Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [sandbox]

A sandbox is a security mechanism for containing and restricting untrusted programs. Such programs could contain malicious code, which would otherwise harm the user's system.

1
vote
2answers
50 views

Secure browsing on any device without limiting the browser

The company I work for has around 500 endpoints spread across several different locations, I have been tasked with finding a solution to allow for secure browsing in this situation. Employees depend ...
0
votes
0answers
18 views

Extension language that is sandboxed by design and by default [closed]

I have a GUI app I wrote for which I've just implemented a very basic mechanism for user-defined extensions written in Guile, a dialect of lisp. I've been studying how to keep this from being a vector ...
0
votes
0answers
21 views

Is MISP enhancing the accuary of Cuckoo Sandboxs score and raised signatures of an analysis?

My current setup of Cuckoo is that Cuckoo is scanning attachments of emails in an automated way using PeekabooAV. Based on the score of the analysis that Cuckoo gave and the raised signatures the ...
7
votes
1answer
229 views

Security risks of using ffmpeg as part of web service

I'm working on a web service that uses ffmpeg on the backend for processing user uploaded media files. I'm giving the users some options to customize how their videos are processed, which is ...
1
vote
0answers
37 views

sandboxing IoCs and signatures

Sandboxes are used for automated extraction of indicators of compromise (IoCs) that can be used to write signatures. Can this signature then be used, for example, on an IPS system to block certain ...
2
votes
1answer
60 views

How can I block access to module for Firefox? (gmail accessing camera)

I run the following command in the background constantly to check for camera access on Ubuntu Linux: lsmod | grep ^uvcvideo I noticed that every time I load into gmail my check is triggering my ...
0
votes
2answers
66 views

If a host is infected is the sandbox environment infected?

Say my host machine is infected and I have a sandbox program. Will that sandbox environment then be infected also? If the answer is yes, what if I have an AV running inside of the sandbox. Will it ...
2
votes
0answers
40 views

Search function in Outlook and attachements

I am wondering how the search function of Outlook is working, especially in regards to researching key words that are presents in emails attachements. Does the Outlook search function opens the files ...
1
vote
0answers
117 views

Lowering Firefox sandbox settings to enable use of Sandboxie

As discussed on the official forum, to use Firefox 60+ with Sandboxie, Firefox's security.sandbox.content.level needs to be lowered to level 2. Now my concern is that the lowered sandbox content ...
1
vote
1answer
330 views

Comparison between Firejail and Apparmor

I'd like to understand how Apparmor and Firejail compare to each other: advantages, pros and cons, purposes, similarities, etc. I might be asking to compare apples with oranges, however I've noticed ...
1
vote
4answers
1k views

How can I sandbox a Wine application on Linux?

I would like to run Microsoft Office programs such as Word but do not trust them, nor should anyone. Without running a virtual machine, is there a good way to sandbox a windows application to run on ...
0
votes
1answer
38 views

What would be reasonable approach for sandboxing new project to be protected against security holes made by chance?

As a regular developer I'm curious about looking at new projects. Let's say today I want to contribute to open source project in Python. This project is on GitHub and I a kind of confident in people ...
3
votes
1answer
212 views

Is there something similar to Firejail for OpenBSD?

On Linux, Firejail (https://firejail.wordpress.com/) offers an easy way to sandbox web browsers and other programs. Is there an easy way to sandbox a web browser on OpenBSD ? (reserve question: is ...
1
vote
0answers
35 views

Java Sandbox Model: ist the ClassLoader sufficient?

I am creating a web application that runs untrusted code written by the user in Java. Of course the code is not supposed to have access to anything I don't want it to, so I wanted to implement the ...
0
votes
0answers
36 views

More firejail questions about Linux netns

I am running firejail to sandbox the Firefox process ( still unsuccessfully ), and it uses a Linux netns to set up an interface. The sandboxed interface works, tcpdump shows the traffic, but I cannot ...
8
votes
2answers
921 views

What's safest way to run WhatsApp? [closed]

For work I have to use WhatsApp. I agree with EFFs concerns about WhatsApp and personal data (harvesting it and shoveling it into Facebook), and perhaps even its security. I thought it would be ...
2
votes
2answers
146 views

Integrate antivirus with a sandbox

When reading the Difference between antivirus and sandbox?, I came up with the idea of how to integrate a sandbox with AV. When the sandbox analyzes the sample and finds that the malware, antivirus ...
2
votes
1answer
330 views

What is the easiest way to sandbox an application in a *NIX environment?

