4 ms·

Can any of you recommend a way to create a sandbox that can seal off processes within a computer? One option is to use a VPC on a cloud-hosted machine to acces

Can any of you recommend a way to create a sandbox that can seal off processes within a computer? One option is to use a VPC on a cloud-hosted machine to access whatever emails, links, websites someone sends you, but this can be time-consuming and costs money. This article claims that Docker would also not be a good solution: https://security.stackexchange.com/questions/107850/docker-as-a-sandbox-for-untrusted-code https://security.stackexchange.com/questions/107850/docker-a... "...container solutions do not and never will do guarantee to provide complete isolation, use virtualization instead if you require this." So is there any other way to create a sealed off sandbox on your own machine that would create a type of moat between your machine and your adversary?

newsoul2019 7y ago
That's what Java applets were supposed to be originally, they were supposed to run in a sandbox....
- hyperpape 7y ago
  Not all sandboxes are created equal. Modern browsers have much better sandboxes than Java ever has had. OS level virtualization is even better.
  - newsoul2019 7y ago
    If you read something like this [1], dated 1999, it seems like they had the right ideas. I guess it went wrong in the actual implementations. [1] http://www.securingjava.com/chapter-two/chapter-two-2.html http://www.securingjava.com/chapter-two/chapter-two-2.html
    - hyperpape 7y ago
      By total coincidence, I was reading about Java sandbox exploits just a few days ago: http://phrack.org/papers/escaping_the_java_sandbox.html http://phrack.org/papers/escaping_the_java_sandbox.html. It feels to me (not a security guy!) like there was something fundamentally too complex here. I wonder if part of the problem is that unlike the browser, there's no natural boundary. JavaScript is was originally built to live in a small self-contained world with specific access to the outside. Java was built with features for writing applications that could touch the filesystem, redefine classes, and everything else. It was also supposed to make everything safe, but that led to complex checks everywhere to try to distinguish privileged from unprivileged code.
sudo_groot 7y ago
If you are interested you should check out Qubes OS: https://www.qubes-os.org/ https://www.qubes-os.org/ It uses xen hypervisor to then launch separate VMs for your different applications. Not an OS for everyone but I have been running it for some time and have had a good experience with it.
hyperpape 7y ago
I believe this is the idea behind Qubes OS. Any virtualization system (virtualbox or whatnot) should give you some protection, at the cost of some convenience. Running with javascript disabled except on a small set of sites will also help protect against many attacks.
noir-york 7y ago
I had written a jail for Windows a long long time ago - it was inspired by Unix's jail. For an app you could configure what filesystem and registry access was allowed and you could redirect FS access. Implemented it as a kernel driver that hooked into the relevant system calls. It was easier to do kernel dev back then (we are talking mid 2000's) - i havent touched windows kernel coding in years. I wonder if Microsoft has implemented a jail for processes in recent versions of windows. Running browsers in a VM can be cumbersome.
- jakejarvis 7y ago
  Agreed about VMs in everyday use, and I'm wondering if the new Windows 10 Pro/Enterprise sandboxes would be a sufficiently safe alternative in these scenarios. After skimming this white paper it seems like they would, but I'm no expert in this area: https://techcommunity.microsoft.com/t5/Windows-Kernel-Internals/Windows-Sandbox/ba-p/301849 https://techcommunity.microsoft.com/t5/Windows-Kernel-Intern...
gnufx 7y ago
On Linux-based systems, Firejail [1] is designed specifically for that (originally for Firefox?). However, it's had quite a few CVEs of its own, and I don't know how effective it is in practice protecting against 0-day-type problems.
deleted 7y ago
[deleted]

newsoul2019 7y ago

That's what Java applets were supposed to be originally, they were supposed to run in a sandbox....

hyperpape 7y ago
Not all sandboxes are created equal. Modern browsers have much better sandboxes than Java ever has had. OS level virtualization is even better.
- newsoul2019 7y ago
  If you read something like this [1], dated 1999, it seems like they had the right ideas. I guess it went wrong in the actual implementations. [1] http://www.securingjava.com/chapter-two/chapter-two-2.html http://www.securingjava.com/chapter-two/chapter-two-2.html
  - hyperpape 7y ago
    By total coincidence, I was reading about Java sandbox exploits just a few days ago: http://phrack.org/papers/escaping_the_java_sandbox.html http://phrack.org/papers/escaping_the_java_sandbox.html. It feels to me (not a security guy!) like there was something fundamentally too complex here. I wonder if part of the problem is that unlike the browser, there's no natural boundary. JavaScript is was originally built to live in a small self-contained world with specific access to the outside. Java was built with features for writing applications that could touch the filesystem, redefine classes, and everything else. It was also supposed to make everything safe, but that led to complex checks everywhere to try to distinguish privileged from unprivileged code.

sudo_groot 7y ago

If you are interested you should check out Qubes OS: https://www.qubes-os.org/ https://www.qubes-os.org/ It uses xen hypervisor to then launch separate VMs for your different applications. Not an OS for everyone but I have been running it for some time and have had a good experience with it.

hyperpape 7y ago

I believe this is the idea behind Qubes OS. Any virtualization system (virtualbox or whatnot) should give you some protection, at the cost of some convenience. Running with javascript disabled except on a small set of sites will also help protect against many attacks.

noir-york 7y ago

I had written a jail for Windows a long long time ago - it was inspired by Unix's jail. For an app you could configure what filesystem and registry access was allowed and you could redirect FS access. Implemented it as a kernel driver that hooked into the relevant system calls. It was easier to do kernel dev back then (we are talking mid 2000's) - i havent touched windows kernel coding in years. I wonder if Microsoft has implemented a jail for processes in recent versions of windows. Running browsers in a VM can be cumbersome.

jakejarvis 7y ago
Agreed about VMs in everyday use, and I'm wondering if the new Windows 10 Pro/Enterprise sandboxes would be a sufficiently safe alternative in these scenarios. After skimming this white paper it seems like they would, but I'm no expert in this area: https://techcommunity.microsoft.com/t5/Windows-Kernel-Internals/Windows-Sandbox/ba-p/301849 https://techcommunity.microsoft.com/t5/Windows-Kernel-Intern...

gnufx 7y ago

On Linux-based systems, Firejail [1] is designed specifically for that (originally for Firefox?). However, it's had quite a few CVEs of its own, and I don't know how effective it is in practice protecting against 0-day-type problems.

deleted 7y ago

[deleted]