Questions tagged [sandbox]

A sandbox is a security mechanism for containing and restricting untrusted programs. Such programs could contain malicious code, which would otherwise harm the user's system.

Filter by
Sorted by
Tagged with
1
vote
3answers
151 views

If we integrate CDR in our email solution, do we really need Sandbox as well?

In the case of social engineering attack vector is an email sent with a malicious attachment like XSL file, I am not really understanding where we will need Sandbox solution if we can just use CDR (...
1
vote
1answer
47 views

Prevent an application from making any network access on macOS

I want to run an application on macOS, but preventing it from making any type of network access, or any type of internet access. I have seen the following possibilities: Use the built-in firewall. ...
1
vote
1answer
49 views

Running virus from real folder in Sandboxie

What if I download a virus to my real folder but only execute it in Sandboxie, is it less secure that if I download it directly from SB?
2
votes
2answers
327 views

Fake output of CPUID instruction

I am trying to analyze a malware in a virtual machine (linux), but it uses the cpuid output to verify if it is in a virtual machine/sandbox, and refuses to run malign code if inside a virtualized ...
2
votes
1answer
116 views

How to securely run Puppeteer / Chromium in a Docker container?

Attempting to run Puppeteer, a Node library to control a headless Chromium (in order to do things like create a PDF of a website), in Docker is a surprisingly fiddly thing. The problem is that, from ...
0
votes
0answers
47 views

Safest way to open PDFs on Android and iOS?

I was checking out Qubes' way of creating safe PDFs, but unless you use Qubes as a daily driver (and use DispVMs to open PDFs) it's still not viable to just use it to create image-based PDFs if you ...
0
votes
1answer
132 views

How to sandbox students' Python 3 code submissions for automatic assignment evaluation on Windows 10?

I am the TA for a coding class in which students will have to write Python 3 scripts to solve programming problems. An assignment consists of several problems, and for each problem the student is ...
1
vote
1answer
83 views

Will this sandbox my user's javascript from my web IDE properly?

I'm working on an IDE that should run a user's JavaScript in the Browser. I don't want to just eval arbitrary code, especially as code may be shared between users. From here and other sources, I ...
1
vote
1answer
185 views

How much protection does sandbox software provide against malicious .exe?

I need to review a large number of .exe game files. I recently had an incident where I got infected by an .exe that passed all my 'checks': virus scan, Virustotal, reviews, community feedback, ...
1
vote
2answers
572 views

Is there a way to safely run untrusted code on a local machine for a videogame

I want to create a simple videogame engine that can run untrusted custom code in order to add functionality to the game. I thought a about using an akka like concurrent actor system, so that the code ...
1
vote
1answer
156 views

Why might malware make a DNS request for an epoch time converter?

I am analyzing malware and I see that two executables when run in a sandbox made DNS requests for www.epochconverter.com Why would an attacker risk detection by making a network request to ...
6
votes
1answer
71 views

Opt-in a security profile at runtime, without tedious setup

I like lowering my access privilege mid-program (e.g. restrict my program to the current directory and files, disable networking). I imagine this is a pretty common wish. I would like to be able to ...
0
votes
1answer
84 views

Is it possible to securely run user defined python code in AWS?

I would like to create an app that accepts users python scripts and executes them as part of its functionality. What I am wondering is if its possible to block I/O, network and other attack vectors so ...
1
vote
0answers
688 views

What “stability and security will suffer” by using a browser with the --no-sandbox flag?

Starting Brave browser (on linux manjaro) shows a “You are using an unsupported command-line flag: --no-sandbox. Stability and security will suffer.” message. Reading the support forums it seems that ...
0
votes
1answer
82 views

use namespace and cgroups or seccomp to implement online judge?

I'm writting a online judge(support C/C++、GoLang). I want to implement a sandbox by myself. my idea: namespace and cgroups compile user's source code statically run executable file in a complete new ...
12
votes
1answer
364 views

How do HTML5 DRM addons protect their output?

