Lite Virtualization and Sandboxes

Manny


So if my email program is sandboxed a viral attachment stays there, even if I execute it there's no issue because when the sandbox dissolves it goes away.  However, Sandboxie gives no warning that you just executed malicious software.  After all it's not an AV program and doesn't scan anything.  It just makes an isolated area on the disk to play with. 

However, since you can make Sandboxie consider email content as trusted content that won't disappear when the sandbox does, then the malicious attachment can stay around.  It's not a dangerous because no malicious content is dangerous until executed.  So sticking around is harmless.  It becomes dangerous only if you execute it outside the sandbox.  That's certainly a possibility and a possible entry point of infection if you aren't using the "software between the ears" as Pete said.  As long as the email program is always run sandboxed then it never makes any difference to the PC since it always disappears when the sandbox dissolves.

Presumably you won't run outside the sandbox if this is your practice but in case you do then perhaps this gives your AV company time to come up with a signature for zero day threats.  So Sandboxie gives you the opportunity to be safer and is another reason to have an AV around.

Which brings me to the next question.  Is there any reason to run AV software in the sandbox?  It might be nice to know if there's a virus in there so that you don't accidentally execute it outside the sandbox if it happens to be trusted content.  Or is it enough to say, don't ever execute untrusted objects, such as email attachments, outside the sandbox and forget it about it?

Manny

You ask good questions.   First yes, an AV or AS will indeed  see stuff in the sandbox.   And you are right about the Email.  Just no reason to ever run Email outside the sandbox.   If you were to walk in go to my computers, and just click on the Outlook icon, it would open sandboxed.  Any attachment on any email also runs sandboxed.   There are a few occasions, where I have to run the browser unsandboxed, but then Online Armor's Run Safer covers pretty much everything.

As to running AV software in the sandbox.   Chances are the install of today's AV's would fail if you tried to install them in the sandbox.  They wouldn't be able to install their drivers or start there services.   Any AV on  you system would see a file downloaded in the sandbox, and scan it.

In my case the only real issue is a file I download, and remove from the sandbox.  I still have a sandboxie option here.   I can right click it select run sandbox, and sandboxie will then give me the option of which sandbox.  I have a special one for this.  Anything can run in this sandbox, but nothing in it can access the internet.  (I can also right click it and scan it with OA, but that's another issue)

Pete

PS.   If you should run a virus in a sandbox, you may well see the affects of the virus.  Sandboxie neither detects or tries to stop things like display effects.   But you can right click the icon and terminate the thing, or just reset the computer.    Here is the key.  Your computer will be unaffected.

I have moved forward a downloaded both Sandboxie and Shadow Defender. They are both paid subcriptions. I am going to be learning the how to's about these programs for a while. After reading everyones comments it would seem that both have there advantages. I do have a question about an issue that I am having launching Windows Live Mail in Sandboxie. It worked okay at first but now I keep getting a memory error and the emailer won't launch. The Sandboxie window shows the program but doesn't run it. This is only happening in Win7. See the attachment. Some help would be greatly appreciated. Thanks.
 
 

Attached Image(s)

“Well it just goes to show you. It’s always something.
If it’s not one thing, it’s another.” __Roseanne Roseannadanna

Terry Ritivoy

Peter2150
 
You ask good questions.   First yes, an AV or AS will indeed  see stuff in the sandbox.   And you are right about the Email.  Just no reason to ever run Email outside the sandbox.   If you were to walk in go to my computers, and just click on the Outlook icon, it would open sandboxed.  Any attachment on any email also runs sandboxed.   There are a few occasions, where I have to run the browser unsandboxed, but then Online Armor's Run Safer covers pretty much everything.

Thanks.  I'm trying to make this a learning thread.  It's going pretty good so far.
 
I can understand how an AV can check downloads going to the sandbox.  It intercepts at a lower level before it gets there.  But I don't understand how an AV checks anything happening inside the sandbox.  It can't penetrate the barrier can it? If I execute a virus in a sandboxed email attachment then I would expect not to get a warning, right?

As to running AV software in the sandbox.   Chances are the install of today's AV's would fail if you tried to install them in the sandbox.  They wouldn't be able to install their drivers or start there services.   Any AV on  you system would see a file downloaded in the sandbox, and scan it.

I agree.  Even if possible it would be silly to install anything to an area that is temporary.





 

Best Regards,
Manny Carvalho
MS-MVP Windows 

Your donation to this site is greatly appreciate

ritzter13


I have moved forward a downloaded both Sandboxie and Shadow Defender. They are both paid subcriptions. I am going to be learning the how to's about these programs for a while. After reading everyones comments it would seem that both have there advantages. I do have a question about an issue that I am having launching Windows Live Mail in Sandboxie. It worked okay at first but now I keep getting a memory error and the emailer won't launch. The Sandboxie window shows the program but doesn't run it. This is only happening in Win7. See the attachment. Some help would be greatly appreciated. Thanks.
 
 

You would be better off starting your own thread on actual issues.  This question will get buried here.

