Sandboxie

Unless I misread your original post, you were suggesting that multiple sandboxes could be used to create a separation between normal web access and web activities requiring higher security such as banking/online shopping. When I said that this is great advice, I meant it. I wanted it to be absolutely clear that I wasn't being critical of anything you said, or suggesting that the use of a single sandbox is in any way preferable to multiple sandboxes.

My post was aimed exclusively at people who are either using the free version or, for reasons of simplicity, prefer to have only one sandbox. I only wanted to add that, when using a single sandbox, it's recommended to empty the sandbox before and after banking/online shopping.

I'm not sure what suites have got to do with this. I don't use a suite personally because I prefer separates, but I don't have a problem with anybody who wants to go down the suite route.

I'm not sure why you would assume that everybody would find using multiple sandboxes the natural thing to do. What one person finds natural another won't. It's all a question of use cases and what the user feels most comfortable with.

There's nothing non-interesting about using multiple sandboxes. As has already been said by others, they are particularly convenient when different sandbox configurations are required for different purposes such as web browsing and software testing. However, multiple sandboxes are not an essential requirement if web browsing is the only anticipated use (although they may still add extra convenience).

I'm not trying to pick a fight; just clarifying things in order to prevent misunderstanding.

 

That was never a question, just as I was not targeting you. It just so happened that your response made me think of a few things.

Hmm. Yes, I should have clarified that a bit. I would have thought, that if you understood that SBIE kept everything it did in the sandbox, that most would have recognized that using one box would pose one common problem. The problem being, how do you delete the box you use everyday whenever you want to do some banking, yet also keep all the current stuff you have been using everyday for use tommorrow. It just made sense to me that I could not do both, and the best solution was to create one box (even without forcing .exes) that I could delete at will and another that I did not delete so its contents could be used as normal. This seemed like the ideal solution to do some things in one box and other things in another.

I was not taking it that way, none the less it is always nice to let others know, just in case they get the wrong meaning.

Sul.

 

Hi,

First off this is a great thread and I have learned a lot as I am in a similar position to original poster in that I want to try Sanboxie but was hesitant. I have read most of this entire thread but not all so apologies if this has already come up but I have a few questions:

One, does Sandboxie uninstall completely and easily? I would love to try but always concerned that it will be difficult to remove as have had problems in that past with other applications that leave stuff behind.

Two, if you use Sanboxie and delete all contents on close are flash cookies also removed like regular cookies? And if this is true am I right in thinking that flash would be much less of a concern using Sanboxie?

Lastly, I have used Firefox for years but if using Sandboxie does it make any difference if used with IE6 say instead of FF? And are both equally safe when using it Sandboxie?

Thank you.

roark

 

Speaking for myself, SBIE has always been a "light" program, very clean uninstalls and very small footprint.

If you tell SBIE to keep such things, they are gone. An example: you have just installed the OS and Firefox. You install SBIE. You start FF in SBIE. No flash installed, so youtube does not work. Within the sandbox you install flash. Now you can watch the videos. When you delete the sandbox, the flash install is gone, along with everything else. The next time you start FF in SBIE, you must again install flash.

Bookmarks and items you wish to keep -- deleting the sandbox will flush those out. This is why SBIE has to option to allow FF to write bookmarks directly to your FF profile. In this manner, you surf in the sandbox, make a bookmark in the sandbox, but the bookmark is written to the REAL location, not the sandbox location. Now when you delete the sandbox, the bookmarks are still there because they were written directly to the real location.

You can also recover whatever you like from the sandbox before deletion. Sandboxie comes with some preset options for a browser like Firefox, such as keeping the bookmarks. You can use these or modify them or create your own. Basically, if you want something to be kept, it can be kept. If you want something to be deleted, it can be deleted.

This depends on what is in your sandbox that is of any value. If all you have in your sandbox is temp files from surfing Wilders, what is there to steal using either IE6 or FF? SBIE will keep what happens in the sandbox out of the system, but if you have gone places or have things in the sandbox that are worth anything, IE6 might not be your best choise.

Sul.

 

In your scenario where persistency across web sessions is important, I understand perfectly why you would use a separate sandbox for secure transactions. I too experimented with this approach but eventually decided that, in my case, I only needed a single box for web surfing, set to automatically delete the contents on exit. When I was using multiple boxes for web browsing, I also set a different coloured border around each box as a visual reminder of which box I was using, in order to prevent the risk of using the wrong box for secure transactions by mistake.

