Found Security Compromise in Sandboxie

Okay then. I actually doubt that I would be worried about it.. I also read though that you can disable something....file system history or something like that? Maybe that would prevent anything from being saved.

 

I think think whats happening here is Sandboxie is so highly regarded,people get nervous when something gets out or has looked to be a security Hole,now if we where talking a Antivirus people exspect a miss or a FP on occasions and may not get so exicited about it.All software has limitations and nothing is a 100 percent.IMO just keep a good hips/Behavior blocker or AV to keep an eye on things just in case and relax and enjoy.

 

Depending on your system is where it is. XP is right click on toolbar, properties, start menu, customise, advanced, uncheck on the bottom - List my most recently opened documents.

 

On vista right click toolbar and select properties.

 

yes thats what I ment, my wording was not so good.When they think it was breeched it was not and it was the user error in most cases but then blame sandboxie is not doing its job.However what i was trying to get at it seems like for some its o my god sanboxie failed,I can not believe it.I put Sanboxie on the pedstal to protect me but my common sense tells me do not be to disapointed If it fails or perhaps I Failed.

 

I guess there are some that really like Sandboxie, and others just can not stand that. I don't mind a new user making an error and posting about it .... but then a seasoned member jumps in and starts with "I've been saying this forever. That sandbox stuff isn't going to be secure." Using as his total basis, that new users incorrect conclusions. Which proves that he himself either does not know the program he is commenting on, or is willing to lead that new user down some false path of misunderstanding.

 

Some are saying this is a "privacy issue" and Sandboxie is designed to prevent "security issues."

From the front page at www.sandboxie.com:

Benefits of the Isolated Sandbox


Enhanced Privacy: Browsing history, cookies, and cached temporary files collected while Web browsing stay in the sandbox and don't leak into Windows.

Read the above claim again. "stay in the Sandbox and don't (sic) leak into Windows." There's not too many ways to read that. That claim is apparently simply not true.

Not trying to throw fuel on the fire, but while Sandboxie is obviously sold as a security tool, it is also clearly marketed as a privacy tool, and leaking the names of video files hardly lives up to that claim.

My .02.

 

@Gerard Morentzy
That is true if you keep the files in the sandbox but the OP says he recovered it to his desktop,

So it wasn't kept in the sandbox.

 

Gizzy, Read my post again. That was my point.

 

Oh sorry,
My mistake

 

The user intentionally recovered it from the sandbox to his real desktop. Where is a leak?

 

What post from the OP are you referring to? It doesn't sound that way to me. It sounds like Windows reported some MRU references that should have been sandboxed. If you think that's a "windows problem" I refer you to the Sandboxie home page where I referenced in a post above Sandboxie stating, "Browsing history, cookies, and cached temporary files collected while Web browsing stay in the sandbox and don't (sic) leak into Windows."

 

The claim cited on Sandboxie's front page is true unless the user intentionally recovers the file onto his/her real system.

As noted here http://www.sandboxie.com/index.php?RecoverySettings#quick
the recovery feature is a tool to facilitate the former, and more cumbersome process, of manually extracting files from C:\Sandbox whenever a user wanted to install those files onto the real system. IMO, anyone choosing to do that should understand the need to be careful since they are moving stuff outside the Sandboxie's protection. In that context, I don't think the quote on Sandboxie's front page is inaccurate.

 

The opening post;

 

Did you even read the opening post? there is nothing about Mru registry items. The OP specifically stated;

So..... it's a Lnk (shortcut) in the "Recent" folder. Sandboxie did not make that, Windows did.

 

Yes, I am asked if I want to save the mpeg, and I said yes and saved it to Desktop.

But it never asks me, or informs me that the filename will also be written OUTSIDE of the Sandbox into :

C:\Users\Tony\AppData\Roaming\Microsoft\Windows\Recent\Horizon-14-Nighttime-2.mpeg.lnk 565 bytes

 

Recover the file?

 

Of course it's a privacy issue and not a good one at that.

What good is the "Sandbox" when things are getting written all over the place OUTSIDE the Sandbox.

I saved a file from a Sandbox session to Desktop, so why on Earth does it allow writing to: C:\Users\Tony\AppData\Roaming\Microsoft\Windows\Recent?

That is a real serious privacy breach, as the filename is written outside the box and desktop that I asked for a file to be saved to.

This raises other concerns... where else are things being written to?

 

I do not mean to be rude, but you should read the help file first before using an application. The "Desktop" is one of the places where Sandboxie can ask you to recover the file after it has been downloaded into the sandbox. Like others have said, the quick recovery makes it easier for someone to move a file from the sandbox to the real system. Doing so, however, places the file outside of Sandboxie's protection since it is not in the sandbox anymore. Hence, Windows immediately created a .lnk file that refers to the file you just saved to your desktop.

 

1. What I do inside the Sandbox should remain inside the Sandbox. And if I ask to save a file to Desktop using Sandbox, then that is all there should be, a single file written to Desktop, not written all over the hard drive where it breaches my privacy and does so without informing me. That makes Sandbox really silly IMHO.

2. Why do you have a reputation for becoming abusive when you feel threatened in your comfort zone? Your way to deal with life issues is to abuse anyone who threatens your security, you act like a child. Please grow up!

 

Use Sandboxie and then download a mpeg file from any website and save it to Desktop.

Then when it asks you, choose "Recover from Same Folder" to keep a copy on your Desktop.

Then cleanout Sandboxie and you will find traces of that mpeg file all over your hard drive.

This proves Sandboxie is flawed and a privacy breach!!!

And what's interesting, even the download box is showing being sandboxed, yet it still saves information OUTSIDE the sandbox. Not good at all. And this raises serious concerns... if Sandbox fails in this, what else is it doing in the background and where else is it allowing information to be written?

 

Short answer: no, it is not flawed based on your situation.

Long answer: read my post above.