Sandboxie technical tests and other technical topics discussion thread

Hi Rasheed. This is why Sandboxie should not be used for testing software to figure out if the software is clean or not. Sandboxie doesnt hide itself and malware can easily tell when its running sandboxed.

In the past, I asked myself, Why doesn't malicious software run and try to infect users when it detects that its running sandboxed? The answer I come up with is that malware writers know that the chances of malware breaking Sandboxies sandbox are about 0, that's why most of the time, malware in the sandbox don't even try to run or break the sandbox and instead it become dormant.

In all the years I used Sandboxie, I never seen anything that acts like malware....running. Probably, NoScript has a lot to do with that but I am sure, I must of had something malicious downloaded automatically into the sandbox at least a few times. But never ran.

Bo

 

lol in other words they got FEAR...

 

Yep, same with many trojans!

Which reminds me, I always intended to see if anyone had adopted this into a passive defence - choosing to simulate static features of VM/sandbox environments in order to fool malware into not running.

 

Correct, but a lot of malware will not check if they run sandboxed. That's why the SBIE + HIPS combo is such a great one. I always run apps first in the virtual container to see if HIPS give any warnings about suspicious behavior. If not, I run them on my real machine. And let's say that malware tried to fool me, then the HIPS will still alert me about dangerous behavior, and you already know for sure that you're dealing with malware.

 

Correct, a lot of malware will either not run correctly or not at all. Not only because they are sandbox aware, but simply because of the isolation and restrictions. Back in the days I often tested malware inside the sandbox.

It's more because they want to make the life of malware analyzers harder. And they know the malware won't work anyway.

 

Can someone perhaps check if it's possible to inject code (DLL injection) from outside the sandbox, into a sandboxed browser?

You can do it with this tool: securityxploded.com/remotedll.php

EDIT: I currently don't use a VM, so that's why I can't do the test myself.

 

I might have time to try it tonight. I have to leave in a moment, but will be back later tonight.

 

I tried 3 different methods of injection, and they were all successful. I injected into Firefox.exe which was Sandboxed by Sandboxie. I verified that the dlls were actually injected using process explorer. I could have tried other methods of injection, but I did not see any sense in it after the first 3 were successful. It seems Sandboxie does not prevent process injection outside the sandbox if my testing methods were correct. I don't use Sandboxie so if I injected into the wrong process, or something then let me know.

Edited 9/2 @4:55 pm (changed failed to successful)

 

Relating to injecting dlls and other manipulation of protected applications, there is some info on their FAQ site:

from http://www.sandboxie.com/index.php?DetectingKeyLoggers.

from http://www.sandboxie.com/index.php?FrequentlyAskedQuestions#KeyLoggers

Both are describing key-loggers, but the same can be said for other malware also. SBIE is not designed to protect sandboxed applications in already compromised system.

 

Thanks for your testing efforts. At least now, we can put this one to bed.

 

Yes, Sandboxie does actually fully protect against all forms of keyloggers, but only when you use and tightly configure both internet access restrictions and start/run restrictions!

 

I tried Sandboxie default settings when I conducted my injection test. I will see if there is anything in the settings that might prevent the process injection. I have rarely used Sandboxie so I don't remember the options available in the settings.

 

From keyloggers running outside of sandbox? So keylogger is running outside SBIE, monitoring everything you type in application that is run under SBIE protection, let's say Firefox. It records all keystrokes and sends them to some server. How do you think SBIE will protect against this if it doesn't have keylogger under it's supervision?

 

I don't know of any Sandbox that will protect against any threat outside the Sandbox. If it does then it's a hybrid of other mitigation methods, and not just a sandbox. If you want to Sandbox the entire user-space then you would have to use something like AppGuard which is also an Antiexecutable.

Edited 9/3 @1:21 pm

 

Sandboxies protects the system from programs that run in the sandbox. If a computer is infected, the malware runs outside the sandbox and SBIE wont do nothing about it. The key for successfully using SBIE is to install it in a computer that is clean to begin with. If you do that and run most of your programs in the sandbox all the time, SBIE will keep the computer clean, otherwise, the infection that's already in the system, might even help other malware break out of the sandbox.

Bo

 

Keyloggers running outside of sandbox-I thought the whole time that in this test keyloggers are running inside the sandbox, my bad!
Forget about protection than-this is a total defeat and the winners are keyloggers.

 

LOL sometimes I read so fast (and bad) I can easily get confused too.

 

Yes, that is the same point I was making. I think some users expect protection outside the scope of a Sandbox.

 

Uff! This is a very bad misconception from some users then. Hope user can read these previous posts of your guys.

 

I was backing up what you were saying. And making sure new SBIE users who come to this thread understand that programs that run out of the sandbox, do not run under the supervision of Sandboxie. The results of your test were to be expected, that didn't put nothing to bed (as someone else said).

Bo

 

Yes, sometimes I see non Sandboxie users bashing Sandboxie because the program doesn't do what its not supposed to do. I personally dont want Sandboxie to do more than what it does now. But that's me. Sometimes I feel that Tzuk tailored SBIE specially for me, I don't want more. Sandboxie works perfectly as it is now for my personal case use.

Bo

 

You know Pete, when I first installed Sandboxie, I said I give it 6 moths and see the results. Six months went by and nothing got infected and then a year and two went puff and now, almost 7 years later, since discovering SBIE, zero infections despite doing basically the same things and visiting the same sites than when I used to get infected.

Bo