Persistency apart, another advantage to multiple sandboxes is of course that each one can be configured with different restrictions according to the intended usage. I found this to be a useful feature when setting up a dedicated box for software testing.

 

Good to see many people are using/talking about Sandboxie these days considering there weren't too many responses to this post by tzuk.

Can a mod reopen it.

 

Yes, chapeau to Tzuk! It also shows the reality of the malware environment nowadays: as it is so difficult to deal with so many variants, sandboxes and virtual environments have proven very effective in isolating malware without having to investigate even the existence of it.

It remains to be seen how long these environment will remain tight and how much their popularity will keep them away from malware writers.

I also wonder how come such a great software (SB) hasn't spawned imitations, as far as I know it is quite unique in its category.

 

Is it really only 6 years since SBIE appeared ? It seems to have been around since the Ice Age.

 

I've just purchased sandboxie(paid for by my company) but am unsure if I really need it.
I am really happy with my current setup and haven't had any malware etc for a long time.
Wouldn't installing sandboxie just be another application to slow down my pc?

 

A quick definition: Sandboxie creates an area (c:\sandbox) where anything and everything that happens inside the sandbox stays. There are methods for you to get what is in there out (such as downloaded files) and also methods to let things you want to keep "just go where they should", called Direct Access, so that you don't have to remember to get them out of the sandbox.

The contents of the sandbox can be deleted pretty much on demand, automatically or whenever you feel the need.

As a security tool, it segregates what you do with program X from the rest of the system. In most cases is gives a few seconds delay on starting up a program initially, but mostly unnoticed after that. Some people have lag issues, but most don't.

You don't have to use it simply for security, you can also use it for convenience. I use it for both, and probably 50/50 on which reason. I like being able to test some settings on a program within the sandbox, then easily delete them and start again. I like being able to test a new program in the sandbox, and if I don't like it, delete the sandbox. All the while, my real system is unaffected. Virtual Machines are more robust, but I like the ease of Sandboxie and use it instead of a VM now for whatever I can.

I don't know, can you think of a use for such a tool?

Sul.

 

@ goaldendj

For browser Sandboxing the resources are minimal. If you go for every internet application sandboxing then you can see quite high resource usage, especially if you have a lot of those applications open at once.

The system drag has always been low for me. Others say the browser is slow to open, etc. I guess I have been just lucky because I haven't noticed this at all.

 

Wont be reopened, IIRC, the thread was closed otb of 'vendor posts spam' or such ??
see here: https://www.wilderssecurity.com/showthread.php?p=278475#post278475

LOL: my edit there.
That post spawned many many threads.

That's amazingly resilient for many tools.
So many softs have come have come and gone.

tzuk has risen to every challenge, kept his head and his manners, encouraged dissection, discussion, vents, rants, continued to innovate and develop, and kept a nice pricing model.
for anyone who gets aquainted, it can become one of the cornerstones of a secure model.

When I first came here looking for advice; sandboxie was introduced to me :grabbed it and held on tight ever since.
I've never even done any checking into his background or company; never felt the need.

I hope he's done well out of this: he deserves it.

 

does sandboxie protect windows live messenger? and software? like how a/v's protect or does it protect just web browsing?

 

Don`t laugh, but a thought came to me on reading the thread "Scroogle final days ?".

There is much talk (always has been) about Google`s practice of collecting all our private data and browsing habits through their Cookie and IP snatch procedures. Rather like some Peeping-Tom.

Well, I have so far been indoctrinated with total confidence that when operating within Sandboxie - NO such information can be sniffed out by external blood-hounds.

True or false ?
Question :- Does Sandboxie STOP Google`s "Watergate" tactics ? If not - why not ?

John B

 

I won't say I have the absolute correct answer, but I will apply some logic to it, and hopefully you will follow it to the end

Sandboxie is not what people sometimes think it is. As a security tool, its primary function is to create an area that is segregated from the OS. Everything functions as normal within this segregated area, but what happens there does not infiltrate into the OS.

There are also features within Sandboxie to allow you to introduce items in the sandbox back into the OS system - recovering files and similar.

There are options to allow a sandbox to directly interface with specifically named areas of the OS system - like having bookmarks written to the real location so that you don't have to recover them.

