Sandboxie: What do you sandbox, other than your browser?

Hi Aladdin. At this time, there is a known printing issue when using Sandboxie and W8.1. If you are using W8.1, I think you just need to wait for the fix that will come in a future SBIE version.

Bo

 

Hi Bo,

Thank you for your prompt reply.

Best regards,

Mohamed

 

I have a problem with EMET 4.0 the GUI agent won't run.

Is there a clash with Sandboxie?

 

Don't tell you run EMET itself within Sandboxie... Otherwise, unlikely.

 

Right, I don't run emet within sandbox but sandboxie does have emet configured.

So far just running the browsers and the emet standard entries. Excel, etc


I gave up on EMET! It blocked it's own office products from M$ fro m even loading!

 

I see, I am using AX on my daughters pc and I really like it

 

Hi everyone.

Can smb tell me how configure sandboxie to get better security performance with sandboxie and other programs

I have got paid version.

This setup I use for firefox
1)Auto-delete sandbox during close program (that should push out my surfing data saved and not only... storaged by Firefox)
2)Force run program in sandboxie (here i put "firefox.exe"- always in protect mode, off only for main updates FF+addons)
3)Drop administrators rights (less power more secure)
4)Allow only run & connect to network specific program which i run in sandbox (here i put "firefox.exe" and plugin-container.exe)
5)Allow read- access only C:\Windows (Program dont should read more than need - that improve security)
6)Allow direct access for firefox.exe
-%AppData%\Mozilla\Firefox\Profiles\*.default\adblockplus\pattern* (here adblock keep my filter list)
-%AppData%\Mozilla\Firefox\Profiles\*.default\NoScriptSTS.db (Need for NoScript save settings)
-%AppData%\Mozilla\Firefox\Profiles\*.default\prefs.js (Need for NoScript save settings)
7)Block file access for My Documents and rest partitions D E G H I
8 )Quick Recovery "F:\Temp" (I use SSD disc so i move/save temp and any downloaded files to older HDD partition)

I)What i should add/block yet for improve security.

II)How configure sandboxie with this programs:
a)Packers:7-zip/Total Commander (for safely unzip & preview comressed file)
b)Messengers AQQ\Teamspeak3 (I Think no need, but sometimes better have it too)
c)Rest network apps with hight risk: ThunderBird & JDownloader

 

I suggest you create a new sandbox, you can name it Packers if you like. Force 7zfm.exe to run sandboxed in the new sandbox. Make sure to add in Quick recovery, the folders where you want files to be unzipped.

In restrictions, you can block all programs from having access to the internet and only allow 7zfm.exe to have Start/Run access. Apply Drop Rights.

I am not too familiar with Total commander but if its similar to WinRar and 7 Zip, you could also force it to run sandboxed in the same sandbox as 7Zip. On my case, I also run and force WinRar and HJSplit in the same sandbox as 7Zip.

Setting 7Zip the way I described, unzipping a file, will always be done sandboxed in the "Packers" sandbox but you would not be able to view the file because of the Start/Run restrictions. You can view unzipped files in your (Forced) downloads folder or you could loosen the Start/Run restrictions in the Packers sandbox that would allow you to view files in the Packers sandbox immediately after unzipping. I do the latter.

Don't forget, set the sandbox to delete on closing. This is basically how I handle RAR, Zip files. Never had a problem with one, unzipping or viewing.

For Thunderbird. I never used it but I am pretty sure its similar to Outlook Express which I have used. This is what I would do. Create a new sandbox. Name it Thunderbird. Go to Sandbox settings>Applications>EMail Reader, Tick Thunderbird.

Make TB a forced program and allow the TB process or processes Start/Run and Internet access. You should also allow access to your browser and PDF reader, so you can open PDFs and click on links in Emails while you are using your mail. For me, that's enough but if you get Word, Excel files a lot, you might want to allow those too. In my case, most attachments other than PDFs, I rather download to my Forced downloads folder or desktop. Whichever way I do it, attachments are never run out of the sandbox.

Add your download folders to Quick recovery and block programs that run in the sandbox from having access to your personal files and folders. The above and setting the sandbox to delete on closing is what I do in my EMail client sandbox. HTH.

Bo

 

Ok big thx.

So configuration is similar like in my browser, just other program in other box.
So i will put all packers in to the one diferent box cause no need split each alone if all will work on same privileges.

 

I think, being able to block all programs from having internet access makes it a good reason for you to use a separate sandbox for 7Zip and Total commander. Thats why I run 7Zip, WinRar and HJSplit in a separate sandbox. The best suggestion that I can give you about configuring your sandboxes is this: make sandboxes as tight as possible, tailor them according to the programs that you you will use in the sandbox and keep them convenient and comfortable to use. Thats what I always try to achieve and it works great.

