SANDBOXIE HIGH TECH PROTECTION

Discussion in 'sandboxing & virtualization' started by EASTER, Feb 9, 2008.

Thread Status:
Not open for further replies.
  1. aigle

    aigle Registered Member

    Joined:
    Dec 14, 2005
    Posts:
    11,164
    Location:
    UK / Pakistan
    I assume that some other sandboxes like GesWall and DefeneWall etc will not allow the installation of a BHO!
     
  2. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    20,590
    Netflix's uses internet explorer and windows media player for it's online viewing of movies. Doesn't work in the sandbox. May have to do with DRM issues.
     
  3. Rasheed187

    Rasheed187 Registered Member

    Joined:
    Jul 10, 2004
    Posts:
    17,559
    Location:
    The Netherlands
    Yes, I suppose so. That´s what I´m saying, I think it makes sense to restrict/lock down certain sandboxed processes even more, so that process execution not initiated/approved by the user, is not allowed. I think Haute Secure tries to do this.

    Btw, there is some discussion going on about malware that is actually able to recognize if it runs in a sandbox or not, this way it can try to act legit or will refuse to run at all. But I can also see advantages, for example, if a tool won´t run sandboxed, this might be an indication that something is wrong.

    And what if SBIE could actually monitor the possible dangerous behavior that a process tries to invoke (just like GeSwall)? Of course it would stay quite when "sandbox aware" malware will run, but your HIPS will not stay quite when the malware runs on your real machine! This way you would immediately know that it´s most likely to be malicious.
     
    Last edited: Feb 13, 2008
  4. Rasheed187

    Rasheed187 Registered Member

    Joined:
    Jul 10, 2004
    Posts:
    17,559
    Location:
    The Netherlands
    I never said that it wasn´t possible, but keep in mind that the driver is installed outside the sandbox, meaning that it can do whatever the hell it wants and Sandboxie can´t protect you against this. So you might want to check your configuration settings. It´s also possible that PD 2008 can function (or at least load) without driver, so perhaps the driver did not actually install?
     
  5. Huupi

    Huupi Registered Member

    Joined:
    Sep 2, 2006
    Posts:
    2,024
    just late,i will check on that tomorow.
     
  6. Ilya Rabinovich

    Ilya Rabinovich Developer

    Joined:
    Sep 13, 2005
    Posts:
    1,543
    I can say only for DefenseWall- yes, untrusted BHO/extension installation is forbidden.

    Pete, did you check it with DefenseWall? Do I need check it out by myself for its compatibility?
     
  7. Stijnson

    Stijnson Registered Member

    Joined:
    Nov 7, 2007
    Posts:
    533
    Location:
    Paranoia Heaven
    Perhaps I'm a total noob, but can someone explain what BHO means? :rolleyes:
     
  8. Cloudcroft

    Cloudcroft Registered Member

    Joined:
    Feb 29, 2004
    Posts:
    471
    Location:
    The Hill Country of Texas
    Browser Helper Object
     
  9. twl845

    twl845 Registered Member

    Joined:
    Apr 12, 2005
    Posts:
    4,186
    Location:
    USA
  10. twl845

    twl845 Registered Member

    Joined:
    Apr 12, 2005
    Posts:
    4,186
    Location:
    USA
    So does anyone know why the sandboxed browser is twice as slow to access? Can I do something to remedy it?
     
  11. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    20,590
    Hi Ilya

    No I didn't. I've set up a separate VM machine for Netflix, and I don't mess in it. Problem is they have a DRM key buried in the registry, and if you fool with it, or with the system, to much, it cuts you off and you can't watch online. Happened to me late last year, and it didn't reset until the first of the year. So consequently, I leave well enough alone, hence a separate VM machine, I don't mess with.

    Pete

    PS Sandboxie would be a problem,even if it did work, as if you deleted the sandbox, the next install would be seen as another machine, and after so many you are cutoff.
     
  12. MitchE323

    MitchE323 Registered Member

    Joined:
    Nov 22, 2007
    Posts:
    156
    Honestly, it could be any number of things. But as my earlier post suggested, you are not alone. Start with the obvious; see if IE is any different, start FF with no addons and add them back one by one. If you are using FF then disable any addons in IE. Try a quick speed test with other security ware temporarily disabled. Check task manager as to CPU and memory. This is from the first page in Tzuks' new help file;
    But I know from experiance that 'full speed' is dependant on what else is going on with the particular setup.
     
