PRIVACY PROTECTION
Summary of this assessment of privacy protection here. Detailed analysis and method here. The term data is used below to mean files, inc program files, and registry keys.
Protecting data on your main machine from sandboxed processes
This is important if you are using the Sandbox for risky purposes, for example surfing sites that could be infected, or as a place in which the activities inexpert (e.g. child) or untrusted users can be segregated.
- Malware or users can read any data they wants to as sandboxed files have full read access to non-sandboxed files and registry keys. This is inherent in most sandboxes but could have been restricted on a per sandbox basis, if CIS had chosen to.
- Keylogging and screengrabbing of non-sandboxed processes by sandboxed processes by most but not all techniques is prevented.There seem to be no restrictions on clipboard logging, web cam capture, or sound capture.
- Using default settings, sandboxed malware can pass on this information over the internet without any hindrance. Ways to address this are here.
Protecting sandboxed data
This is important if you are using the sandbox to segregate sensitive data, or for sensitive operations including banking (think passwords and anonymous browsing).
- The fact that the Sandbox file store is accessible (though hidden) from the real environment, and the registry keys are fully accessible (though in a segregated location), could render it accessible to malware or to exploration by unauthorised users or indeed operation of system programs like backup and restore.
- Unauthorized users could get direct access to sensitive data stored in the sandbox via the CIS interface as password protection is easily bypassed at present
- Hackers should not be able to hack into the Sandbox and take control of the computer as inbound CIS firewall connection controls, and OS access restrictions are in place by default
- Malware running in the sandbox will have access to all sandboxed data and the lack of outgoing firewall restrictions means they can send this data, and any data they can obtain by logging or grabbing, over the internet. Although you cannot yet make the protection level dependent in any way on sandboxed status, you could consider raising the overall level of control as described in this FAQ here.
- The fact that the neither sandbox file store nor the segregated registry keys can be securely deleted (ie overwritten to prevent undeletion) when reset increases the above risks. To address this you could try using Windows facilities to encrypt the file store, but I have not tested this.
- Keylogging and screengrabbing of sandboxed processes by unknown, background, non-sandboxed processes is inhibited by the normal behavior blocker rules. Keylogging and screengrabbing of sandboxed process by sandboxed processes by some (maybe 50% of) techniques is prevented.There seem to be no default restrictions on clipboard logging, web cam capture or sound capture
- Files and key written by programs will not usually leak to the non-sandboxed environment as as the virtualiser is a kernel hook so is difficult to bypass and sandboxing seems fairly comprehensive in scope. But there are indications of a few leaks which could let something through.
- As communications between sandboxed and non-sandboxed programs are not restricted, sandboxed programs can leak information to programs running unsandboxed which in turn could write the data involved outside the sandbox. The simplest example is the clipboard (simple cut and paste effects a transfer, no logging is needed for this). Some ways of addressing this here.
- You should remember that Shared Space is, by definition, a mechanism for transmission between sandboxed and non-sandboxed environments, so you should be careful what you put in it.
Protection when changing purposes
This is important when you want use the sandbox for risky purposes which may result in malware installations and then want to use it to store things that need to be protected (or vice versa). There is no automatic protection against such risks, you need to remember to reset the sandbox between such uses or use the other approaches described here.
