SafeSpace Beta [Archive] - Wilders Security Forums

Tidyup

August 6th, 2007, 04:23 AM

Hi all.

I'd like to let you know about a new HIPS product which launched last Friday.

SafeSpace has been developed by Artificial Dynamics (http://www.artificialdynamics.com), and is currently under a Beta trial. The Beta itself can be found HERE (download.com) (http://www.download.com/SafeSpace/3000-2239_4-10720058.html?tag=lst-0-1).

SafeSpace is a sandbox technology which isolates internet applications in a virtual environment, protecting both your computer from malware infection, and also your private data from theft. It configures itself once installed, automatically adding protection to common internet applications and locking down your private data. For more information, please visit our website.

SafeSpace supports Windows XP SP2 and Vista 32-Bit editions. The installation also includes all the additional pre-requisite software it requires.

SafeSpace is a free product for personal use, and is the result of 3 years of development. I'd like to invite you all to try our software and feedback any comments you may have, using the beta feedback form. (http://www.artificialdynamics.com/content/support/beta-feedback.aspx)

Many thanks,

Kris.
Artificial Dynamics.

stapp

August 6th, 2007, 08:10 AM

Strange, your site doesn't show up in my opera tab bar

LUSHER

August 6th, 2007, 08:47 AM

That's because the web page has a blank title. :D

WilliamP

August 6th, 2007, 09:08 AM

How do you get into and out of the SafeSpace?

stapp

August 6th, 2007, 09:14 AM

The address bar shows where I went to, but the opera tab bar shows it as blank.

Tunerz

August 6th, 2007, 09:56 AM

So it is somewhat nearly the same on how Sandboxie does its job a.k.a. simple procedures?

LUSHER

August 6th, 2007, 10:08 AM

Yeah it's similar to Sandboxie but a lot slicker, easier to configure what files/folders to give read only, totally blocked access etc.

It reminds me a lot of BufferZone actually, with the red border around virtualized apps and files.

Feature wise looks quite impressive.

LUSHER

August 6th, 2007, 10:14 AM

-{ Quote: "The address bar shows where I went to, but the opera tab bar shows it as blank." }-

Of course the address bar shows where you where to. The url exists obviously.

Here's part of the source..

<title>

</title></head>
<body>

As you can see the title of the page is blank. Normally Your tabs will display whatever it is titled e.g "Very lousy page".

With Firefox it tries to show the title of the web page, but if it does not exist it will display the url. In this respect Opera might be not as good since it doesn't fall back to the url if the title is blank or missing.

stoppit

August 6th, 2007, 10:21 AM

-{ Quote: "The address bar shows where I went to, but the opera tab bar shows it as blank." }-

Thanks for pointing this out. It will be fixed soon.

stoppit

August 6th, 2007, 10:22 AM

-{ Quote: "How do you get into and out of the SafeSpace?" }-

Hi WilliamP.

Are you referring how you run applications inside and outside of SafeSpace?

Thanks.

Kris.

glentrino2duo

August 6th, 2007, 10:27 AM

Three years of development and is now in beta?

LUSHER

August 6th, 2007, 10:35 AM

Hmm the "purge safespace" option only terminates processes running in safespace? It doesn't clear the virtualized files?

How do you do that?

stoppit

August 6th, 2007, 10:50 AM

-{ Quote: "Hmm the "purge safespace" option only terminates processes running in safespace? It doesn't clear the virtualized files?

How do you do that?" }-

Hi Lusher.

Purge does remove all virtualized file and registry content. However, it doesn't remove files which you downloaded and stored in private areas - these files are highlighted with a red border (or a red SafeSpace logo on Vista).

This allows you to store downloaded files in any private folder without having to explicitly manage them any differently. SafeSpace ensures that whenever you open or view these files, they always open inside SafeSpace.

Thanks.

Kris.

LUSHER

August 6th, 2007, 11:31 AM

Ah I see.

So if a program i run in spacezone creates a file in a area not marked virtualized (c:\program files etc by default) it will still remain even after purging?

Still Would be a nice feature to be able to remove even those files (which are marked in red borders), so one can go back to totally clean state..

stoppit

August 6th, 2007, 11:40 AM

Many thanks for the feedback - a good suggestion.

WilliamP

August 6th, 2007, 11:54 AM

My question should have been. Does it require re-boot to get in and out?

zopzop

August 6th, 2007, 12:00 PM

looks interesting (actually it sounds almost exactly like geswall except with the red borders around the program windows). i wonder how it would do against things like killdisk, keyloggers (for example, can programs running inside the safespace log keystrokes of programs running outside the safespace) and process terminators (can a program running inside safespace shutdown a program running outside safespace).

