done.

In these cases, it's tempting to say that fault for the infection would lie with the users themselves, but that's just an excuse for software that overestimates user’s familiarity with the technical underpinnings of IE. Please consider reducing functionality where ActiveX controls are concerned rather than merely adding more dialogs to the user experience.
Anonymous
February 10, 2006
The comment has been removed
Anonymous
February 10, 2006
@curious

Protected Mode is only available on Windows Vista because it depends on the new privilege restrictions in Windows Vista called Mandatory Integrity Control.

@Greg

I agree with you that reducing complexity can help improve security. As you may already, in addition to running IE in Protected mode, we're also disabling most of the ActiveX controls on your system from begin used by Internet sites and removing some legacy features all together. We’re doing that while still maintaining compatibility with the scenarios that customers use today. You can read more about those features in at the end of the IE7 release notes: http://msdn.microsoft.com/ie/releasenotes/default.aspx

To your second question, all applications on Windows Vista will run with User permissions and therefore have some protection. Internet Explorer in Protected Mode runs with even less permission and therefore enhanced protection for your personal files and settings on your system.
Anonymous
February 10, 2006
What happens when you have one page in the Trusted Zone on one tab and another page in the Internet Zone on another tab? Since they're both running in the same IE process, how does that work?
Anonymous
February 10, 2006
Why is it that no IE version thus far actually deletes history wwhen you tell it to? If you select to keep history for 1 day it will still show up one week from now.
Anonymous
February 10, 2006
Dean: Pages in non-Protected Mode zones open in their own browser window.
Anonymous
February 11, 2006
PingBack from http://dancmorgan.wordpress.com/2006/02/10/protected-mode-in-vista-ie7/
Anonymous
February 13, 2006
My goodness, I haven't seen so many acronyms since the last Sun Microsystems press release!

Geez... I can't imagine what it'd be like around the office. "Quick! The TIF must have UAC to the ACL with ACE and ensure the integrity of the UIPI!" :/
Anonymous
February 13, 2006
My "browser helper" dll uses WriteFile() to a Mailslot. Will the user be asked for permission to do that? How often will the user be asked? Each write, or once for each instance of IE, or once for the first write by the helper.
Anonymous
February 13, 2006
With all these benefits of "Protected Mode", why don't you set IE7 to run this way by default?

I am not convinced that novices would be confused if there were SIMPLE, BUT DETAILED explanations for errors, risks involvd for making exceptions, and how to avoid them in the future.
Anonymous
February 15, 2006
Simply Awesome, from what I've seen, it IS the default (on Vista).

If you're surfing in the internet zone, then you're running in protected mode (it says so in the status bar :))
Anonymous
February 15, 2006
LarryOsterman, gg; should have tested it on the beta Vista and not just on XP.

Glad Microsoft is as keen on security as I am.
Anonymous
March 06, 2006
PingBack from http://www.blahblahblahg.com/2006/03/06/malware-defense-run-applications-as-a-limited-user/
Anonymous
March 08, 2006
Running as Limited User - the Easy Way

Malware has grown to epidemic proportions in the last few years....
Anonymous
March 15, 2006
As we’ve described
previously, we’ve made some major architectural improvements to improve browsing...
Anonymous
March 20, 2006
I’m really excited for my talk tomorrow here at Mix06. This conference feels more like a party than work....
Anonymous
July 23, 2006
如今这世上，可谓真假莫辨，真的可以变成假的，假的也可以宣称自己是真的。这不，这几天笔者就遇到了一个非常怪异的问题，差点被IE保护模式功能的虚拟重定向功能给搞糊涂了。不过总算藉此机会好好了解一下IE保护模式，对于Windows...
Anonymous
August 04, 2006

I had mentioned a while back that we planned to call the version of IE7 in Windows Vista “Internet...
Anonymous
August 04, 2006
Since a recent digg article and its underlying Wikipedia entry seems a little confused about index.dat,...
Anonymous
August 04, 2006
The comment has been removed
Anonymous
August 05, 2006
PingBack from http://www.windowsxlive.net/?p=55
Anonymous
August 08, 2006
PingBack from http://www.iskenderiye.com/wordpress/?p=79
Anonymous
August 15, 2006
PingBack from http://www.iskenderiye.com/wordpress/?p=86
Anonymous
August 16, 2006
PingBack from http://www.aso.com.tr/press/?p=206
Anonymous
September 05, 2006
I picked up this post on Vista's new Mandatory Integrity Control feature by way of Steve's blog. The...
Anonymous
September 11, 2006

