1

As I understand it, a sandbox is an isolated environment on a machine, used to gather informations on a threat, or test it directly. That's made so that the threat can't harm anything, once you're done you delete that isolated environment, most likely a virtual machine and you're safe.

The main goal is, you're isolated so you're not at risk for what you have outside of the sandbox.

I wondered if there's something similar to the sandbox (like a hardened environment with testing tools inside) to test safely what happens on your computer (which is absolutely not safe, and which you absolutely can't afford to reset) from your own computer ? Like I don't know, some kind of partition that is barely accessible from the main working environment, that couldn't be infected easily, and which you could use to troubleshoot what's happening on your main user session whenever something wrong happens ?

If something like that exists, how is that called ?

Improve this question
  • 3
    In theory there is stuff like SGX secure enclaves. In practice you always want to sandbox the untrusted code in a VM. – CodesInChaos Sep 1 '17 at 8:23
  • If such a 'perfect security' sandbox could be created, then we would not need sandboxes because we would have perfect security. There is a reason why the ebola virus is tested in complete isolation. – schroeder♦ Sep 1 '17 at 9:07
  • @schroeder Well I'm not looking for complete isolation. What i'm looking for is somehow a forward observation bunker, computer security wise. Or a stronghold from which you can take back lost territory, which security wise means "In that one place I still have most things functionnal and I can plan what to do to kick out threats on my computer". So, is it totally irrealistic ? – Kaël Sep 1 '17 at 9:15
  • Ok then, there is no accepted security term for this because it is not secure. You want 'resiliency' not security (a subtle difference in terms). Once you shift your thinking to resiliency, there are a few famous things that can help: virtual machines and 'containers' (think Docker) and process isolation. – schroeder♦ Sep 1 '17 at 9:18
  • By the way, there are many sandboxes that run on a host computer. Not all sandboxes are remote, but the sandboxes only allow data in, never out. – schroeder♦ Sep 1 '17 at 9:19
3

You are maybe talking about Jail (freeBSD). Or Chroot (OpenBSD)

There is a ported version of Jail/Chroot for windows called winjail

I used Chroot for dynamically analyzing Malware code sample. i needed evidence, trace and log entries for shipping some proofs of concept or custom signatures.

  • The thing is i was 100% sure of what the impact of those malicious lines would be on the system, via a previous static analysis.

  • Never ever run a full Malware (PE file or compiled / packed program) outside a full isolated sandbox.

  • I won't recommend using jail for malware sample analysis until you're 100% sure of what you are doing, 95% is not enough.

In the case i failed convincing you and you still want to run Malicious things outside a sandbox:

  • take a snapshot (RAM dump included), store it on a external device.

  • Remove the external device.

  • Physically isolate the computer (software isolation is not enough) & unplug all USB devices if you can.

  • Do your things.

  • Restore the snapshot once you are done.

Improve this answer
1

You're describing both sandboxing and forensic analysis.

The closest you're going to get to a solution is using something like Cuckoo. You supply a virtual image of your computer as-is (using a tool like VMWare vCenter Converter), giving yourself a virtual replica of your operating environment, then you detonate your malware payload/questionable application in it and Cuckoo hooks all the Windows API and network calls and tells you everything the malware tried to do.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.