Tidyup

August 6th, 2007, 12:03 PM

-{ Quote: "My question should have been. Does it require re-boot to get in and out?" }-

The initial installation requires a reboot, but after that, no further reboots are required for any of the features of SafeSpace (adding / removing application from SafeSpace control, purging, etc).

You can also change all configuration settings on the fly and they are applied instantly.

Hope this answers your question.

Kris.

WilliamP

August 6th, 2007, 12:15 PM

Thank you for the reply. Right now I have Returnil which requires re-boot. I am interested to know if SafeSpace is as secure as Returnil.

Rasheed187

August 6th, 2007, 12:22 PM

I´m not sure yet about how it works exactly, but seems to be a better version of BufferZone, I like the fact that it runs quite smootly. But it isn´t like Sandboxie where you can easily install apps in the sandbox, it´s more like a realtime protection tool for the browser, but files downloaded will show up in the "real" file system, but still protected by SafeSpace, correct? :)

Tidyup

August 6th, 2007, 12:30 PM

-{ Quote: "looks interesting (actually it sounds almost exactly like geswall except with the red borders around the program windows). i wonder how it would do against things like killdisk, keyloggers (for example, can programs running inside the safespace log keystrokes of programs running outside the safespace) and process terminators (can a program running inside safespace shutdown a program running outside safespace)." }-

KillDisk
SafeSpace blocks all IPC and kernel interaction with the system, through virtualization of IPC communications and by removing administrative rights from SafeSpace protected applications.

Because of this, I could not use KillDisk inside SafeSpace.

Of course, please let me know if you do find a way of enabling KillDisk functionality inside SafeSpace.

Keyloggers
We have already added protection against several keylogging techniques, and we are continuing to research this area as an ongoing project. If you do find any products or methods which do manage to log keystrokes inside SafeSpace, please let us know either by posting here, or submitting it via our Beta Feedback Form (http://www.artificialdynamics.com/content/support/beta-feedback.aspx)

Process Termination
As with keyloggers, we have already added protection against numerous process termination techniques, and we are actively investigating any others we find. Please let us know if you do find a technique which works in SafeSpace.

Thanks.

Kris.

combo

August 6th, 2007, 02:04 PM

how about cpu usage ? ;D

zopzop

August 6th, 2007, 03:52 PM

well curiosity got the best of me and i downloaded and gave this program a whirl. it looks very nice and runs smoothly on my laptop (1.8ghz amd processor with 512 megs of ram windows xp sp2). installation went through with zero problems and so far it seems glitch free.

after getting a feel for safespace i put it through some tests :

for testing i made sure the testing app was safely inside safespace and the target of the tests was outside safespace

test 1) http://www.diamondcs.com.au/freeutilities/apt.php
advanced process termination test by diamondcs. safespace failed kill 6 only. it passed the others.

test 2)http://www.syssafety.com/leaktests.html
simple keylogger test and simple process termination test by the makers of system safety monitor. i couldn't get either of these tests to run, i got a message back saying "access denied". so i don't know how safespace would fare against them.

test 3) martin's undetectable keylogger test - safespace passed easily. martin's was unable to log any alphanumeric keys.

test 4) http://www.trustware.co.il/TrojDemo.exe
trojdemo.exe from the makers of bufferzone - it seems safespace failed this test. trojdemo was able to read the contents of mydocuments despite safespace's "no access" setting.

test 5) http://firewallleaktester.com/aklt.htm
Anti-Keylogger Tester 1.0 - safespace passed all tests except the directx one.

test 6) http://ghostsecurity.com/registrytest/
ghostsecurity's regtest, safespace passed both tests. no changes were made to the registry. BUT the second test was able to shutdown explorer when it was simulating a restart. can the safespace devs look into this and see if it's possible to stop programs/applications running inside safespace from shutting down explorer? so far geswall is the only sandboxing app that manages to stop this test from shutting explorer down.

edited to include results of ghostsecurity test.

aigle

August 6th, 2007, 04:42 PM

Killdisk! Killdisk! I wonder how it will do!

A big download by the way!

LUSHER

August 6th, 2007, 04:43 PM

It passes killdisk, as already mentioned. yes, I verified it too. Happy?

Why this obession with killdisk???

solcroft

August 6th, 2007, 04:58 PM

-{ Quote: "Killdisk! Killdisk! I wonder how it will do!

A big download by the way!" }-
Do try against some of the kernel unhooker malware. I'm wondering how it'll fare against them. ;D

Thermodynamics quiz complete... off to sleep... zzz... I hate my lecturer...