  13. twl845

    twl845 Registered Member

    Joined:
    Apr 12, 2005
    Posts:
    4,186
    Location:
    USA
    Thanks MitchE323. I want to stress that the slow down is only when FF is loading. After FF is up, it's fast as ever. I'll see if I can isolate it as you suggested. :)
     
  14. trjam

    trjam Registered Member

    Joined:
    Aug 18, 2006
    Posts:
    9,102
    Location:
    North Carolina USA
    I found 2 that work great together with Firefox.;)
     
  15. MitchE323

    MitchE323 Registered Member

    Joined:
    Nov 22, 2007
    Posts:
    156
    First check the items posted before (most likely your problem is there) and then take a look at your CPU usage. If it seems high, you might fit the scenerio discussed here; http://sandboxie.com/phpbb/viewtopic.php?t=2717&start=0 Tzuk has identified an issue that may apply in your case.
     
  16. wat0114

    wat0114 Guest

    I find FF 2.0.0.11 loads quite fast, while IE 7 is slow @ ~ 25 seconds. Once open, the browsing speed in both is fast as normal. Either way, I see it as small, inconsequential price to pay for the security Sandboxie provides.
     
  17. MitchE323

    MitchE323 Registered Member

    Joined:
    Nov 22, 2007
    Posts:
    156
    I think it is a matter that SandboxIE works better with 'pure code'. Lots of plugins and BHOs written by different authors, lots of security products by different authors, and none of them written with a 'sandbox' in mind, present issues. That's the 'diagnostic' trait I mentioned. Doctor SandboxIE is looking at your MRI and saying ..."hmmm 25 seconds to load IE?". haha
     
  18. innerpeace

    innerpeace Registered Member

    Joined:
    Jan 15, 2007
    Posts:
    2,121
    Location:
    Mountaineer Country
    When you start a browser sandboxed, it's not only loading the browser, but SandboxieRpcSs.exe and SandboxieDcomLaunch.exe. It's also loading everything it's needs in order to run the browser isolated. Also, in my case, I have the Sandboxie service disabled and it also has to start manually. I was hoping someone else would answer the question, so that's my attempt at an answer. If it's not right, someone correct me.

    innerpeace
     
  19. twl845

    twl845 Registered Member

    Joined:
    Apr 12, 2005
    Posts:
    4,186
    Location:
    USA
    My thought also. I would like to speed up start up just the same if I can.:)
     
  20. twl845

    twl845 Registered Member

    Joined:
    Apr 12, 2005
    Posts:
    4,186
    Location:
    USA
    As Tzuk says in the thread, we might have to wait for the next version for a fix. No big deal. Thanks again.:)
     
  21. wat0114

    wat0114 Guest

    Same here, though maybe in time the developer will fix this. Time will tell but in its present state it's a keeper for me.
     
  22. twl845

    twl845 Registered Member

    Joined:
    Apr 12, 2005
    Posts:
    4,186
    Location:
    USA
    I start the sandboxed FF with the desktop icon when I want to use it. Is that what you mean by manually?
     
  23. innerpeace

    innerpeace Registered Member

    Joined:
    Jan 15, 2007
    Posts:
    2,121
    Location:
    Mountaineer Country
    Yes I use an icon, but I don't have Control start at Windows boot. I like too keep a lean booting Windows. The setting is in the Sandboxie Control - Configure - Shell Integration - Start Sandboxie Control. The trade-off however is that Sandboxie probably starts up slower. I've never timed it though.

    Edit: I'm not recommending changing the setting, I do it to have less things starting up at Windows boot.
     
  24. EASTER

    EASTER Registered Member

    Joined:
    Jul 28, 2007
    Posts:
    11,126
    Location:
    U.S.A. (South)
    Odd results and very different then my own. IE loads as always with only excption is that i am approached with the IE not sandboxed prompt i set for myself on purpose. Other than that, IE loads excellent, IE6 btw, don't care for IE7 at all.

    Perhaps FF is the browser that has those hesitations, i dunno, i don;t need it nor use it. Opera is my other alternative internet source and it also runs fine.

    I certainly do allow SandboxIE control to start with windows and for good reason i might add.

    With IE theres never been a hint at all of CPU elevation so thats irrelevant for those users.

    Right now on this latest config of mine i also impliment AE + Deep Freeze as well as EQS, so the confidence and safety of surfing even dogged up sites is of no effect period.

    In fact i think i've armored this particular set up recently with as perfect enough balance against any type of risks that might be laying in wait whereever.

    If i need to download i just plug in my USB pen drive and transfer them over there.

    VMware is a complete waste for me, i go straight in the rabid dog's bin and emerge without so much as a scratch, so whats the need for it? They are not quite as dangerous as many make then out to be IMO.
     
  25. twl845

    twl845 Registered Member

    Joined:
    Apr 12, 2005
    Posts:
    4,186
    Location:
    USA
    That's my exact same set up too. I like it that way. I guess it can take credit for a lot of the slow start then. I checked the CPU usage during start of FF and it's about 25%. I uninstalled FF add on extensions one at a time and saw no difference in load up time. I guess that's just the way it is. No big deal. :)
     
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.