Questions tagged [sandbox]

A sandbox is a security mechanism for containing and restricting untrusted programs. Such programs could contain malicious code, which would otherwise harm the user's system.

Filter by
Sorted by
Tagged with
1 vote
1 answer
36 views

What sandbox does an <object> element run in? Can this sandbox be configured?

I run a site that displays user-generated SVGs. They are untrusted, so they need to be sandboxed. I currently embed these SVGs using <object> elements. (Unlike <img>, this allows loading ...
user avatar
0 votes
1 answer
95 views

How to store malware for analysis?

I am planning on analysing some malware samples dynamically using a sandbox tool and a target Windows VM. The host (physical machine) runs Ubuntu and in it are the sandbox and target VM. So far I only ...
user avatar
  • 1,145
2 votes
1 answer
53 views

Security of a ro volume in Docker

What are the security implications of mapping a host folder to a Docker container ro? For example -v /usr/local/bin:/usr/local/bin:ro. Of course, the container can now read the host folder. But, ...
user avatar
0 votes
0 answers
24 views

what are the risk associated with installing flatpaks at user level

flatkill has been floating around for a while, and honestly it was the reason I was personally resistant to using flatpak packages for a while. I'm wondering though, most of the article is written ...
user avatar
1 vote
0 answers
88 views

How can I enforce a security sandbox with any process?

Deno (the node.js fork) is designed to be secure by default. Therefore, unless you specifically enable it, a program run with Deno has no file, network, or environment access. Deno has a set of ...
user avatar
  • 111
1 vote
1 answer
107 views

Is it possible to move image files from a text thread on a phone to a virtual box without downloading them?

I'm looking into a spam bot that's been sending me messages on my phone (Samsung s10). It's sent a couple images that I want to try and scrape for metadata and do a reverse image search on. Since the ...
user avatar
0 votes
0 answers
570 views

Is there a more convenient, yet safe, way to run DOSBox-X than I'm currently doing it?

I recently learned about DOSBox-X. It's basically a somewhat less awful version of the basically-abandoned DOSBox. I currently have it installed inside a Windows 10 VM inside of my Windows 10 bare ...
user avatar
  • 1
1 vote
0 answers
105 views

Do modern video game consoles sandbox games? [closed]

If for example there is a game, that is specifically designed to try to get control of your game console or to be able to provide the user of the game control over their system and somehow got onto ...
user avatar
54 votes
6 answers
20k views

If malware does not run in a VM why not make everything a VM?

There is a lot of malware that can detect whether it is running inside a VM or sandboxed environment and if such environment is detected it can conceal it self and not execute. So why not make ...
user avatar
  • 1,145
1 vote
1 answer
343 views

Why does sandboxie require admin privileges when it runs a software installer that requires it?

Shouldn't it just "emulate" the admin privileges like everything else? Why dose it actually require it? And is there any security problems with that?
user avatar
  • 153
1 vote
1 answer
117 views

Is there a way to tell what the file does before opening it?

You have just noticed that an unknown executable file has been downloaded to your machine. Is there a way to tell what the file does before opening it?
user avatar
5 votes
1 answer
308 views

Web Assembly Security

I'm excited about the prospects of web-assembly for the future, but I'm curious if this will have the same security ramifications of Java Applets. What are some of the reasons why web assembly is ...
user avatar
  • 153
0 votes
1 answer
433 views

How does Chromium's sandboxing compare to Firejail's?

I am increasingly being requested to join videoconferences through Zoom, which I don't trust to run on my machine. I understand that there are two common ways of sandboxing this software: you can ...
user avatar
3 votes
1 answer
153 views

How realistic is to be 'hacked' by ONLY clicking a link [duplicate]

In the case of phishing training, most training will say "don't click the link, you can get hacked!" If there was an exploit that could bypass the chrome sandbox on an up-to-date verison of ...
user avatar
  • 31
0 votes
1 answer
89 views

Seeking recommendations/warnings for creating a server for malware sample upload and analysis

I am trying to conceptualize a server where users can upload potentially dangerous malware samples to a server. They would not need to be stored in the file system per se but kept in memory long ...
user avatar
3 votes
1 answer
576 views

Why aren't Microsoft Office macros sandboxed?