Best Regards,
Manny Carvalho
MS-MVP Windows 

Your donation to this site is greatly appreciate

Terry, Sandboxie has an excellent forum and several of the folks there are real experts, they can probably help you.

Manny, anything can "penetrate" the sandbox, there is no barrier until you try to get out.

Acadia

"Security is always excessive until it's not enough." - Robbie Sinclair, Country Energy, NSW Australia

@Terry   Acacia's correct.  In the Sandboxie forum, they surely will help you.  I neither run that mail client or Win 7 so I am no help here.

@manny   Again Acadia is spot on.   To something like an AV Sandboxie is just simply another folder on your computer.  It's only when you run something in the sandbox, that it does it's magic and monitor what the software is doing.


Pete

PS.   If y ou want a painfully thorough way of seeing what Sandboxie is doing, try this.  Install Malware Defender, and put it in learning mode just  through a couple of reboots.   Then turn off learning mode, and launch a browser in the sandbox.  MD will intercept all the calls,(driving  you nuts) allowing you to see exactly what Sandboxie is doing.

ritzter13


I have moved forward a downloaded both Sandboxie and Shadow Defender. They are both paid subcriptions.
 
 

Terry, just to correct a minor nit.  Subscriptions implies a yearly payment of some kind.  In this case both of these programs at this time provide on going updates, etc for no extra fee, or any annual fee.

Pete

Manny

You would be better off starting your own thread on actual issues.  This question will get buried here.

 
I posted this rather late in the day (for me anyway). After rethinking this I realized my problem would be a distraction in this particular subject thread. If necessary I will start a new topic in the rmail section. Keep asking those questions Manny. We all learn from your wisdom.
 

Acadia

Terry, Sandboxie has an excellent forum and several of the folks there are real experts, they can probably help you.

 
Thanks Moose. I will research this over there. I was just wondering if the CH Sandboxie users have experienced the same problem.
 

Pete2150

Terry, just to correct a minor nit.  Subscriptions implies a yearly payment of some kind.  In this case both of these programs at this time provide on going updates, etc for no extra fee, or any annual fee.

 
I knew that wasn't right. My bad. I meant that I purchased the licenses for both rather than running the free version. Thanks for the suggestions.

“Well it just goes to show you. It’s always something.
If it’s not one thing, it’s another.” __Roseanne Roseannadanna

Terry Ritivoy

ritzter13


  I was just wondering if the CH Sandboxie users have experienced the same problem.
 

No, just like Peter, I neither use Win7 nor that email client.

Acadia

"Security is always excessive until it's not enough." - Robbie Sinclair, Country Energy, NSW Australia

Sorry Terry I use both those but as yet haven't decided if or when to try out Sandboxie.

Joan Archer
http://crossstitcher.webs.com/

Terry,I use both Win 7 and I run Live Mail (actually I run all apps that access the net plus internet shortcuts like my desktop banking shortcut in Sandboxie).


I've had no issues with Live Mail though that is not my default e-mail client (Thunderbird 3 is).

Good advice Bill about the Sandboxie forum.

Frank Golden
Acer Aspire 5672WLMi, 2 GHz Core 2 Duo, 500GB HDD, 4GB DDR2 ram, ATi X1400  [Win 7 Home  + XP-SP3 Pro + Ubuntu 10.04 LTS  + Ubuntu 8.10 + PCLinuxOS 2010  Gnome and PCLinuxOS 2010  KDE]

After all this, I figured I'd actually give Sandboxie a try.  My initial impression is darn good.  It adds a second or two to my browser starting up but then it behaves normally.

I'll play with it further.

Best Regards,
Manny Carvalho
MS-MVP Windows 

Your donation to this site is greatly appreciate

Manny


After all this, I figured I'd actually give Sandboxie a try.  My initial impression is darn good.  It adds a second or two to my browser starting up but then it behaves normally.

I'll play with it further.

Hi Manny

Good for you.   If you buy the license, and can use forced programs, then you will really see the power of this  little fellow.

Pete

Purchased license yesterday, no more nag screens, yay.
$1000.00 jackpot from my "friendly neighborhood" Casino help pay for the license, again yay.



Anything I should know about the paid version?

Frank Golden
Acer Aspire 5672WLMi, 2 GHz Core 2 Duo, 500GB HDD, 4GB DDR2 ram, ATi X1400  [Win 7 Home  + XP-SP3 Pro + Ubuntu 10.04 LTS  + Ubuntu 8.10 + PCLinuxOS 2010  Gnome and PCLinuxOS 2010  KDE]

fjgold


Purchased license yesterday, no more nag screens, yay.
$1000.00 jackpot from my "friendly neighborhood" Casino help pay for the license, again yay.



Anything I should know about the paid version?

Hi Frank

Only that it's better then the free version.   Best thing is you can set up forced programs, so you can make all your browsers forced, and then just use the regular icons.

You can create separate sandboxes for each browser and tailor it to your liking.   I restrict what can run in the different sandboxes and also restrict what can access the internet.

The only other thing is the more you play with it the more you will like it.

Pete