Bo

 

Can I just copy the above forced drive letters and paste in my sbie ini or do I have to do it within the program?

 

You can copy and paste all the Forced drive letters from above to your Sandboxie configuration file (USB sandbox). But in two computers, all I do is force one letter and my USB drives are covered.

Bo

 

What other tweaks should I make for usb sandbox?

 

one separated sandbox for:

- my download folder
- my Browsers

nothing more for the moment

 

Overkill, I think blocking all programs from having internet access is the important settings for your USB sandbox. I also suggest you set the sandbox to delete on closing, enable Drop Rights and block programs running in the sandbox from having access to your personal files and folders. I allow all programs to start and run in my USB sandbox but if you like to make things tighter, you can set it up so only the programs that you use often can run.

Bo

 

I have 3 different sandboxes for Firefox. One normal one (most used) just named "Firefox", which allows bookmark access. But not downloading/recovery. One named "FirefoxDownloads" that allows recovery. And one called "FirefoxSecure" that allows neither. In all 3 of them only FF is allowed for both start/run & internet access.

Also sandboxed is VLC, Pidgin Messenger, one for "NewDownloads", where I scan anything recovered before moving them to my physical computer, since I don't allow scanners inside my browser sandboxes. 2 for emulators I have. And one called "Realtime" where I sandbox removable drives & USB ports, allowing only VT Hash Check & MBAM to run in them.

Used to use one for UTorrent too... but don't use it anymore.

 

Do any of you sandbox your E-mail client, if so, which one do you sandbox?

 

I sandbox Outlook 2010, TyRidian.

 

I sandbox Outlook Express. Receiving and sending E mails sandboxed using an EMail client makes it sort of like, the mails are saved to the hard drive, you have read them and recovered attachments but the mails themselves........ have never been open.

Bo

 

Outlook 2010 (and also Thunderbird when I've been playing with that). I put in direct access to the pst files. Adding attachments comes from the default download directory rather than allowing Outlook to browse my real filesystem, but I'm happy enough with that inconvenience, it makes you think what you're doing.

As far as the list of sandboxed apps, I have one per: Acrobat, Chrome, Copernic, Explorer++, FF, Google Earth and Picasa, IE11, Excel & Word 2010, Nitro, Password Safe and TrueCrypt, Skype.

I've had most problems with Word add-ins. I run Emet 4.1 update 1 and had few problems with that.

I also add the following to most profiles manually in the config file, according to some good posts a few years back:

ClosedFilePath=\Device\Mup\
ClosedFilePath=%Personal%
ClosedFilePath=C:\AUTOEXEC.BAT
ClosedFilePath=C:\boot.ini
ClosedFilePath=C:\ntldr
ClosedFilePath=C:\NTDETECT.COM
ClosedKeyPath=HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\
ClosedKeyPath=HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\
ClosedKeyPath=HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnceEx\
ClosedKeyPath=HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
ClosedKeyPath=HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
ClosedKeyPath=HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\
ClosedKeyPath=HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\
ClosedKeyPath=HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System\
ReadFilePath=C:\Windows\

Also, I DropAdminRights although I don't run in admin accounts.

In addition, I add ClosedFilePath for most of my drives according to what the applications is doing. So for example, there is no reason for a browser to get at my data (every reason why not to!). Conversely, I close internet access for Office and pdf viewers, if I need to follow links from those, I do so manually.

 

A sandbox by itself is not enough protection...

Most Important
- Put a huge complex passord on your Administrative account...
- Do not use your administrative account for day to day operation... Ever! It's designed for administration purposes not regular use for a reason.
- Create a limited user account, put a password on it. Use that one.... Do not grant your limited account administrative privileges....

Note: Do not worry, you can still run many applications that require it via "Run As" then Chose administrator when necessary. The idea is to limit background applications ability to activate in administrator mode and gain full unlimitted access to your system in the background unseen.

If you are following this guidance to implement this on an old system (Not a fresh windows install) then you must also perform the following:

Prior to implementing you tight security protocols... You must investigate each and every process that automatically loads, either at boot time or at login time for each user account you wish to protect. The idea is to validate the process as legitimate or malicious.

Also invetigate each and every process that runs live, many could be spyware, or backdoors, effectively rendering your sandboxes useless.

