CPF Sandbox: discussions

[system]

@Pedro* post:60

Off-topic: i’m not even talking about BOClean or CAVS. This is me maturing my ideas. (there’s another reason for another day, or pm’s).
But yes, once BOClean is available, i’ll install it right there ;D

On-topic: Everything from browser is redirected to the sandbox (in case of virtualization sandbox, the one i prefer). Everything in the sandbox has restricted rights, which is primarily the intent of the sandbox.
A virus, for instance, cannot do anything, unless to other files inside the sandbox. It can read from the system (depending on what program, read all, read except some parts defined by you etc.). But everything it writes, is to a fake registry, fake file system, etc.
When you want, you delete the sandbox, and everything is gone. Before that, you can save what you want from the sandbox (if you feel it’s all right).

I think sandbox + virtualization might not be as safe as people think it is.

[system]

Nothing’s perfect. The developer of SandboxIE himself has noted that he does patch weaknesses.
The thing is, can you give me an existing malware/site that can evade SandboxIE?

[mike6688]

@LUSHER post:61

I think sandbox + virtualization might not be as safe as people think it is.

Lusher,

Would you care to shed some more light on this statement? I know that virtualization and sandboxing may have problems, yes, but it would be interesting if you can expand on your comment as to what you think about them.

Mike

[system]

I hope this is my final opinion lol:

No sandbox. Sandbox is the right companion for a firewall, but it’s really not related to inbound/outbound. One could understand the use of HIPS - refined application control in real time - for a refined outbound control. It fits in Comodo’s structure too- NetMon- AppMon- HIPS.

But maybe the sandbox should be a sepparate program. That’s my opinion anyway. Now it is. And there already exists one.

Point is, i like SandboxIE, and it’s the best around- light, easy to use, and powerful. No need to build another. This one is freeware too, and if you want advanced options, support the developer and buy the lifetime license (25 dollars).
The developer is constantly improving it, and will listen to you.

I’ve been talking about SandboxIE since i started this thread. I realize i have what’s needed. Why should i need everything in one interface? For an easier target?

CPF with HIPS, Antivir/ Avast!/ BOClean or CAVS (sandbox would fit better in CAVS lol), and SandboxIE. Malware goodbye.

[system]

@Pedro* post:62

Nothing’s perfect. The developer of SandboxIE himself has noted that he does patch weaknesses.
The thing is, can you give me an existing malware/site that can evade SandboxIE?

Not without giving you the password. No.

[system]

Ah, so i need to insert password to get infected?What a relief, i thought you had a dangerous site there.
Is it some PoC?

[system]

If you haven’t seen it before, here’s a link worth looking at:

http://techsupportalert.com/security_virtualization.htm

Toggie