HTML5 has a DRM framework Encrypted Media Extensions (EME), that allows DRM companies to create content decryption modules (CDM) to decrypt DRM protected content. Browsers should use a sandbox to run ...
2
votes
0answers
131 views

Sandboxing untrusted JavaScript execution by redeclaring variables

Some irrelevant background (read only if you want to say "no, just use an iframe") Scenario Suppose that I downloaded a string jsCode containing arbitrary JavaScript code from a (potentially ...
2
votes
0answers
112 views

Can a named pipe with a low integrity label have its SACL/DACL modified by a low integrity process?

If a named pipe on Windows has a Low Mandatory Level label and SYSTEM_MANDATORY_LABEL_NO_WRITE_UP in its SACL, but the DACL has WRITE_DAC and WRITE_OWNER for the current user, can a low integrity ...
1
vote
2answers
106 views

Secure browsing on any device without limiting the browser

The company I work for has around 500 endpoints spread across several different locations, I have been tasked with finding a solution to allow for secure browsing in this situation. Employees depend ...
0
votes
0answers
128 views

Is MISP enhancing the accuary of Cuckoo Sandboxs score and raised signatures of an analysis?

My current setup of Cuckoo is that Cuckoo is scanning attachments of emails in an automated way using PeekabooAV. Based on the score of the analysis that Cuckoo gave and the raised signatures the ...
7
votes
1answer
671 views

Security risks of using ffmpeg as part of web service

I'm working on a web service that uses ffmpeg on the backend for processing user uploaded media files. I'm giving the users some options to customize how their videos are processed, which is ...
2
votes
1answer
120 views

sandboxing IoCs and signatures

Sandboxes are used for automated extraction of indicators of compromise (IoCs) that can be used to write signatures. Can this signature then be used, for example, on an IPS system to block certain ...
2
votes
1answer
111 views

How can I block access to module for Firefox? (gmail accessing camera)

I run the following command in the background constantly to check for camera access on Ubuntu Linux: lsmod | grep ^uvcvideo I noticed that every time I load into gmail my check is triggering my ...
0
votes
2answers
149 views

If a host is infected is the sandbox environment infected?

Say my host machine is infected and I have a sandbox program. Will that sandbox environment then be infected also? If the answer is yes, what if I have an AV running inside of the sandbox. Will it ...
3
votes
0answers
83 views

Search function in Outlook and attachements

I am wondering how the search function of Outlook is working, especially in regards to researching key words that are presents in emails attachements. Does the Outlook search function opens the files ...
1
vote
0answers
595 views

Lowering Firefox sandbox settings to enable use of Sandboxie

As discussed on the official forum, to use Firefox 60+ with Sandboxie, Firefox's security.sandbox.content.level needs to be lowered to level 2. Now my concern is that the lowered sandbox content ...
1
vote
1answer
2k views

Comparison between Firejail and Apparmor

I'd like to understand how Apparmor and Firejail compare to each other: advantages, pros and cons, purposes, similarities, etc. I might be asking to compare apples with oranges, however I've noticed ...
1
vote
4answers
3k views

How can I sandbox a Wine application on Linux?

I would like to run Microsoft Office programs such as Word but do not trust them, nor should anyone. Without running a virtual machine, is there a good way to sandbox a windows application to run on ...
0
votes
1answer
102 views

What would be reasonable approach for sandboxing new project to be protected against security holes made by chance?

As a regular developer I'm curious about looking at new projects. Let's say today I want to contribute to open source project in Python. This project is on GitHub and I a kind of confident in people ...
2
votes
1answer
499 views

Is there something similar to Firejail for OpenBSD?

On Linux, Firejail (https://firejail.wordpress.com/) offers an easy way to sandbox web browsers and other programs. Is there an easy way to sandbox a web browser on OpenBSD ? (reserve question: is ...
1
vote
0answers
52 views

Java Sandbox Model: ist the ClassLoader sufficient?

I am creating a web application that runs untrusted code written by the user in Java. Of course the code is not supposed to have access to anything I don't want it to, so I wanted to implement the ...
8
votes
2answers
1k views

What's safest way to run WhatsApp? [closed]

For work I have to use WhatsApp. I agree with EFFs concerns about WhatsApp and personal data (harvesting it and shoveling it into Facebook), and perhaps even its security. I thought it would be ...
2
votes
2answers
230 views

Integrate antivirus with a sandbox

When reading the Difference between antivirus and sandbox?, I came up with the idea of how to integrate a sandbox with AV. When the sandbox analyzes the sample and finds that the malware, antivirus ...
3
votes
1answer
5k views

What is the easiest way to sandbox an application in a *NIX environment?