Tidyup

August 6th, 2007, 05:27 PM

-{ Quote: "
test 1) http://www.diamondcs.com.au/freeutilities/apt.php
advanced process termination test by diamondcs. safespace failed kill 6 only. it passed the others.

test 4) http://www.trustware.co.il/TrojDemo.exe
trojdemo.exe from the makers of bufferzone - it seems safespace failed this test. trojdemo was able to read the contents of mydocuments despite safespace's "no access" setting.

test 5) http://firewallleaktester.com/aklt.htm
Anti-Keylogger Tester 1.0 - safespace passed all tests except the directx one.

test 6) http://ghostsecurity.com/registrytest/
ghostsecurity's regtest, safespace passed both tests. no changes were made to the registry. BUT the second test was able to shutdown explorer when it was simulating a restart. can the safespace devs look into this and see if it's possible to stop programs/applications running inside safespace from shutting down explorer? so far geswall is the only sandboxing app that manages to stop this test from shutting explorer down.

" }-

Thank you for this feedback. I will look into these issues ASAP.

We are already aware of the DirectX Keylogger method, and this will be resolved for release.

Regards,

Kris.

Franklin

August 6th, 2007, 06:04 PM

Is SafeSpace a rebranded / reworked Bufferzone?

Iangh

August 6th, 2007, 07:45 PM

Can a tester let me know how one updates Firefox extensions using Safespace?

What's the process?

Likewise for new programmes?

Is it similar to Defensewall in that you set the programme as trusted?

I'm waiting for the more informed posters to try it a little while longer before downloading.

Thanks,
Ian

Tidyup

August 7th, 2007, 04:14 AM

-{ Quote: "Is SafeSpace a rebranded / reworked Bufferzone?" }-

No. As I mentioned, we have been developing SafeSpace for over 3 years.

Tidyup

August 7th, 2007, 04:22 AM

-{ Quote: "Can a tester let me know how one updates Firefox extensions using Safespace?

What's the process?

Likewise for new programmes?

Is it similar to Defensewall in that you set the programme as trusted?

I'm waiting for the more informed posters to try it a little while longer before downloading.

Thanks,
Ian" }-

Firefox extensions will install inside SafeSpace. However, because the Firefox installation directory is virtualized, any extensions which are added, will be wiped when you next purge (or log off).

If you want to install extensions for more permanent use, there are two options:

1. Temporarily run Firefox outside SafeSpace - this can either be done from the console, or by right clicknig the SafeSpace icon in the Systray.

2. Temporarily add the Firefox installation directory to the Privacy Page as Full Access, allowing SafeSpace to make changes to the real directory. Again, changes to the Privacy settings are dynamic, and are immediately enforced.

Regarding new programs you would like to protect with SafeSpace, you simply add them to the list in the Applications Page. SafeSpace intercepts them being launched from then on and always runs them protected.

I hope this answers your question.

Regards.

Kris.

Artificial Dynamics.

Iangh

August 7th, 2007, 04:37 AM

Thanks, Kris

I'll give it a go.

First, Derby, now, Warrington.

UK software companies are popping up in unusual places :).

Ian

Meriadoc

August 7th, 2007, 04:41 AM

Hi Kris looks interesting, having a look now:) ...big download.

Tidyup

August 7th, 2007, 04:59 AM

-{ Quote: "Hi Kris looks interesting, having a look now:) ...big download." }-

It includes all the pre-requisite software required, which accounts for the bulk of the download.

Zero3K

August 7th, 2007, 10:46 AM

I think that the installer should just contain the actual program. When ran, it should download and install the required components if they're not already installed.

osip

August 7th, 2007, 11:31 AM

Had to revert my system...Installed and rebooted OK,did´nt detect opera browser which I manually added, after this when rebooting I fell in endless reboot cycle at the end of win:s boot process...Probably some compatibility issue, I have Returnil but with protection off...maybe that´s the problem...

Tidyup

August 7th, 2007, 11:47 AM

-{ Quote: "Had to revert my system...Installed and rebooted OK,did´nt detect opera browser which I manually added, after this when rebooting I fell in endless reboot cycle at the end of win:s boot process...Probably some compatibility issue, I have Returnil but with protection off...maybe that´s the problem..." }-

Hi Osip.

Thanks for highlighting this issue. I'll run some tests with Returnil.

For your info, the list of applications detected automatically by SafeSpace is minimal for the Beta (Firefox, Internet Explorer, Windows Live / MSN messenger) but in future releases we will be expanding the list to include all of the commonly used browsers, messengers and file sharing/P2P applications.

Best regards,

Kris.

Artificial Dynamics.

osip

August 7th, 2007, 04:46 PM

-{ Quote: "Hi Osip.

Thanks for highlighting this issue. I'll run some tests with Returnil.

