"A Virtually Secure Browser" by Seth Misenar

ssj100 · Oct 4, 2009

The goal of this paper will be to provide a very brief exploration of different attack vectors affecting web browsers, and then to posit a better method for securing, and maintaining the security of browsers through virtualization.
Click to expand...

http://www.sans.org/reading_room/whitepapers/hsoffice/rss/a_virtually_secure_browser_33124

Doodler · Oct 4, 2009

ssj100 said:

I'd just like to mention that I'm noticing a very familiar and constant trend in these articles/reviews of Sandboxie.

I think I got the same impression when Matt (from remove-malware.com) posted his video review of Sandboxie.

They all seem to neglect one aspect of Sandboxie - it isn't just about a creating "sandbox" for your various applications. It can also act as an extremely powerful "anti-executable" and "firewall" within that sandbox.

I think perhaps a lot of new users and people who don't think much of Sandboxie fail to recognise this aspect. Just think how secure your browsing session would be if nothing can start/run or access the internet except iexplore.exe? Then with this concept in mind, add in the fact that all your browsing takes place in a virtualised environment too! And there's no need to restart your ENTIRE system to get rid of any malware that falls into your sandbox - you simply empty the sandbox and carry on!

When I first discovered Sandboxie, I found these 2 concepts (restriction + virtualisation) mind-blowing...I'd never come across such security measures before, and I'd certainly never come across anything so powerful. To this day, I don't think the combination of these 2 concepts (when applied appropriately) has been bypassed since the incarnation of Sandboxie.
Click to expand...

Agreed.

wat0114 · Oct 4, 2009

ssj100 said:

They all seem to neglect one aspect of Sandboxie - it isn't just about a creating "sandbox" for your various applications. It can also act as an extremely powerful "anti-executable" and "firewall" within that sandbox.
Click to expand...

Yes, the author completely missed this important security feature of SandBoxie. However, it seems he's more interested in a solution that benefits enterprise environments, where a virtualization application can be centrally managed, and this is where Thinapp excels, albeit at a much greater cost.

andyman35 · Oct 4, 2009

ssj100 said:

I'd just like to mention that I'm noticing a very familiar and constant trend in these articles/reviews of Sandboxie.

I think I got the same impression when Matt (from remove-malware.com) posted his video review of Sandboxie.

They all seem to neglect one aspect of Sandboxie - it isn't just about a creating "sandbox" for your various applications. It can also act as an extremely powerful "anti-executable" and "firewall" within that sandbox.

I think perhaps a lot of new users and people who don't think much of Sandboxie fail to recognise this aspect. Just think how secure your browsing session would be if nothing can start/run or access the internet except iexplore.exe? Then with this concept in mind, add in the fact that all your browsing takes place in a virtualised environment too! And there's no need to restart your ENTIRE system to get rid of any malware that falls into your sandbox - you simply empty the sandbox and carry on!

When I first discovered Sandboxie, I found these 2 concepts (restriction + virtualisation) mind-blowing...I'd never come across such security measures before, and I'd certainly never come across anything so powerful. To this day, I don't think the combination of these 2 concepts (when applied appropriately) has been bypassed since the incarnation of Sandboxie.
Click to expand...

Very true,most reviews seem to focus on just the one aspect of SBIE without really explaining it's wondrous depths.

Kees1958 · Oct 5, 2009

ssj100 said:

I'd just like to mention that I'm noticing a very familiar and constant trend in these articles/reviews of Sandboxie.

I think I got the same impression when Matt (from remove-malware.com) posted his video review of Sandboxie.

They all seem to neglect one aspect of Sandboxie - it isn't just about a creating "sandbox" for your various applications. It can also act as an extremely powerful "anti-executable" and "firewall" within that sandbox.
Click to expand...

About SRP

Most system managers use a Software Restriction Policy for deny execute. With numerus search results on SSJ+LUA+SRP, I trust you are familiar with that concept.

About Sandboxie

Another reason not mentioned is that the author obviously is happy with the web 3.0/cloud re-incarnation of the 'thin client' concept. Only we seem to be stuck with fat PC's with no smartcard/biometric based security and 'travelling user profiles'.

Maybe he hopes that Intel and Google might cause some stir with their new 'lean' OS-ses. Maybe he hopes that netbook and notebook producers (which are marketing biometric access as a additional feature) will push desktop producers to offer the same. So maybe he dreams of some sort of biometric access on lean os-ses with Web 4.0/cloud 2.0, where ordinary PC users do not store data on their home PC, but have it secured and accessible from the cloud.

