A Sandbox prog?

A sandbox is a metaphor for executing a program within a restricted or protected environment on your system. When a program runs under the control of a sandbox application, it no longer communicates freely (unrestricted) with the OS or other processes on the system, but rather all its interactions are filtered through the sandbox application. A sandbox is sometimes referred to as an application layer firewall because it allows you to set rules to control the interactions between a program and the rest of the system much like setting access rules in a network layer firewall. A good sandbox can give you control of every system call, file or device access, or any functions or services accessed by a program.

A program that is restricted by such an application is said to "run in a sandbox", under the controls and within the limits that you configure with the specific sandbox application. Tiny Personal Firewall (TPF) is based upon a sandbox. I myself use the previous version, Tiny Trojan Trap which was available as a separate product less than a year ago.

To truly understand the function and capabilities of a sandbox, you really need to see what all it can monitor and control. Take a look at this thread which details many of the capabilities of the Tiny Trojan Trap sandbox. Seeing what controls are possible with a specific sandbox app should make more clear what such an application is and does.

 

No, they are actually very different. An anti-virus scans a file prior to access looking for either known malware (checking by signature) or for patterns that are suspicious (checking by heuristics), but after it is done scanning, an AV program allows the file to be accessed normally if it isn't flagged as malware. If that file is an executable, it will run normally with no further intervention by the AV and an AV places no limitations on what that EXE can do when it runs so long as it scanned clean at access time.

A sandbox doesn't scan files at all. It simply enforces the set of rules defined for an executable whenever that EXE runs. Those rules are enforced for the entire time the EXE runs and for whatever functions and accesses are being controlled by the sandbox.

A simple example of the controls added by a sandbox would be seen in the case of sandboxing Internet Explorer (as I've done with TTT on my XP system). IE is restricted from writing to any location on my file system except for a specific list of directories I've allowed. Also, IE is not allow to write anywhere in the Windows registry on my system, except for a few keys that belong to IE itself. There are a lot more restrictions in place, but these two clearly point out the power of a sandbox...

Because of the Tiny sandbox configuration on my system, IE is completely restricted to being "just a browser". All of it's special Windows integration (thanks Microsoft ) is totally meaningless because the sandbox prevents it from being able to do anything other than what I allow it to do in the rules set in place for IE. It is as if IE were just any other browser because of these restrictions placed upon it.

 

Using sandboxing technology to assess whether a program is malware is still very different than having a general purpose sandbox installed where you control all the access rights and levels yourself, program by program. So no these are not the same though they use some similar technology under the hood. (I'd call Norman an anti-virus that uses a special purpose sandbox for diagnostic benefits.)

 

A Java Virtual Machine environment is just another example of a sandbox concept. Again, it is a different implementation but the same concept. If the sandbox is secure, the idea is to keep the Java code contained and controlled within the limits of that particular sandbox. If it works it will keep it from gaining undue privileges and access rights to the rest of the system. Unfortunately, there have been some flaws in some of these in the past which allowed the program to escape some of the sandbox restrictions.