There are also options to disallow or allow specific applications from running within the sandbox, as well as options to disallow or allow specific applications from having network access.

All of these provide a robust security tool, when it is taken in context to what effects your real system or what can execute or access the web.

However, once a program such as a browser is started within a sandbox, it behaves as normal. The sandbox might disallow other programs from running, such as flash or adobe reader, as well as keylogger, or it might allow them to run, but not allow them network access. While this does provide some restrictions, it does not effect what the browser does.

When you imagine that google attempts to mine some data from your cache, what laws are in place to keep the browser in the sandbox form accessing the cache? Normally, there aren't any. When you imagine that a malicious website can try to steal your passwords somehow, first you have to ask, are my passwords or data related to passwords available to the browser? Is the browser the tool to gather the data, by an exploit? It might be. If the browser is the tool, what sort of restrictions does the browser have in the sandbox?

Normally a browser can read about anything on the system, whether sandboxed or not. So if google wants to read a file, and the browser is allowed to do so, how does Sandboxie prevent this? Only if you specifically tell it to.

The security of Sandboxie is based on what you have in the sandbox. If you do some banking, then delete the sandbox contents, the data was only stored in the sandbox, not the real system, so the data is gone. When you next start the browser in Sandboxie, and you then go to a website that attempts to steal your data, it is already gone.

IMO the proper use of Sandboxie is to never use the browser outside of the sandbox to do things that might store sensitive data. This way, you are always sure the "area" of information that the browser has access to is in the sandbox, and you can handle sensitivity by either deleting the contents or using multiple sandboxes, which segregates one box with sensitive data from another box that might do things to try and get that data.

The point is, running a browser in a sandbox does not inherently stop all things from happening. Things run as normal, except the system is kept out of the mess that might be created within the sandbox.

Sul.

 

Oh Sully, what a detailed account of the problem, I will have to read it a few more times to digest it all. Ya not a Lawyer are ya ?

Anuvver stoopid question. My teacher put me in the back row `cos I made her life a misery wiv my awkward questions..

Whilst a Browser may have a comfortable life and degree of independence inside the sandbox why does Google ?

Google is a just a Search engine, I could select any one of a dozen. I would have hoped that a Search engine is constrained to the same security level as a porn site - just does it`s job and NO outward bound traffic. What gives Google or any other Search engine an exclusive security pass to access the Crown Jewels and nick `em from my Guardian Angel ?

John

 

You can run ALL internet facing applications in Sandboxie. I've thrown everything at it, and they work ok. Yahoo Messenger, Live Mail, etc. Only problems you come across are ... any adjustments that you make, adjustments that are not stored server side, they will be gone when you close the application and delete the sandbox - if you tick to delete the sandbox on closure (which I recommend).

So when you add a friend/contact to your list, as this information is usually stored server side, it still shows up when you next run - that information is stored. But if you add an avatar to your display pic, or you wish to save coversation logs, these will be gone, as this information is usually stored in to your C:\ (it's worth testing the application sandbox thoroughly to make sure you understand how it works, and so you don't lose anything important)

Sandboxie tricks the application, windows live messenger, for instance, into thinking it is running in the normal areas of your hardrive. In actual fact it is running in a virtual area (the sandbox) So when you've finished, closing the sandbox removes any bad stuff, and changes, that may have occured whilst operating in the sandbox.

For browsers, there are some instant 'save bookmarks' boxes you can tick. These can be found in the Application section of Sandboxies control. Makes things a little easier. Other than that though, customising is down to the user.

There is a bunch of Sandboxie configuation tips here at Wilders. (in the search)

 

It is not really that simple. Your browser is fetching a page and rendering it. The page is full of code. The code does this or does that. The browser does what it is told. When you restrict scripts in the browser, certain or all things that a page is supposed to do is limited.

Google asks your browser a question, such as what OS are you running in. The browser responds because it can. If you go to a malicious website, with scripts allowed, a script might ask your browser to fetch the username. Maybe the script counts on an exploit in the browser to get it to do something that it might not normally do. It does not matter to the browser if it is in the sandbox or not, it will read what it can and report back what it can. If you have no data on the real OS (have not been banking outside the sandbox) then there is nothing there to get. If you have, well, the sandbox does not normally restrict the browser from reading anywhere, so it would read what it wanted to. If the sandbox was used for some time, it would look within itself as well, to find data to send 'home'. If the sandbox was recently deleted, again, there would be nothing for it to read and send 'home'.

