Author Topic: Using the 6.x sandbox/kiosk for different purposes  (Read 24641 times)

Offline mouse1

  • Global Moderator
  • Comodo's Hero
  • *****
  • Posts: 11856
I have been following this thread and decided to test each individual purpose, I have concentrated on the "Average User" rules but may also test some "advanced rules" in future tests.
I have so far only tested the Banking hardened browser.
Following the rules step by step is pretty straight forward -
after securing the Kiosk as seen in rules A,B,C and D here
I created the required folders, see folders  and followed the other steps "General Guidelines" which are good practice.


Creating and using the Hardened banking browser
I followed the steps Here
I installed Ad Block and HTTPS Everywhere in Ice Dragon,
I had never used Keepass before, make sure to install the portable version. I installed the database in a shared area I called Kiosk (I have deleted shared space)
I reset the sandbox then entered the Kiosk I opened the banking browser from the shortcut - Software for Virtual use only - I have set my bank log in page to open as the home page, then logged in using Keepass, when I finished I logged out, exited the Kiosk and reset.
Thanks very much for reviewing this Treefrogs. I and I'm sure many users will appreciate the care you take, and i will sort out any problems, needs for clarification that you find.

Quote
After a little time spent setting this up I found it very easy to use. I like the fact that the browser used will never be used for any other purpose therefore creating a very secure banking enviroment.
That's exactly the idea :), glad it works

Offline treefrogs

  • Comodo's Hero
  • *****
  • Posts: 550
  • Money.... it's a crime
I have set up and tested the Anonymous web access browser, I followed the same guidelines seen Here.
The only exception been #5, I did not alter or add to the browser as JAP is pre-configured for anonymity by default, changing this could be counterproductive.

I followed the steps Here and installed the portable JAP browser in to the specified folder, reset the sandbox and entered the Kiosk.
Once in the browser JAP starts from the shortcut and anonymously connects to the web. I also configured the Tor browser the same way, another portable versions of chat/email etc should be just as straight forward.

All app's running in the kiosk can be made to ask for internet access by following the guide Here  
I created rules to force all browser connections to only connect through my VPN.

Edit:JAP uses Java, I have Java set to always run fully virtualized with Partially Limited rights, this has no impact on functionality that I have noticed.
The portable installation is a little different than the standard install, I found This guide helpful.

Edit: I think it's worth noting that both the JAP browser and the Tor browser bundle both come with custom settings and add ons pre-installed so there is no need to tweak or add to the browsers, doing this could actually be counter productive.


[attachment deleted by admin]
« Last Edit: March 20, 2013, 12:17:20 PM by treefrogs »
Windows 7 x64
CIS 6 - fully virtual/HIPS enabled
Virtual Dragon
Cyberfox

Offline treefrogs

  • Comodo's Hero
  • *****
  • Posts: 550
  • Money.... it's a crime
The risky site browser set up is very straight forward, Using the Guidelines seen Here
I created the files - 'Software for VIRTUAL use ONLY' and the shortcut folder, I have called it 'Kiosk'
I installed a portable copy of CD following This Guide and placed a shortcut to the .exe in the shortcut folder (Kiosk)
As the site will be used for risky sites and downloads I also added killswitch.exe to the shortcuts (Kiosk) folder.
I added VT, CIMA and others to the bookmarks, I also added the VTChromizer extension for context menu VT uploading.
This browser is ideal for finding and testing risky software, resets before and after use are critical.
I also create the FW rule found Here[/url ]to control any unknown file connection attempts

I have tested three of these hardened virtual browsers now, I have found that after initially reading the guidelines and creating the folders needed, the set up is relatively simple.
Once in the Kiosk using these browsers is as easy as using any other program, the advantage is knowing you are running a secure browser that is specific to that task.
I have tried to follow the guide as much as possible for these tests and intend to come back and add some advanced rules as I test them.

I recommend using these guides to anyone who wants to get the best security for specific high risk tasks.

Edit: I forgot to mention that CD issued an alert saying installing in this location is not recommended, I haven't seen any issues with the browser at all.



[attachment deleted by admin]
« Last Edit: March 17, 2013, 02:27:12 PM by treefrogs »
Windows 7 x64
CIS 6 - fully virtual/HIPS enabled
Virtual Dragon
Cyberfox

Offline treefrogs

  • Comodo's Hero
  • *****
  • Posts: 550
  • Money.... it's a crime
Secure deletion is another layer of security/privacy that can be used to permanently delete the contents of the kiosk/sandbox.
I tried this using Eraser both in the kiosk before resetting and out of the kiosk. Errors are encountered each time.