For about 20+ years now, Microsoft Office macros have been used to spread malware. Even in recent years those threats have not disappeared and they often resurface in one form or another e.g. World’s ...
user avatar
0 votes
2 answers
348 views

Safe mobile browsing

What actions can I take to make web browsing on mobile phone (android) as safe as possible? My main concern are sites that would install malware (has happened before on desktop computer). On a ...
user avatar
  • 1
2 votes
1 answer
2k views

Can I safely run a virus using sandboxie? [duplicate]

I want to test some untrusted software to check them, for this reason, I researched for a good sandbox software and I found Sandboxie I tested few safe application, but I am not sure if I can run ...
user avatar
  • 1,317
3 votes
1 answer
2k views

Is Windows Sandbox a viable alternative to conventional VM solutions considering its design?

The idea of having a fast, disposable VM at the palm of my hand appeals to me very much. It makes adding an extra layer of security to any thing I want to do so easy - just launch the sandbox ...
user avatar
0 votes
1 answer
301 views

Is it safer to run executable file (not safe, may contain virus) on VBox

I have a host system (Windows 10) with premium antivirus and running a Windows 7 in Virtualbox with no antivirus. I have installed sandboxie and try to run executable files that may contain virus. Is ...
user avatar
0 votes
1 answer
297 views

Securely analyze and format a USB flash drive

I need to scan the contents of a USB stick with several antivirus software. I have several ways to do this. Either I mount the key, I scan its contents (I may place the suspicious files in ...
user avatar
  • 1
2 votes
0 answers
157 views

Windows command bypassing Sandboxie

Using Sandboxie typing net user some_user some_password, on a sandboxed cmd, actually changes the password of the real user. Is this intentional? It is just a default Sandboxie installation running ...
user avatar
4 votes
1 answer
300 views

Disguise System as VM

Malware sometimes uses anti-vm and anti-sandbox behavior to act like harmless software. Wouldn't it be a good prevention strategy to disguise the host machine as a VM so that potential malware would ...
user avatar
2 votes
2 answers
2k views

What's the safest virtualization tool for running unsafe software - VirtualBox vs Windows Sandbox vs Hyper-V [closed]

I'd want to ask, what's the safest environment to run potentially unsafe software? I'm aware that this question may be very tricky, because each of those may have its flaws, but generally speaking ...
user avatar
  • 219
1 vote
3 answers
356 views

If we integrate CDR in our email solution, do we really need Sandbox as well?

In the case of social engineering attack vector is an email sent with a malicious attachment like XSL file, I am not really understanding where we will need Sandbox solution if we can just use CDR (...
user avatar
  • 1,204
1 vote
1 answer
176 views

Prevent an application from making any network access on macOS

I want to run an application on macOS, but preventing it from making any type of network access, or any type of internet access. I have seen the following possibilities: Use the built-in firewall. ...
user avatar
  • 331
1 vote
1 answer
194 views

Running virus from real folder in Sandboxie

What if I download a virus to my real folder but only execute it in Sandboxie, is it less secure that if I download it directly from SB?
user avatar
  • 141
3 votes
2 answers
2k views

Fake output of CPUID instruction

I am trying to analyze a malware in a virtual machine (linux), but it uses the cpuid output to verify if it is in a virtual machine/sandbox, and refuses to run malign code if inside a virtualized ...
user avatar
  • 31
11 votes
3 answers
2k views

How to securely run Puppeteer / Chromium in a Docker container?

Attempting to run Puppeteer, a Node library to control a headless Chromium (in order to do things like create a PDF of a website), in Docker is a surprisingly fiddly thing. The problem is that, from ...
user avatar
  • 211
0 votes
0 answers
170 views

Safest way to open PDFs on Android and iOS?

I was checking out Qubes' way of creating safe PDFs, but unless you use Qubes as a daily driver (and use DispVMs to open PDFs) it's still not viable to just use it to create image-based PDFs if you ...
user avatar
  • 121
3 votes
1 answer
711 views

How to sandbox students' Python 3 code submissions for automatic assignment evaluation on Windows 10?

I am the TA for a coding class in which students will have to write Python 3 scripts to solve programming problems. An assignment consists of several problems, and for each problem the student is ...
user avatar
1 vote
1 answer
241 views

Will this sandbox my user's javascript from my web IDE properly?

I'm working on an IDE that should run a user's JavaScript in the Browser. I don't want to just eval arbitrary code, especially as code may be shared between users. From here and other sources, I ...
user avatar
1 vote
1 answer
1k views

How much protection does sandbox software provide against malicious .exe?

I need to review a large number of .exe game files. I recently had an incident where I got infected by an .exe that passed all my 'checks': virus scan, Virustotal, reviews, community feedback, ...
user avatar
  • 121
3 votes
2 answers
2k views

Is there a way to safely run untrusted code on a local machine for a videogame

I want to create a simple videogame engine that can run untrusted custom code in order to add functionality to the game. I thought a about using an akka like concurrent actor system, so that the code ...
user avatar
1 vote
1 answer
224 views

Why might malware make a DNS request for an epoch time converter?