One of the reasons we went to Blackhat last month was to show how the Security Development Lifecycle...
Anonymous
October 18, 2006
PingBack from http://soci.hu/blog/index.php/2006/10/18/vista-ie-protected-mode/
Anonymous
October 18, 2006
Since I don't feel like packing my moving boxes yet, I am trying out IE 7.0 RTM for Windows XP SP2 in
Anonymous
November 08, 2006
As you may have seen on the Windows Vista blog , we released Windows Vista to manufacturing today! Wahoo!!!
Anonymous
November 30, 2006
PingBack from http://www.pchelpforum.com/windows-vista/24168-xp-vista-help-please-2.html#post158569
Anonymous
December 23, 2006
PingBack from http://thestressblog.com/2006/12/23/vista-so-far/
Anonymous
January 12, 2007
I’m pleased to report that on January 8th, we had the 100 millionth IE7 installation. However, even more
Anonymous
January 14, 2007
PingBack from http://www.andres-homepage.ch/?p=25
Anonymous
January 15, 2007
Wow - that's a great milestone. From the IE Blog : http://blogs.msdn.com/ie/archive/2007/01/12/100-million-ie7-installations.aspx
Anonymous
January 17, 2007
IEBlog : 100 Million IE7 Installations! IE7의 설치가 1억건을 돌파했다는 소식입니다. GPM인 Tony Chor의 이야기를 그대로 옮겨 번역해보겠습니다:
Anonymous
January 18, 2007
PingBack from http://logicbank.com/2007/01/18/ie7-reaches-100-million-installations/
Anonymous
March 17, 2007
The comment has been removed
Anonymous
March 29, 2007
You know those cutesy animated cursors you see on some Web sites? Suddenly, they're not so cute anymore. Ryan Naraine at ZDNet reports a flaw in the way Internet Explorer 6 and 7 handles animated cursors in Windows XP running...
Anonymous
March 29, 2007
The comment has been removed
Anonymous
April 19, 2007
PingBack from http://blogs.zdnet.com/Ou/?p=343
Anonymous
May 22, 2007
PingBack from http://blogs.zdnet.com/hardware/?p=129
Anonymous
June 22, 2007
Wow, this has been a tough one I closed this afternoon. The customer has developed a custom IE toolbar
Anonymous
July 18, 2007
Over the past few days, we’ve gotten several questions from customers about how you can invoke third-party
Anonymous
July 18, 2007
Over the past few days, we’ve gotten several questions from customers about how you can invoke third
Anonymous
July 26, 2007
PingBack from http://www.ajaxgirl.com/2007/07/26/chris-wilson-keynote-at-tae/
Anonymous
August 06, 2007
PingBack from http://www.0hv.net/enriching-the-web-safely-how-to-create-application-protocol-handlers
Anonymous
August 06, 2007
PingBack from http://www.0hv.net/enriching-the-web-safely-how-to-create-application-protocol-handlers-2
Anonymous
August 12, 2007
PingBack from http://www.redbyte.net/analysis/windows_vista_integrity_control_capabilities/
Anonymous
September 17, 2007
PingBack from http://www.pcdailytips.com/2007/09/18/ie7-protected-mode-explained/
Anonymous
September 18, 2007
PingBack from http://aoortic.com/?p=11406
Anonymous
September 20, 2007
one more reason not to use QuickTime one more reason not to use Acrobat Reader 2 more reasons to keep
Anonymous
November 06, 2007
PingBack from http://blogs.sparknettech.com/ben/2007/11/06/downloader-madness/
Anonymous
November 09, 2007
PingBack from http://office.realeyesmedia.com/blogs/jun/?p=88
Anonymous
December 06, 2007
PingBack from http://www.powerstroke.org/forum/computer-geeks/31729-grrrrrrrrr.html#post352584
Anonymous
February 09, 2008
PingBack from http://www.etixet.com/using-process-explorer-to-run-as.html