Secure deletion is possible using Comodo System Cleaner. To securely delete the kiosk I exited the kiosk using the exit kiosk button, opened CSC then navigated to shredder - shred files and folders - C:\VTRoot and checked it, then hit shred, caution must be used to only select C:\VTRoot and nothing else as the data will be lost for ever, a message warning that C:\ drive contains windows files appears needs to be allowed and then the shredder runs.
On my pretty average X64 system the entire VTRoot folder was shredded in well less than a minute when using a 3x wipe with random charcter overwrite. A system reboot is needed to complete the process.
This method wipes all the registry values from the VTRoot entry HKLM\SYSTEM\VritualRoot\ although file key [Mod edit by Mouse] names remain.
Nothing was recoverable off the HDD using Recova to scan for traces.

Edit: After shredding but before reboot it appears as if a reset has been performed, C:\VTRoot no longer exists in the directory, I did have cmdvirth.exe and two instances of svchost.exe still running virtual, but no user invoked programs.

Edit 2: I used CSC to delete C:\VTRoot as described above then ran Recova before a reboot to see what is recoverable, there is no recoverable C:\VTRoot files/folders although they are lots of entries that can only be identified as coming from C:\......
After a reboot they are no recoverable files/folders relating to C:|VTRoot at all.



[attachment deleted by admin]
« Last Edit: April 05, 2013, 12:57:21 PM by mouse1 »
Windows 7 x64
CIS 6 - fully virtual/HIPS enabled
Virtual Dragon
Cyberfox

Offline justin_smith

  • Comodo Family Member
  • ***
  • Posts: 81
Re: Using the 6.x sandbox/kiosk for different purposes
« Reply #19 on: February 02, 2014, 07:57:31 PM »
Hi folks, fascinating discussion here. I have a newbie question: what's the purpose to doing sandboxing for banking purposes?

If I follow other suggestions here (e.g. use separate browser, harden that browser, only access banking sites on it, etc.), why is it advantageous to use sandboxing? I thought sandboxing is to ensure no malware gets out of sandbox to main system, but if I ensure I access "good" banking website, then there is no need for such assurance. Does sandboxing somehow prevent malware potentially running on the main system seeing what I am doing inside the sandbox (I did not think it provided such protections but could be wrong)? Or is there some other reasoning?
« Last Edit: February 02, 2014, 07:59:08 PM by justin_smith »

Offline mouse1

  • Global Moderator
  • Comodo's Hero
  • *****
  • Posts: 11856
Re: Using the 6.x sandbox/kiosk for different purposes
« Reply #20 on: February 03, 2014, 06:22:54 AM »
Hi folks, fascinating discussion here. I have a newbie question: what's the purpose to doing sandboxing for banking purposes?

If I follow other suggestions here (e.g. use separate browser, harden that browser, only access banking sites on it, etc.), why is it advantageous to use sandboxing? I thought sandboxing is to ensure no malware gets out of sandbox to main system, but if I ensure I access "good" banking website, then there is no need for such assurance. Does sandboxing somehow prevent malware potentially running on the main system seeing what I am doing inside the sandbox (I did not think it provided such protections but could be wrong)? Or is there some other reasoning?

1. You can erase all traces after your banking session if you wish. Or encrypt them. In the sandbox (presuming no leaks) everything is kept in one box so you can be sure of total deletion or encryption
2. You can make the sandbox a dedicated banking environment, making it more efficient, more secure (using banking-specific settings) and less likely you will make errors like using the wrong browser, or browser setting, password manager, navigating to phishing URLs etc etc etc

Point 2. would be enhanced if Comodo allowed multiple sandboxes. But you can get the advantage now if you don't use the sandbox for anything else, and you can get most of the advantage if you use it for a restricted range of compatible purposes

Hope this helps

Mike
« Last Edit: February 03, 2014, 06:33:48 AM by mouse1 »

Offline Dch48

  • Comodo's Hero
  • *****
  • Posts: 2547
Re: Using the 6.x sandbox/kiosk for different purposes
« Reply #21 on: February 03, 2014, 12:31:01 PM »
I just use Dragon in the Kiosk for all sensitive things including banking. No other steps have been done and no settings changed from Dragon outside the Kiosk. What is wrong with this? it seems sufficient to me. If I need to do all those other things (which I won't), then the Kiosk is essentially useless. Needing to take all those additional steps is ridiculous.

