3

I'm wondering how secure is "browser in the box" from Sirrix?

They said in their official website:

In contrast to simple sandboxing methods provided by standard browsers "Browser in the Box" isolates all activities of the browser completely from the host operating system. Merely a single shared folder within the host is made accessible for a separate user account. This folder stores all persistent configuration data like favorites of the browser. Equally all downloaded files are initially stored in this folder and are only forwarded into the normal user accessible download folder after a malware scan.

Actually this is good idea, since isolating the browser will provide much more security on the client side.

I want to hear your opinion.

8

From their product page, we can infer a lot about how their system works. Here are the key points:

  • Can be used with Windows XP and Windows 7
  • Comes with: VirtualBox 4.0.16, hardened Linux Debian 6 and SELinux and Firefox
  • Browser execution takes place in separated virtual machine with own operating system
  • Downloaded files are first scanned and then provided to user Configurable security polic for copy & paste, download, upload and printing
  • Reset to certified initial snapshot upon each start of the browser
  • Configuration data of the browser can be stored persistently and are retained for restart

So apparently it runs Firefox on Debian 6 Linux with SELinux inside a virtual machine running inside VirtualBox, on a host that must be Windows.

As for how secure that is, for the most part, it's the same as running a browser inside a Linux VM in VirtualBox with a snapshot you roll back every time you want to reset. Except that they are actually using a very outdated version of VirtualBox from 2012, which is probably a bad idea for lack of security updates. I get the feeling development on this product is abandoned.

While a virtual machine does add security, virtual machine breakouts do exist, and VirtualBox has be on the receiving end of such exploits before.

  • Is there any similar alternative as this one for linux? Or manual how-to? – Mirsad Apr 22 '16 at 22:28
  • 1
    @mirsad I'm not aware of any similar products, but it's pretty straightforward to do yourself. Setup a Linux VM in your VM software of choice, and take a snapshot when all configured. Optionally you can configure the browser to store the user profile outside the VM in a shared folder so that your settings can persist, before creating the snapshot. Then just roll back the clean snapshot when a clean reset is desired. – Alexander O'Mara Apr 22 '16 at 22:30
  • @mirsad VirtualBox also runs on Linux. – Philipp Apr 22 '16 at 22:41
  • It should be trivial to go to oracle and download the newest version, and upgrade it to 5.0.20 as of 5-1-16 – cybernard May 1 '16 at 19:25
1

Hi I am a working student at Sirrix AG and responsible for the QA of BitBox.

You are actually surfing more secure, considering that if you infect BitBox with malware from the web, your host system will not be effected. The Microphone is also disabled by default, so it cannot be activated by malware to spy on you. Also all interactions between Host and BitBox are watched by watchdogs (You can configure the Policies yourself). To get even more security, you can install e.g McAfee and configure BitBox to use it, so that the downloaded files are checked, before it is moved from BitBox to the hosts download folder.

  • Is this project still going on? What about support for linux? – Mirsad May 2 '16 at 5:25
  • @mirsad we had a Linux Version but the request was so low that we had to abandon the Linux version. – Ferhat May 2 '16 at 7:00
  • @mirsad and yes the project is still going on constantly – Ferhat May 2 '16 at 9:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.