Sandboxie-Recommended Settings

I have been trying the latest version of Sandboxie for about one week now (unregistered). The only setting that I have changed is to delete the contents of the default browser sandbox on program closure. What I plan to do is to use Sandboxie for general web surfing. If I need to download something from a reputable website I will use an unsandboxed browser. What other Sandboxie recommended settings changes should be made for "user friendly" safe web surfing?

Thank you.

 

Give Internet Access only to your default browser. This can be found in Sandbox Settings -> Resource Access -> Internet Access.

If you download a trojan in the sandbox and it tries to connect, Sandbox will not allow it.. I guess.

Of course a firewall would probably stop it, but since the setting is there, go for it.

 

I guess there is a need for more restrictions in case of possible browser hijack.

 

To protect against keyloggers (courtesy of Blackcat)...

What you can do is use ProcessGroups in conjunction with special closedpaths, and it will block anything other then the files you've specified from running sandboxed.

For example, assume that you are using firefox as your browser. The lines to add are these:

1- In Sandbox Control, click...

Configure > Edit Configuration

2- Under Global settings, add:

ProcessGroup=<restricted>,Start.exe,SandboxieDcomLaunch.exe,SandboxieRpcSs.exe, firefox.exe

3- Then under DefaultBox (or any of your other boxes) add:

ClosedFilePath=!<restricted>,*
ClosedIpcPath=!<restricted>,*

That will block everything other then the processes in the "restricted" processgroup from running. Thus, if the browser downloaded a keylogger to the sandbox and tried to execute it, it would just fail since the process is not listed in the processgroup above.

BUT make sure that you add your own processes to the processgroup listed above -- as I did with firefox.exe in the above example.

 

You don't need both of those.

 

Its a kind of redundancy to add both,Wraihtdu who came up with these lines,initially added only ClosedFilePath=!<restricted>,*. which should be enough.
Also look at the long thread over at Sandboxie forums.

 

Yeah I know that. That's why I made that post. I'm using ClosedIpcPath=!<restricted>,*

 

In addition to the above, I also use Sandbox Settings > Resource Access > File Access > Blocked Access to keep any sandboxed malware (e.g. keyloggers) from accessing my personal files.

 

Bell where do I add this in the notepad settings Do I add it anywhere or in a certain spot

 

Here are my settings, which enable firefox.exe to run in the sandbox, as well as sandboxie itself, and NOTHING else.

For purposes of illustration, I have used a larger print for the added settings, so as to distinguish them from the other settings.

 

I'm still new at this. Isn't another way of protecting against keyloggers by (1) opening Sandboxie Control, (2) click View and then Programs, (3) select the applicable sandbox (if more than one appears), (4) right-click the program...e.g. Internet Explorer or Firefox, (5) select Program Settings, and (6) click "This program is the only program in this sandbox that can access the internet"?

 

Yes that's a way, but with this settings you also make sure that the keylogger (or any other executable) can't even run in the sandbox.
Better than having a keylogger being unable to send data, is don't even allow it to run.

 

Mr Belgamin explained just that why this setting is vulnerable.

 

Thanks for the clarification. I'm still learning.

So if I make a sandbox to use when I conduct online banking and want to make it more robust than the default sandbox, it sounds like the way to go is to add the settings indicated in bellgamin's post. If I screw something up with the settings during that process, am I correct in assuming I can simply delete that sandbox altogether, the messed up settings associated with that sandbox will be deleted as well, and I can try again?

 

If there's no defaultbox anymore so their config is gone,but global settings stay but have no effect on other boxes because there are no added closed paths in the config. file

 

Huupi, bear with me. Not too sure I completely understand your response.

Let's say I have two sandboxes...one is my default box and the other is my online banking sandbox. Let's also assume I'm happy with the default box settings and haven't changed them, but I have added bellgamin's anti-keylogger settings to the online banking sandbox. Finally, let's assume I've screwed something up in the process of adding bellgamin's settings to the online banking sandbox (because I'm not a programmer or that computer-savvy). Are you saying it's no big deal because deleting altogether the online banking sandbox will also remove those messed up settings...and the default sandbox and its settings remain untouched?

 

Yes,all other boxes remain untouched,only in the config .ini file you will see that online sandbox settings are gone if you delete this sandbox.

 

Appreciate it. Thank you.

 

I got this to run good in Firefox and Opera, but not in IE. I assume it works in IE and is good to have there too right? If so, anyone got this to work and wouldn't mind sharing their config?

dja2k

 

If you talk about those "hard" settings then IE required that SandboxieCrypto.exe is also added to ProcessGroup.

 

What about adding these lines to the ini? What do these do?


ClosedFilePath=!<restricted>,\Device\RawIp
ClosedFilePath=!<restricted>,\Device\Ip*
ClosedFilePath=!<restricted>,\Device\Tcp*
ClosedFilePath=!<restricted>,\Device\Afd*

 

They forbid that anything outside the "restricted" group connect to the internet.

 

Aren't these redundant while using the other two ClosedFilePath=!<restricted>,* and ClosedIpcPath=!<restricted>,*?

dja2k

 

Yes, I think they are redundant.

Personally, in my sandbox for firefox, I have the "execution prevention" enabled so that only firefox and pdf x-change viewer can run, because I do open and download a lot of pdf's for university. But only firefox can conect to the internet.

If you wan't to allow internet access to the same group that is allowed to run, it's redundant.... if it can't run, it can't connect