I am analyzing malware and I see that two executables when run in a sandbox made DNS requests for www.epochconverter.com Why would an attacker risk detection by making a network request to ...
user avatar
  • 130
7 votes
2 answers
192 views

Opt-in a security profile at runtime, without tedious setup

I like lowering my access privilege mid-program (e.g. restrict my program to the current directory and files, disable networking). I imagine this is a pretty common wish. I would like to be able to ...
user avatar
0 votes
1 answer
293 views

Is it possible to securely run user defined python code in AWS?

I would like to create an app that accepts users python scripts and executes them as part of its functionality. What I am wondering is if its possible to block I/O, network and other attack vectors so ...
user avatar
  • 103
1 vote
0 answers
1k views

What "stability and security will suffer" by using a browser with the --no-sandbox flag?

Starting Brave browser (on linux manjaro) shows a “You are using an unsupported command-line flag: --no-sandbox. Stability and security will suffer.” message. Reading the support forums it seems that ...
user avatar
  • 901
0 votes
1 answer
266 views

use namespace and cgroups or seccomp to implement online judge?

I'm writting a online judge(support C/C++、GoLang). I want to implement a sandbox by myself. my idea: namespace and cgroups compile user's source code statically run executable file in a complete new ...
user avatar
  • 1
13 votes
1 answer
694 views

How do HTML5 DRM addons protect their output?

HTML5 has a DRM framework Encrypted Media Extensions (EME), that allows DRM companies to create content decryption modules (CDM) to decrypt DRM protected content. Browsers should use a sandbox to run ...
user avatar
  • 3,108
3 votes
0 answers
327 views

Sandboxing untrusted JavaScript execution by redeclaring variables

Some irrelevant background (read only if you want to say "no, just use an iframe") Scenario Suppose that I downloaded a string jsCode containing arbitrary JavaScript code from a (potentially ...
user avatar
  • 131
2 votes
0 answers
234 views

Can a named pipe with a low integrity label have its SACL/DACL modified by a low integrity process?

If a named pipe on Windows has a Low Mandatory Level label and SYSTEM_MANDATORY_LABEL_NO_WRITE_UP in its SACL, but the DACL has WRITE_DAC and WRITE_OWNER for the current user, can a low integrity ...
user avatar
  • 132k
1 vote
2 answers
164 views

Secure browsing on any device without limiting the browser

The company I work for has around 500 endpoints spread across several different locations, I have been tasked with finding a solution to allow for secure browsing in this situation. Employees depend ...
user avatar
2 votes
4 answers
649 views

Testing malware or bad url's from a SIEM

What would be a good approach for testing malware or bad URL's from things picked up from my SIEM to validate them? I was told to set up a VM for these tests but don't want it to hit the internal ...
user avatar
8 votes
1 answer
3k views

Security risks of using ffmpeg as part of web service

I'm working on a web service that uses ffmpeg on the backend for processing user uploaded media files. I'm giving the users some options to customize how their videos are processed, which is ...
user avatar
  • 183
2 votes
1 answer
326 views

sandboxing IoCs and signatures

Sandboxes are used for automated extraction of indicators of compromise (IoCs) that can be used to write signatures. Can this signature then be used, for example, on an IPS system to block certain ...
user avatar
2 votes
1 answer
183 views

How can I block access to module for Firefox? (gmail accessing camera)

I run the following command in the background constantly to check for camera access on Ubuntu Linux: lsmod | grep ^uvcvideo I noticed that every time I load into gmail my check is triggering my ...
user avatar
0 votes
2 answers
300 views

If a host is infected is the sandbox environment infected?

Say my host machine is infected and I have a sandbox program. Will that sandbox environment then be infected also? If the answer is yes, what if I have an AV running inside of the sandbox. Will it ...
user avatar
3 votes
0 answers
121 views

Search function in Outlook and attachements

I am wondering how the search function of Outlook is working, especially in regards to researching key words that are presents in emails attachements. Does the Outlook search function opens the files ...
user avatar
1 vote
0 answers
1k views

Lowering Firefox sandbox settings to enable use of Sandboxie

As discussed on the official forum, to use Firefox 60+ with Sandboxie, Firefox's security.sandbox.content.level needs to be lowered to level 2. Now my concern is that the lowered sandbox content ...
user avatar