How Protected Mode Improves Security

When Internet Explorer runs in Protected Mode, Mandatory Integrity Control (MIC), a Windows Vista and later operating systems feature, forces Internet Explorer to be a low-integrity process. MIC does not allow low-integrity processes to gain write access to high-integrity-level objects, such as files and registry keys, in a user's profile or system locations. Low-integrity processes can write only to folders, files, and registry keys that have been assigned a low-integrity MIC access control entry (ACE) known as a mandatory label. Table below describes the different integrity levels.

Mandatory Integrity Control Levels

As a result of being a low-integrity process, Internet Explorer and its extensions run in Protected Mode, which can write only to low-integrity locations, such as the new low-integrity temporary Internet files folder, the History folder, the Cookies folder, the Favorites folder, and the Windows temporary file folders. By preventing unauthorized access to sensitive areas of a user's system, Protected Mode limits the amount of damage that a compromised Internet Explorer process can cause. An attacker cannot, for example, silently install a keystroke logger to the user's startup folder.

Furthermore, the Protected Mode process runs with a low desktop integrity level. Because of User Interface Privilege Isolation (UIPI), a compromised process cannot manipulate applications on the desktop through window messages, thus helping to reduce the risk of shatter attacks.

Shatter attacks compromise processes with elevated privileges by using window messages.

If a Web page or add-on does require more privileges than provided by Protected Mode or the compatibility layer, it will prompt the user to grant those privileges using User Account Control (UAC). This can occur, for example, if the user needs to install an add-on that requires elevated rights. Most add-ons can run within Protected Mode, however, and loading them will not prompt the user.

Because Protected Mode also protects extensions, vulnerabilities in extensions, such as buffer overflows, cannot be exploited to access any part of the file system or other operating system object to which Protected Mode does not normally have access. Therefore, the damage that a successful exploit can cause is very limited.

Defense-in-Depth

Protected Mode is not the first line of defense against malware; it's a form of defense-in-depth. Protected Mode offers protection in the event that a malicious Web page successfully bypasses the other security measures of Internet Explorer. In the case of a successful exploit, Protected Mode restricts the processes' privileges to limit the damage that malware can do. In other words, even if your browser gets hacked, Protected Mode might still keep your computer safe.