If you really need a different browser when in the Kiosk, then Comodo should provide one and make it part of the Kiosk itself with all the needed settings as defaults like Avast does with their Safe Zone.
« Last Edit: February 03, 2014, 12:35:46 PM by Dch48 »
Avatar FX6327X Desktop
AMD FX-6300 6 core CPU
Sapphire R9-270X GPU
Windows 8.1 64 bit, IE11 & Outlook 2007
Comodo Internet Security 7.0 full package, MBAM on Demand

Offline mouse1

  • Global Moderator
  • Comodo's Hero
  • *****
  • Posts: 11856
Re: Using the 6.x sandbox/kiosk for different purposes
« Reply #22 on: February 03, 2014, 12:35:13 PM »
I just use Dragon in the Kiosk for all sensitive things including banking. No other steps have been done and no settings changed from Dragon outside the Kiosk. What is wrong with this? it seems sufficient to me. If I need to do all those other things (which I won't), then the Kiosk is essentially useless.

Please read the above topic, and in partic the first and banking posts to understand. Then read my reply to Justin. If you then have detailed queries I will be very happy to help.

Best wishes. Mike

Offline justin_smith

  • Comodo Family Member
  • ***
  • Posts: 81
Re: Using the 6.x sandbox/kiosk for different purposes
« Reply #23 on: February 03, 2014, 03:46:39 PM »
Thanks mouse, I read your reply very carefully and have two followup questions (along with couple comments).

1. You can erase all traces after your banking session if you wish. Or encrypt them. In the sandbox (presuming no leaks) everything is kept in one box so you can be sure of total deletion or encryption

I understand secure delete idea. I suppose if I require my secure banking browser settings to delete everything upon exit, it may come close but not close enough (as it would not be secure shred). Still, I guess I am not too concerned about this, because I doubt any banks store my password or other sensitive information anywhere on my system, encrypted or not (or am I too naive)?

Separately, I think there is a usability issue here since I am not sure I always want to delete some cookies if I want the banking site to remember that this is a "known" PC where I do NOT want it to keep asking me additional "security" questions or other info to login (which is what most sites do when they see computer for the first time).

2. You can make the sandbox a dedicated banking environment, making it more efficient, more secure (using banking-specific settings) and less likely you will make errors like using the wrong browser, or browser setting, password manager, navigating to phishing URLs etc etc etc

Point 2. would be enhanced if Comodo allowed multiple sandboxes. But you can get the advantage now if you don't use the sandbox for anything else, and you can get most of the advantage if you use it for a restricted range of compatible purposes

I am not worried about it being more or less efficient (small performance delay is OK for banking site operations). I am also not worried about using wrong browser, because (a) I personally am careful in this regard and (b) if I weren't careful enough, I feel like I would just as likely forget to use Kiosk in the first place, as I am to use the right browser. Still, if it helps some folks remember, I completely understand the importance of this benefit.

Now, what I mostly want to concentrate on in your answer is the "more secure (using banking-specific settings)" part of your reply. Could you clarify what settings would make your proposed setup more secure that would not be achievable by making browser-only settings in the banking browser? In other words, I think you are saying some settings in Kiosk itself (not in browser used in Kiosk) make it a more secure environment. What are those settings and why are they making it more secure (if not obvious from the settings themselves)?

Appreciate your response!

Offline mouse1

  • Global Moderator
  • Comodo's Hero
  • *****
  • Posts: 11856
Re: Using the 6.x sandbox/kiosk for different purposes
« Reply #24 on: February 03, 2014, 04:19:56 PM »
Thanks mouse, I read your reply very carefully and have two followup questions (along with couple comments).

I understand secure delete idea. I suppose if I require my secure banking browser settings to delete everything upon exit, it may come close but not close enough (as it would not be secure shred). Still, I guess I am not too concerned about this, because I doubt any banks store my password or other sensitive information anywhere on my system, encrypted or not (or am I too naive)?
Most browser clean functions are not comprehensive. Probably none are. And they are not secure delete. In sandbox you can use separate Comodo secure delete tool to fully clean everything at once.