In anticipation of this dream Thin-Appp is the best choice in corporate environments, because it fits in just perfect in the centrally managed thin client dream revived. SBIE-fans: I would not worry to much

About Chrome/Iron
It really it is a pity the reviewer did not go deeper on the added security of the Chrome/Iron browser in a x64 environment (since SBIE will not be released on x64).

Regards Kees

wat0114 · Oct 5, 2009

ssj100 said:

Regardless, why not have the best of both worlds and use Sandboxie as well as LUA + SRP? It can work flawlessly, so why not? This way, if anything bypasses Sandboxie (which is yet to happen, when appropriate restrictions are in place), it will be blocked by SRP.
(Note that in reality, SRP jumps to the action before Sandboxie when it comes to "anti-executable" functioning).
Click to expand...

I tend to agree with this, because I'm having difficulty finding virtualizing/sandboxing software that matches the level of security SB provides while matching SB's minimal footprint on system resources. IMO, Shadowdefender is the only product I've tested that comes close.

jmonge · Oct 5, 2009

wat0114 said:

I tend to agree with this, because I'm having difficulty finding virtualizing/sandboxing software that matches the level of security SB provides while matching SB's minimal footprint on system resources. IMO, Shadowdefender is the only product I've tested that comes close.
Click to expand...

did you try DefenseWall?it may not be same but similar product and it is good program

wat0114 · Oct 5, 2009

jmonge said:

did you try DefenseWall?it may not be same but similar product and it is good program
Click to expand...

Yes. Actually twice, one of the trials on my VirtualBox setup, both cases XP, and it's a great program at what it does, no doubt, but unfortunately it causes very noticeable sluggishness on my browsing speeds.

jmonge · Oct 5, 2009

wat0114 said:

Yes. Actually twice, one of the trials on my VirtualBox setup, both cases XP, and it's a great program at what it does, no doubt, but unfortunately it causes very noticeable sluggishness on my browsing speeds.
Click to expand...

that is good it is fast here

Ilya Rabinovich · Oct 5, 2009

wat0114 said:

Yes. Actually twice, one of the trials on my VirtualBox setup, both cases XP, and it's a great program at what it does, no doubt, but unfortunately it causes very noticeable sluggishness on my browsing speeds.
Click to expand...

Strange, it shouldn't be like that.You had to call for support this case.

wat0114 · Oct 5, 2009

Ilya Rabinovich said:

Strange, it shouldn't be like that.You had to call for support this case.
Click to expand...

I'm quite adventurous, so I'll give it a whirl on my Vista system and post how things went.

jmonge · Oct 5, 2009

ssj100 said:

That's very strange. This is a classic example of different programs having different side effects on different systems.

For me, neither DefenseWall nor Sandboxie cause ANY sluggishness on browsing speeds.

For wat0114, DefenseWall causes sluggishness.

For jmonge (he PM-ed me about it haha), Sandboxie causes sluggishness.

I guess I'm just thankful that I'm not limited by browsing sluggishness when it comes to choosing between Sandboxie or DefenseWall.

Please also keep in mind that Sandboxie and DefenseWall are two very different programs. Sure, they may apply a similar concept, but the biggest difference is that DefenseWall allows everything to take place on the REAL system, while Sandboxie does it in a VIRTUALISED sandbox. Furthermore, I'm not sure if DefenseWall has any "anti-executable" functioning either.
Click to expand...

i want to mention that i didnt choose sandboxie cause the browsing slow down only but i personally prefer DefenseWall over all preference choice

Log in or Sign up

"A Virtually Secure Browser" by Seth Misenar

ssj100 Guest

Doodler Registered Member

wat0114 Guest

andyman35 Registered Member

Kees1958 Registered Member

wat0114 Guest

jmonge Registered Member

wat0114 Guest

jmonge Registered Member

Ilya Rabinovich Developer

wat0114 Guest

jmonge Registered Member

Log in or Sign up

"A Virtually Secure Browser" by Seth Misenar

ssj100 Guest

Doodler Registered Member

wat0114 Guest

andyman35 Registered Member

Kees1958 Registered Member

wat0114 Guest

jmonge Registered Member

wat0114 Guest

jmonge Registered Member

Ilya Rabinovich Developer

wat0114 Guest

jmonge Registered Member

Useful Searches