You can use this program to investigate each and every process and document and validate them using this tool:
Advanced Process Analysis and Identification System free from here: https://hermes-computers.ca//apais_1.php

Now you are ready to create an effective sandbox strategy...
# 1 - I prefer developing a RamDrive -Make it at least 1 Gig or better (Look it up) free ramdrive: http://www.softperfect.com/products/ramdisk/
# 2 - Move all sandboxes Primary storage location to your new RAMDrive this will isolate them from in built trackers trying to prevent control.
# 3 - Create a new individual Sandbox for each, and every internet facing program - regardless of it's reputation
# 4 - make all your sandboxes autodelete on exit. So as to preven session persistent tracking by greedy corporate spooks...
# 5 - Configure Each Sandbox with the utmost care - make it tight - Learn how to do it proper - default settings are not enough...
# 6 - Most Important - Put a password on Sandboxie so no one can change the settings via remote control...
# 7 - Use Firefox - Keep it updated - regularly upgrade your addons...

Run Firefox with the following configuration
A - NoScript
B - Do Not Track Me
C - FlagFox
D - HTTPS Everywhere from https://www.eff.org/https-everywhere
E - Use Roboform for your passwords, keep them big unreadable, and most important all different
F - Use DuckDuckGo for search engine... https://duckduckgo.com/ Frack the trackers!

Note: Ramdrive's already work more or less like a sandbox as sandboxes use memory to virtualise live on going. This will greatly improve the sandbox ellement's performance. Your web browser will substantially increase in speed once properly loaded. This is also an effective counter tracking mechanism, as your browser leaves an anormous amount of data visible to each and every site you visit. By compartmentalizing everything within sandboxes and runing it all within one or more RamDrive's you effectively eliminate most of the persistant tracking effort of the browser and it's scripts. Each time you shutdown you will vapourize the content of the RamDrive... This is what kills the Anti-privacy trackers and persistent mechanisms...

Remember to tell those who track you for profit: We do not forgive, We do not forget...

Security is not by default, it's by design... Your design.

Guy Deschênes

 

All you sayed Hermes what ever, just wont work if you are against hackers. You can try what ever you want. Just won't work with normal internet surfings.
You could try stay with only http, https etc. and avoid Flash, java and all the plugins. Maybe that way, I don't really know.
Sandboxie might help some in that security though. What you posted is not normal to do at all. More like against some sickness in this world against our PCs.

 

I don't think anyone's saying a sandbox is anything other than a component of increased security, along with account security, attack surface reduction, engagement of brain and so on. Sandboxie is something I'm delighted to have in the toolkit though on a benefit-vs-effort equation. For various reasons, I'd also include VMs since this section is about sandboxing and virtualisation.

I've also had a good experience with the Yubikey and Lastpass combination on Windows 7, which allows for 2FA on both logon and Lastpass.

 

Jarmo P...

The only thing the above stated guidance fails to protect against effectively is very tedious and rather expensive to implement Browser Fingerprinting...

https://panopticlick.eff.org/
https://wiki.mozilla.org/Fingerprinting

If you understand how the Internet works and the relationship between servers and Internet centric client applications you would readily understand the effectiveness of this methodology...

The reality that the government is siphoning data between points is a problem for privacy conscious types...

However the use of encryption is effective regardless of rumors and misinformation rampant these days. This however is not something that is effective against such efforts. These are methods that are targeting intrusive privacy busting efforts by hostile snooping corporations and hackers.

It is the equivalent of erecting a fence around your property, adding a few guard dogs and a good alarm and monitoring system. It doesn't prevent the DEA or the ETF from barging in and destroying your life, but it will stop the local neighborhood idiots from trampling your flowers...

By the way, properly implemented this methodology not only works, it actually dramatically improves all internet performance. (RAMDrive) With the rare exception of blocking hacker loving Java script by default. (NoScript)

It must be said... Default Sandboxing by itself doesn't not protect your privacy...

In fact if you run a sandbox improperly configured, you are fully exposed to data theft. Typically a default sandbox is only able to protect you against writing to the drive or renaming files and other similar types of behaviors. Unless you configure your sandbox to prohibit access to sensitive disk areas and impose other similar limits to the applications being sandboxed you are still vulnerable to multiple types of hostile penetration by criminals and other government officials...

For example:
An easy effective countermeasure against such predation is to simply keep all your data on another drive say D:\ and configure your sandboxes to completely prohibit access to the D:\ Meaning your web browser or other applications running inside the sandbox would be unable to scan and exploit data stored on D:\ as access to it would be immediately blocked...

This is the only guaranteed way you will not be breached and your intellectual property remotely stolen while sandboxed in the name of National Security...

The only open issues remaining are in built O.S. vulnerabilities and installed applications providing backdoors and other similar hostile elements. Also addressed in my previous post.

However not implementing such measures typically leaves you open to countless security horrors and untold data theft and identity theft...