Quote
Separately, I think there is a usability issue here since I am not sure I always want to delete some cookies if I want the banking site to remember that this is a "known" PC where I do NOT want it to keep asking me additional "security" questions or other info to login (which is what most sites do when they see computer for the first time).
I have not had this problem with my banking site. Probably the behavior you talk about is external IP linked not cookie linked? Cookies are typically pretty insecure so I doubt banking sites use them to store secure user data, though maybe they do if they can be strongly encrypted. Other sites do of course. You could make an exception for them if you were sure they were secure.

Quote
I am not worried about it being more or less efficient (small performance delay is OK for banking site operations). I am also not worried about using wrong browser, because (a) I personally am careful in this regard and (b) if I weren't careful enough, I feel like I would just as likely forget to use Kiosk in the first place, as I am to use the right browser. Still, if it helps some folks remember, I completely understand the importance of this benefit.
It's not just the wrong browser, it's the wrong browser instance, set up to be secure in the way best suited to banking. And all the ancilliary software, like secure password management, all in the same environment. Most people would find it difficult to ensure they always used the right bits together say under stress, but some people of course would not. Dedicated environments are efficient speed-wise too.

Quote
Now, what I mostly want to concentrate on in your answer is the "more secure (using banking-specific settings)" part of your reply. Could you clarify what settings would make your proposed setup more secure that would not be achievable by making browser-only settings in the banking browser? In other words, I think you are saying some settings in Kiosk itself (not in browser used in Kiosk) make it a more secure environment. What are those settings and why are they making it more secure (if not obvious from the settings themselves)?
They are the settings in the assemblage of software brought together for this purpose - you can find these settings and the software I suggest in the General and Banking sections above. You could replicate all but the Kiosk settings externally, if you made dedicated browser, CIS, and other app installations. But then those installations would be unsuitable for more general purposes and they would not be assembled together in a way that makes doing the right thing for banking easiest, and visually signals you're in the banking environment. Also it would be difficult to ensure the data they jointly create is securely deleted in one go. This is very important for things like clipboards, and password software which is not carefully designed and creates say insecure temp files.

All this would be improved of course if there was support for multiples sandboxes.

Hope this helps

Mike

Offline mouse1

  • Global Moderator
  • Comodo's Hero
  • *****
  • Posts: 11856
Re: Using the 6.x sandbox/kiosk for different purposes
« Reply #25 on: February 04, 2014, 12:57:38 AM »
Oh thre is also a separate password for access to the entire environment, which has some merit.

Offline justin_smith

  • Comodo Family Member
  • ***
  • Posts: 81
Re: Using the 6.x sandbox/kiosk for different purposes
« Reply #26 on: February 07, 2014, 08:53:57 AM »
Thanks Mike

Offline Conroy

  • Newbie
  • *
  • Posts: 24
Re: Using the 6.x sandbox/kiosk for different purposes
« Reply #27 on: April 16, 2014, 04:34:04 PM »
Thanks for this Information Mouse. I am new to Comodo.

With regards to money transfer, I only use a credit card online (no banking) and wonder which option (1 or 2) I should use for this in the following list you gave?

Quote
1. Banking & other apps where private communication to the correct location is critical
2. Anonymous browsing & other apps where secrecy of web activity is critical
3. Browsing risky sites & trying out potentially risky software inc. gaming
4. Corporate usage

Also, I use Gmail webmail, and other sites I log into. Which option for this please?

Best wishes.

Offline mouse1

  • Global Moderator
  • Comodo's Hero
  • *****
  • Posts: 11856
Re: Using the 6.x sandbox/kiosk for different purposes
« Reply #28 on: April 16, 2014, 10:19:57 PM »
Thanks for this Information Mouse. I am new to Comodo.

With regards to money transfer, I only use a credit card online (no banking) and wonder which option (1 or 2) I should use for this in the following list you gave?

Also, I use Gmail webmail, and other sites I log into. Which option for this please?

Best wishes.

I would use option 1 for the credit card. 

And 2 for email and browsing, assuming anonymity is important to you.

You can combine them as suggested in the Introduction, resetting between uses.

Best wishes

Mike

Offline Conroy

  • Newbie
  • *
  • Posts: 24
Re: Using the 6.x sandbox/kiosk for different purposes
« Reply #29 on: April 16, 2014, 11:44:48 PM »
Thank you.

 

Free Endpoint Protection
Seo4Smf 2.0 © SmfMod.Com Smf Destek