I have a significant number of untrusted binary applications that need to be executed on a *nix box. I'm hoping that there might be some simple command/script (e.g. sandbox ./app1953) that could ...
1
vote
1answer
367 views

What is the point of escaping an interpreter's sandbox?

Assuming that the attacker already has code execution (which is the case of every interpreter sandbox escape exploit I know of), couldn't he just use a function/method (like Runtime.getRuntime().exec()...
3
votes
1answer
433 views

Meltdown and Spectre regarding Firewalls and Sandboxing [duplicate]

I don't deeply understand Meltdown and Spectre -- all I know is that they are basically keylogging-like vulnerabilities within the CPU, which bypass any application layer stuff; correct me if I'm ...
0
votes
1answer
55 views

How do you handle untrusted software installation / runtime?

If you need to install software from a third party and frequently run it on your PC, but you do not trust the software, although antivirus doesn't rise any flags: Is it possible to install software ...
1
vote
1answer
93 views

Is it secure to keep malware in filesystem of VMs?

We are going to install a sandbox solution that requires Ubuntu Server as the underlying OS (the product is not shipped as a ready to install appliance). For performance reasons the malware samples ...
2
votes
0answers
65 views

What potential security issues running sandboxd as root?

I have noticed that MacOS is running its sandbox process under the root user. This implies that any sandboxed process, assuming that it can escape the sandbox, would then have root privileges. Am I ...
1
vote
2answers
231 views

How does a sandbox module know the difference between trusted and untrusted code

What criteria does a sandbox use to determine whether executing code (registry read/write) can be trusted or not ?
1
vote
1answer
1k views

Can hackers compromise a VM to the point that they compromise your host OS? [duplicate]

Recently I was reading up on various security strategies and one that has been around for a while but is starting to gain traction now is working within a VM on your desired OS. If that VM ever gets ...
1
vote
0answers
59 views

Can the Android OS prevent the API calls to system services from being fooled?

Android Application Framework provides a whole bunch of system services, such as PackageManagerService, ActivityManagerSerive. Most of the services are in the System Server process. The framework also ...
1
vote
1answer
422 views

Why do some ransomware executables run on VirtualBox? [closed]

Even though they appears to have anti-VM capabilities? I've downloaded some latest samples of ransomware executables from cerber, locky, and other family of ransomware Why do they still execute in ...
12
votes
2answers
1k views

Malware sandbox detection

I started some reverse engineering exercises using Ollydbg, IDA Pro and other tools like Sysinternals suite, etc. Some of these exercises are about malware. I downloaded some different malware from ...
18
votes
4answers
5k views

How is Sandboxing implemented?

What I would like to know is two fold: First off, what is sandboxing? Is it the trapping of OS system calls and then secondly deciding whether to allow it to pass through or not? How is it implemented ...
0
votes
1answer
100 views

How does Thunderbird quarantine downloaded emails? Is it dangerous to download emails and store them offline?

There shouldn't be a high security risk as long as the email attachments aren't opened / executed by the user but it could still be a risk and maybe I'm wrong. So how does Thunderbird quarantine ...
1
vote
1answer
1k views

What is the differerence between virtualization and sandboxing

Is virtualization basically "easier" sandboxing ? Where the system calls are intercepted and rules are set out whether to allow the system call to go through or not. I believe system calls are traced ...
1
vote
1answer
552 views

How to sandbox Firefox ESR for normal browsing?

I'm running Debian 9.1 with KDE and for security purposes I'd like to run Firefox ESR in a sandboxed mode. However I'd still like to use many normal Firefox features for my normal browsing, download ...
1
vote
1answer
111 views

Job applicants submit code, how do companies securely test it?

Applicants for software engineering jobs sometimes go through coding challenges as part of the interview process. The company may send applicants code and a development task with a deadline, and ...
1
vote
2answers
678 views

How to test the security of a hardened Web Browser?

I want to actually test the security of a sandboxed and hardened web browser after I implemented 3rd party security tools that claim to harden the browser. So how can I or what approach should I ...