Anonymous
February 17, 2008
PingBack from http://software.hane.us/using-process-explorer-to-run-as.html
Anonymous
March 02, 2008
The comment has been removed
Anonymous
March 27, 2008
PingBack from http://employmentwagesblog.info/ieblog-protected-mode-in-vista-ie7/
Anonymous
April 19, 2008
This post is content adapted from Chapter 11 of the Microsoft Virtual Server 2005 R2 Resource Kit . Always
Anonymous
May 12, 2008
PingBack from http://www.cerias.purdue.edu/weblogs/pmeunier/reviews/post-148/finally-somebody-gets-secure-web-browsing-and-does-it-the-right-way/
Anonymous
June 10, 2008
PingBack from http://www.techspedia.com/2008/06/11/vu468843-microsoft-internet-explorer-7-disablecachingofsslpages-may-not-prevent-caching/
Anonymous
June 10, 2008
PingBack from http://www.techspedia.com/2008/06/11/vu468843-microsoft-internet-explorer-7-disablecachingofsslpages-may-not-prevent-caching-2/
Anonymous
June 12, 2008
PingBack from http://www.mondo3.com/forum/computer-hw-sw-elettronica-informatica/31277-ie7-sicurezza.html#post386226
Anonymous
June 24, 2008
This blog post frames our approach in IE8 for delivering trustworthy browsing. The topic is complicated
Anonymous
June 28, 2008
PingBack from http://payton.adultstarsstories.com/vistawindowexplorer.html
Anonymous
June 28, 2008
PingBack from http://blog.itsolutionsla.com/index.php/2008/06/24/ie8-and-trustworthy-browsing/
Anonymous
July 02, 2008
Hi! I’m Eric Lawrence, Security Program Manager for Internet Explorer. Last Tuesday, Dean wrote about
Anonymous
July 02, 2008
PingBack from http://internetexplorerblog.info/?p=145
Anonymous
July 07, 2008
PingBack from http://miles.onlinevidssite.info/howcantemporaryinternetfilesenduponmycomputer.html
Anonymous
July 09, 2008
PingBack from http://www.sarin.mobi/2008/07/ie8-and-idn/
Anonymous
July 12, 2008
PingBack from http://nyla.onlinevidsdigestabout.info/vistasecuritytrojaninternetexplorerfix.html
Anonymous
September 25, 2008
PingBack from http://www.jeff.wilcox.name/2008/09/25/using-ielaunchurl-to-launch-and-retrieve-the-pid-of-a-protected-mode-ie7-window/
Anonymous
October 19, 2008
PingBack from http://lightman76.wordpress.com/2008/10/20/internet-explorer-plugins-and-vista/
Anonymous
January 18, 2009
PingBack from http://www.keyongtech.com/1274533-https-new-window
Anonymous
January 22, 2009
PingBack from http://www.hilpers.nl/397891-tijdelijke-internet-bestanden
Anonymous
February 09, 2009
PingBack from http://portal.lacaterinca.com/ie8-security-part-viii-smartscreen-filter-release-candidate-update/
Anonymous
February 10, 2009
PingBack from http://www.chorr.com/2009/02/10/ie8-security-part-viii-smartscreen-filter-release-candidate-update/
Anonymous
February 17, 2009
Изменения в фильтре SmartScreen в IE8 RC1 Привет, меня зовут Алекс Гловер (Alex Glover) и я являюсь главным
Anonymous
March 16, 2009
    안녕하세요! 저는 인터넷 익스플로러 보안 프로그램의 책임자인 에릭 로렌스라고 합니다. 지난 화요일, 딘(Dean)이 신뢰성 높은 브라우저 에 대한 저희의 생각을
Anonymous
April 05, 2009
Malwarehasgrowntoepidemicproportionsinthelastfewyears.Despiteapplyinglayeredsecurityp...
Anonymous
May 29, 2009
PingBack from http://paidsurveyshub.info/story.php?title=ieblog-protected-mode-in-vista-ie7
Anonymous
May 31, 2009
PingBack from http://woodtvstand.info/story.php?id=4307
Anonymous
June 08, 2009
PingBack from http://insomniacuresite.info/story.php?id=6801

Share via

Protected Mode in Vista IE7

Comments

Additional resources