Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Hot answers tagged

133 votes
Accepted

If malware does not run in a VM why not make everything a VM?

One has to take into account why the malware is doing this distinction in the first place. Some malware does not run in the VM because the chance is high that this VM is used for inspecting the ...
user avatar
59 votes

Why is it considered safe to install something as a non-root user in Linux environments?

We always hear... Do we? I don't. Installing some untrusted program as a normal user is a bad idea with Linux the same it is with Windows or Mac: this program has access to all your data and can ...
user avatar
58 votes

How is Sandboxing implemented?

Well this answer ended up fairly long, but sandboxing is a huge topic. At its most basic, sandboxing is a technique to minimize the effect a program will have on the rest of the systems in the case of ...
user avatar
  • 64k
43 votes
Accepted

Docker as a sandbox for untrusted code

tl;dr: container solutions do not and never will do guarantee to provide complete isolation, use virtualization instead if you require this. Bottom up and top down approaches Docker (and the same ...
user avatar
  • 23.1k
36 votes
Accepted

Why is it considered safe to install something as a non-root user in Linux environments?

In short: yes, being on a low-privilege account helps protect you against malware, but does not make you immune. Like any security measure, no single thing is going to keep you 100% safe. TL;DR: ...
user avatar
24 votes

Reading physical memory frame previously owned by another process to read contents of its memory page

I was curious of this myself once, and wrote a small program under linux that malloc'ed all available memory and dumped it to disk. It turned out that it was all zeroed out before it was handed to my ...
user avatar
23 votes

Reading physical memory frame previously owned by another process to read contents of its memory page

In Linux, processes is able to read another process memory when any of the following conditions applies: The process had root permission or it can read /proc/$PID/mem or /dev/mem, by default /proc/$...
user avatar
  • 31k
17 votes

The Perfect Mousetrap - Can a sandbox system be designed such that it's identical to an actual computer?

Yes, it can be done as (theoretically) every "computing device" is computationally equivalent to every other computing device. Look up the Church-Turing thesis if you are interested. However your ...
user avatar
  • 1,921
15 votes

Docker as a sandbox for untrusted code

Whilst the answer from @jens-erat has the correct high-level point that virtualization provides superior isolation to containerization solutions like docker, it is not a black and white setup. On the ...
user avatar
  • 60.7k
12 votes
Accepted

Same-origin policy for desktop application?

It seems to me you're discussing two things: sandboxing on the desktop and then strategies for user content access in sandboxed applications. Sandboxing There are many sandboxing models out there, ...
user avatar
10 votes

Does Android have sufficient app sandboxing?

Each version of Android is incrementally stronger on this front than the previous, and Lolipop certainly pushes application sandboxing a step further than Kitkat, particularly with respect to inter-...
user avatar
  • 81.9k
9 votes

Reading physical memory frame previously owned by another process to read contents of its memory page

The attack you describe doesn't work on Windows. Starving the page-zeroing thread doesn't prevent zeroing, it only delays it. The existence of the page-zeroing background task is a performance ...
user avatar
  • 750
9 votes

Why is it considered safe to install something as a non-root user in Linux environments?

This is a horrible case of Security Theater Security Theater is the practice or belief of something that looks like it improves security, but in reality does little/harm to it. This false belief has ...
user avatar
9 votes
Accepted

Malware sandbox detection

Start with this guide -- https://github.com/hfiref0x/VBoxHardenedLoader -- it's incredibly up-to date in terms of making a VirtualBox guest VM more-difficult to detect, including techniques valid in ...
user avatar
  • 18.9k
9 votes
Accepted

Security risks of using ffmpeg as part of web service

Yes there are security risks, especially if you allow arbitrary formats. FFmpeg supports a huge variety of formats, both popular and obscure, for video, audio, and images. Any vulnerability in ...
user avatar
  • 64k
8 votes
Accepted

How secure is "Browser in the Box"?

From their product page, we can infer a lot about how their system works. Here are the key points: Can be used with Windows XP and Windows 7 Comes with: VirtualBox 4.0.16, hardened Linux ...
user avatar
8 votes

If malware does not run in a VM why not make everything a VM?

In fact, something similar is being practiced. First of all, note the following: Not all malware check for VMs, and there are other common criteria for not running such as research or monitoring ...
user avatar
  • 583
7 votes

Best method to sandbox X applications in ubuntu

You can use subuser to sandbox an application using Docker. Say you wanted to sandbox Firefox: You would create a folder my-subuser-images and then create a second folder firefox in the first one: ...
user avatar
7 votes
Accepted

What are ways I can analyze malware in an infected machine, not just clean it?

Malware analysis should be done in a VM preferably disconnected from the Internet. This is mainly to protect your system, and stop it from spreading (if the malware has that capability). You can ...
user avatar
  • 12.3k
7 votes

The Perfect Mousetrap - Can a sandbox system be designed such that it's identical to an actual computer?

Actually lorenzo's answer does not quite cut it. The Church-Turing thesis only provides us with a model of computing, it can't tell us anything about virtualization because it is not concerned with ...
user avatar
7 votes
Accepted

Can someone read a iOS class variable from outside the app?

Yes, it is possible to read iOS class variables from outside of an app. Depending on your perspective and proclivity towards jailed or jailbroken devices, you may find a few ways to read them at ...
user avatar
  • 18.9k
7 votes

Comparison between Firejail and Apparmor

AppArmor could be closer compared to SELinux than FireJail, but here's the differences. The most important (IMO) is the level at which they run. FireJail runs as a program in userspace while ...
user avatar
  • 5,090
6 votes
Accepted

Information Transfer Between Browsers and Tabs

Hard to answer because we can have a lot of horizons here. Short answer: I will use your bank as an example. Let's say you open a new tab and enter on your-bank.com. If your bank has not ...
user avatar
  • 1,316
6 votes

What does "sandboxing" mean for Chrome OS?

A sandbox is like a special "section" of your computer that has been blocked off from accessing the rest of your computer. In a perfect sandbox you can do anything you want within it, but it will not ...
user avatar
  • 162
6 votes
Accepted

Is it secure to keep malware in filesystem of VMs?

The medium malware is stored on is irrelevant. Malware is just data, and data can only cause harm if something interprets it. This can mean anything from directly executing a malicious file to opening ...
user avatar
  • 64k
6 votes
Accepted

Why aren't Microsoft Office macros sandboxed?

Microsoft Office macros are a design of the past. Do note that they were designed back in the days when a userland program could overwrite memory of another application (or even the kernel!), ...
user avatar
  • 17.4k
5 votes

Does Android have sufficient app sandboxing?

Does Android KitKat and later have sufficient default sandboxing to prevent malware from doing any harm How long is a piece of string? Ensuring confidentiality isn't the only goal of information ...
user avatar
  • 8,424
5 votes

Security concerns with user Python scripts

To approach this problem from a different angle, how about creating a domain specific language? Why give the users the ability to do a plethora of things you don't want them to be able to do, and ...
user avatar
  • 249

Only top scored, non community-wiki answers of a minimum length are eligible