I have a significant number of untrusted binary applications that need to be executed on a *nix box. I'm hoping that there might be some simple command/script (e.g. sandbox ./app1953) that could ...
1
vote
1answer
159 views

What is the point of escaping an interpreter's sandbox?

Assuming that the attacker already has code execution (which is the case of every interpreter sandbox escape exploit I know of), couldn't he just use a function/method (like Runtime.getRuntime().exec()...
3
votes
1answer
283 views

Meltdown and Spectre regarding Firewalls and Sandboxing [duplicate]

I don't deeply understand Meltdown and Spectre -- all I know is that they are basically keylogging-like vulnerabilities within the CPU, which bypass any application layer stuff; correct me if I'm ...
0
votes
1answer
49 views

How do you handle untrusted software installation / runtime?

If you need to install software from a third party and frequently run it on your PC, but you do not trust the software, although antivirus doesn't rise any flags: Is it possible to install software ...
1
vote
1answer
85 views

Is it secure to keep malware in filesystem of VMs?

We are going to install a sandbox solution that requires Ubuntu Server as the underlying OS (the product is not shipped as a ready to install appliance). For performance reasons the malware samples ...
0
votes
0answers
124 views

Differences between a full scale sandbox and a portable sandbox?

I'm trying to learn the key differences between a sandbox used for malware analysis and a portable sandbox used by companies like Sandboxie, Crowdstrike Falcon. Are we talking about the same ...
2
votes
0answers
37 views

What potential security issues running sandboxd as root?

I have noticed that MacOS is running its sandbox process under the root user. This implies that any sandboxed process, assuming that it can escape the sandbox, would then have root privileges. Am I ...
-1
votes
0answers
50 views

What would be the best method to intercept process creation - Sandbox Design for Windows

I've been researching designing a sandbox for Windows that sandboxes web-browsers and smtp-pop programs. It's understood that these sort of programs cannot be trusted because of the potential they ...
1
vote
2answers
185 views

How does a sandbox module know the difference between trusted and untrusted code

What criteria does a sandbox use to determine whether executing code (registry read/write) can be trusted or not ?
0
votes
1answer
566 views

Can hackers compromise a VM to the point that they compromise your host OS? [duplicate]

Recently I was reading up on various security strategies and one that has been around for a while but is starting to gain traction now is working within a VM on your desired OS. If that VM ever gets ...
1
vote
0answers
49 views

Can the Android OS prevent the API calls to system services from being fooled?

Android Application Framework provides a whole bunch of system services, such as PackageManagerService, ActivityManagerSerive. Most of the services are in the System Server process. The framework also ...
1
vote
1answer
243 views

Why do some ransomware executables run on VirtualBox? [closed]

Even though they appears to have anti-VM capabilities? I've downloaded some latest samples of ransomware executables from cerber, locky, and other family of ransomware Why do they still execute in ...
12
votes
2answers
945 views

Malware sandbox detection

I started some reverse engineering exercises using Ollydbg, IDA Pro and other tools like Sysinternals suite, etc. Some of these exercises are about malware. I downloaded some different malware from ...
14
votes
4answers
2k views

How is Sandboxing implemented?

What I would like to know is two fold: First off, what is sandboxing? Is it the trapping of OS system calls and then secondly deciding whether to allow it to pass through or not? How is it implemented ...
0
votes
1answer
85 views

How does Thunderbird quarantine downloaded emails? Is it dangerous to download emails and store them offline?

There shouldn't be a high security risk as long as the email attachments aren't opened / executed by the user but it could still be a risk and maybe I'm wrong. So how does Thunderbird quarantine ...
1
vote
1answer
607 views

What is the differerence between virtualization and sandboxing

Is virtualization basically "easier" sandboxing ? Where the system calls are intercepted and rules are set out whether to allow the system call to go through or not. I believe system calls are traced ...
1
vote
1answer
423 views

How to sandbox Firefox ESR for normal browsing?