For your info, the list of applications detected automatically by SafeSpace is minimal for the Beta (Firefox, Internet Explorer, Windows Live / MSN messenger) but in future releases we will be expanding the list to include all of the commonly used browsers, messengers and file sharing/P2P applications.

Best regards,

Kris.

Artificial Dynamics." }-

Thanks for your answer,Kris...I really liked the approach of safespace,before I try again I need to know if Returnil was the problem or not...Another thing(actually I installed 2 times) I discovered was a problem with Admuncher, what´s your recommendation concerning this app, the whole app folder to trusted ?

handshakes...

dogma

August 8th, 2007, 08:17 AM

Hi all

Any reasons why I should replace GESwall FREE with this new (seems to be unlimited) program?

I see that the personal edition is not limited, unlike Geswall free, and does detect (without any configuration) IM's and p2p software (soon) out of the box?

Thanks in advance.

zopzop

August 8th, 2007, 12:37 PM

-{ Quote: "
I see that the personal edition is not limited, unlike Geswall free..." }-

well for one thing geswall free still allows you to right click and run isolated any app you want to. geswall free/paid has been put through many nasty tests and passed them, both from users of this board and from av-comparatives.

not to mention safespace is still in beta form and we don't know what features will remain after the final version is released or if it will even be free for personal use after the full version comes out.

all i'm saying is, if safespace is still free for personal use after the final version comes out (hell even a free version with some features missing) i'd still not hesitate to install it or recommend it to others. i'm LOVING safespace so far and it seems like it's one of 3 programs i'd pay for, the other 2 being geswall and defensewall.

yankinNcrankin

August 8th, 2007, 08:52 PM

I have a Dell XPS200 XpProS2 fully patched with returnil installed but disabled and no other software or programs on my box other than what comes with XpProS2. Installation of this program went ok but took awhile to unpack. Rebooted. Program did some initial something then icon was visible in bottom right. Tried using the run as feature by right clicking the icon and tried to run firefox but it didnt launch. I couldnt get fire fox to run at all. Tried launching firefox using the regular .exe couldnt get it to launch. Rebooted again and tried again same result. Bummer I wanted to test this program out on a real live system but no go.

LUSHER

August 9th, 2007, 12:54 AM

-{ Quote: "well for one thing geswall free still allows you to right click and run isolated any app you want to.
" }-

I could have sworn you can do that for SafeSpace too!

EASTER

August 9th, 2007, 01:20 AM

License:Free Average User Rating: Be the first to rate this product! Downloads: 507
Requirements: Windows XP SP2/Vista
Limitations: No limitations
Date Added:August 2, 2007

One of these days i'll get around to SP2, probably when SP3 is released. I'm a little slow in catching up with the $M patch jobs. I prefer to piece together where possible my own homemade hole plugs or let security software make up for $M's gross limitations in computer-coding engineering feats.

I am however greatly inspired to find SafeSpace (beta) yet another "NEW" development in this highly popular security arena of Protection and looks like another welcome addition to take serious note of.

Welcome and All The Best For A Successful Run :)

sukarof

August 9th, 2007, 03:05 PM

I installed safespace on my Vista 32 bit. Installation went fine but I when I tried to open Internet explorer and Firefox, they just hang, wouldnt load at all, no trace of their processes in the memory. No error messages. I had to do a cold reboot and uninstall Safespace. Could this be because I installed it in a limited account?

TerryWood

August 21st, 2007, 03:32 AM

I did not realise this thread was running. I posted this yesterday under Sandboxie Returnil or SafeSpace:

"I tried SafeSpace (I use Sandboxie & Returnil) today for the first time.

Very nice & pleasing GUI. I agree with the comments voiced in other threads that its very similar to BufferZone in concept but (in my view a lot easier to use).

Installation was not good. It hiccupped then stalled in an eggcup freeze. Using task manager appeared to jog it along., but when it installed I got an error message "The connection to SafeSpace agent is down...."

I could not get it to work. Even after a repair install. Uninstallation and then reinstalling it solved the problem.

SafeSpace, DOES NOT WORK WITH KEYSCRAMBLER. So if you do on line banking ARE YOU PRPARED TO GIVE UP KEY SCRAMBLER TO USE SafeSpace.

In my case I think not.

Given GesWall BufferZone and Sandboxie (the latter works with KeyScrambler) it is difficult to see what is on offer with SafeSpace that is really different apart from an attractive GUI. Their web site is full of the usual meaningless hyperbolae.

I am still awaiting a reply from the developers!!

Finally my biggest criticism is reserved for the 35mb download which results in a 6mb install. Absolutely ludicrous.

In my view a half decent product with a lousy start.

Come on SafeSpace developers you can do better"

Terry