Think of it like this, the browser is capable of running remote code. If that code says to get some user data, and the browser can do it, it is just as if you had a program on your desktop that told the browser to do the same thing. That is why many people turn scripting off except on a per site basis. You just never know what a malicious site will try and pull.

Sandboxies purpose is to keep that keylogger that was sent to you from getting into the real system by keeping it in the sandbox.

Don't think about sandboxie when you ask these questions, think about the browser and how google would get your data with a browser. Then think about how sandboxie might be used to limit this behaviour.

You can move up a row if you would like, I only use my dunce cap when it is shrouded in foil and I am watching 'signs'.

Sul.

 

@Keyboard_Commando

Nice. It is important to also realize that while the contents of a sandbox are kept from creeping into the OS system, what runs in the sandbox normally has full access to the real system (meaning, it can read c:\windows files without issue etc etc). It just cannot modify what it accessed. If it does modify, the modification happens on a copy in the virtual space (c:\sandbox).

So while you don't have to worry about infecting your system, you might have to worry about whether or not a program within a sandbox can read something in the OS system that would be a no-no.

Sul.

 

Out of interest where do you guys here envisage SBIE to be in another 6 years,or will it be here at all?

Will it still be recognisable,or will developments in the Windows infrastructure toward application isolation force it to change entirely in order to survive?

I realise that by then we'll probably be looking at Windows 9 so it's difficult to guess ahead,but my personal opinion is that given Tzuk's innovative nature he'll find himself a niche to reside within.

 

Here's hoping not

 

My dear Sully, cannot repeat the script, it is too long, but greatly appreciated and will be thoroughly read.

Again, I will have to absorb all that very logical information. I am getting more out of this Wilders thread than ever I have had from the net, simply because all you posters are just so helpful and wonderful. More important you are all experienced users and have no allegiance to any external influences.

Now Sully, I have been plodding along under the impression that Ronan Tzuk`s magic box protects me from all evil. Now I have dents appearing in my armour.

Do I understand that SBxie is no more than a One Way valve ? It totally protects me from external infections, but allows all my little secrets to be scooped up with ease by Google and the Internet Mafia ?

I would not be too happy for my long running sordid relationship with the lady next door to become an over-night blockbuster in the Shanghai Morning Star. My wife would`nt see it, but 13.8 million Chinese may.

John B

 

That will depend on what you think SBIE is doing. Its job is not to prevent google from collecting your habits, its job is to make sure what happens in the sandbox stays in the sandbox.

Tzuk did not stop there though, thankfully. He gave you many options to control what happens in the sandbox. The ability to deny even read access to a specific area is one example (ie. Blocked Access).

It seems to be pretty common for people to believe that Sandboxie is a one man army of security, that it will cover all bases and be the knight in shining armour. If you want to talk about one security tool that stops your system from becoming infected, then Sandboxie might indeed be that knight.

But if you want to find a program that will protect your data from being read by someplace you willingly visit, Sandboxie out-of-the-box is just a poor peasant. You can beef it up through configurations to become maybe a knight or a lord, but not out-of-the-box.

I would love for someone who knows differently to say "That Sully doesn't know what he is talking about", but I don't think that will happen in this instance. The fact of the matter is, from my knowledge on the topic, what happens in the sandbox stays in the sandbox, but what happens in the sandbox doesn't matter as long as it stays there. Keeping your privacy is not an option I have seen in Sandboxie anywhere. Proxomitron or Privoxy type tools seem more the thing to use for that.

But all hope is not lost. Carefully constructing how you use SBIE can help you. Back to my examples of multiple boxes.. If the browser outside the sandbox has no data, and you start in a clean sandbox, there is no data. If you choose one sandbox for doing sensitive actions in, then delete that box when you are done, you keep a clean record. If you use a different sandbox for doing things that might be 'dirty' but you never use it for anything sensitive, then again you have not data in that sandbox of any value, even if you never delete it.

Sul.

 

I don't get this at all: how can any modification of any number of Sandboxes prevent an external source from gathering information sent by our sandboxed browser to that external source?

What happens in the sandbox may not reach the rest of our computer but is certainly available to the recipient. For example, you type in your user name and password for on-line banking. It goes out of the sandbox to the bank. Or am I missing something basic here?