I'm running Debian 9.1 with KDE and for security purposes I'd like to run Firefox ESR in a sandboxed mode. However I'd still like to use many normal Firefox features for my normal browsing, download ...
1
vote
1answer
104 views

Job applicants submit code, how do companies securely test it?

Applicants for software engineering jobs sometimes go through coding challenges as part of the interview process. The company may send applicants code and a development task with a deadline, and ...
1
vote
2answers
483 views

How to test the security of a hardened Web Browser?

I want to actually test the security of a sandboxed and hardened web browser after I implemented 3rd party security tools that claim to harden the browser. So how can I or what approach should I ...
3
votes
1answer
175 views

Windows 10's (Windows Defender Application guard) VS Browser Sandboxing

Microsoft has introduced a new feature called "Windows Defender Application Guard" The video from Microsoft explained that (WDAG) allows the user to isolate the code running within one page in what ...
2
votes
1answer
371 views

Sandbox for attachment accessment

I am currently trying to review an e-mail sent to myself, that could be malicious, or it could not. I would like to create a sandbox environment to review this kind of message (it's more than likely ...
2
votes
1answer
1k views

Running Firefox from inside a Docker container

Will I increase my security level by running Firefox from inside a Docker container (XUbuntu) under a non root user? Does it make sense to do so to protect against different kind of malware & ...
3
votes
1answer
124 views

Ctf creation sandboxed question

I have a tiny question, we are creating a ctf but we stumbled upoun a idea that we don't know how to solve. As several websites that create ctf's as hack.me use sandboxes. Due to the security and ...
3
votes
1answer
128 views

What OS should I use for sandboxing/running viruses designed for IoT devices?

I have a telnet and ssh honeypot (more specifically, cowrie). Most viruses I get there are designed for routers, cameras, etc... The virtualization software I am using is VirtualBox, and I am using ...
3
votes
5answers
531 views

Designing a sandbox or how to “perfectly” isolate an app?

I have been thinking on how an app could be "perfectly" isolated from the rest of the system. Now I know we will never achieve "perfect" in practice, but in theory, how could one go about it? I put ...
4
votes
0answers
149 views

Doing builds in a sandbox

I'm keen to start allowing people to build Electron apps on my cloud infrastructure. On Linux the security I'm employing is with throwaway Docker containers. I know it's not 100% secure but it's ...
6
votes
1answer
156 views

VM vs System Call Interposition vs Software Fault Isolation

I have an exe file that I don't trust (maybe its infected with malware). I know that running it in a VM will isolate the exe file from my system, but what about using mechanisms such as System Call ...
1
vote
1answer
742 views

In Kali Linux, how can I open files in a safe manner without disconnecting internet?

I downloaded a few documents over Tor as of late. I am mindful of the issues which I can confront when I open a document downloaded through Tor in an online machine. I want to know how to open these ...
1
vote
0answers
158 views

Browser custom protocol handlers

The possibility of running a shell command from an extension (NPAPI) has been phased out, but custom protocol handlers are still supported. What is the practical difference if an extension can still ...
1
vote
1answer
65 views

Encrypt/Isolate files of the Software

We want to create a secure email client based on Thunderbird source code and looking for a method to encrypt files or to isolate files from being stolen by some malware. and to avoid infecting pc via ...
0
votes
2answers
72 views

How to mimick malicious activity in a network?

I'm trying to setup a VM that will try to mimick malicious web browsing behavior. It should download malware and just get infected. There are a lot of open source threat intel feeds with bad IPs ...
0
votes
1answer
667 views

Should I sandbox web application?

Let's say that I'm building a web application that I will host on my server. Should I sandbox it in order to protect my server? Note I just learned that there might be more to sandboxing your web ...
2
votes
1answer
418 views

How can youtube track user in sandbox?

I used Chrome in Sandboxie, and even after deleted contents of the sandbox, youtube.com still recommended videos for me, which based on vids I saw. Only after I deleted all history in Chrome then ...