5 ms·

Maybe just to mention you an open-source, windows based countermeasure against ransomeware (and all other software that has tendency to trash its garbage all ov

by stiray 4y ago

Maybe just to mention you an open-source, windows based countermeasure against ransomeware (and all other software that has tendency to trash its garbage all over the system disk). It should be widely known but unfortunately it isnt: https://sandboxie-plus.com/ https://sandboxie-plus.com/ You declare a sandbox and run program there (by default or context menu) and all the changes, including registry will be done as "copy-on-write" into sandboxie folder. Even uninstalling complex software like adobe photoshop is just deleting that folder. Here someone is teasing but running wannacry in a sandboxie: https://www.youtube.com/watch?v=bg5GaEVEYlE https://www.youtube.com/watch?v=bg5GaEVEYlE What ransonware will do in this case, it will open a file, but all the writes are going to be done within sandboxie directory leaving original files intact.

Kuinox 4y ago
On windows pro/education/enterprise there is windows sandbox, available almost out of the box: https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview https://learn.microsoft.com/en-us/windows/security/threat-pr...
- stiray 4y ago
  It is on completely different level, sandboxie doesnt use virtualization and is achieving its goal using API hooking. This means practically zero overhead.
  - devwastaken 4y ago
    Virtualization is almost zero overhead in modern day, and is safer. Breaking out of sandboxes has many more areas of exploitation.
  - xnyan 4y ago
    Windows sandbox overhead is quite low. I've played several games using it and the performance hit is in the low single digits, typically 2-5% in my experience. It's complicated but IMO virtualization seems to have less opportunities to fail vs a sandbox in terms of isolation.
nyanpasu64 4y ago
My concern is that Sandboxie won't stop malware from stealing files, browser cookies, sessions, and opening a browser and puppeting it to steal your bank accounts.
- stiray 4y ago
  For this it would be nice if Outpost Firewall would be still there. The application firewalls are becoming less and less configurable =/ Anyway: https://sandboxie-website-archive.github.io/www.sandboxie.com/RestrictionsSettings.html https://sandboxie-website-archive.github.io/www.sandboxie.co... (old site before it was bought and later released into open source)
  - out-of-ideas 4y ago
    I have been trying to find the name of this software (Outpost Firewall) on-and-off for a year; wondered what happened to it... sad that it is gone. Any good alternatives (I was never a fan of the Zone Alarm one)? Edit: specified Outpost

by stiray 4y ago

Kuinox 4y ago

On windows pro/education/enterprise there is windows sandbox, available almost out of the box: https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview https://learn.microsoft.com/en-us/windows/security/threat-pr...

stiray 4y ago
It is on completely different level, sandboxie doesnt use virtualization and is achieving its goal using API hooking. This means practically zero overhead.
- devwastaken 4y ago
  Virtualization is almost zero overhead in modern day, and is safer. Breaking out of sandboxes has many more areas of exploitation.
- xnyan 4y ago
  Windows sandbox overhead is quite low. I've played several games using it and the performance hit is in the low single digits, typically 2-5% in my experience. It's complicated but IMO virtualization seems to have less opportunities to fail vs a sandbox in terms of isolation.

nyanpasu64 4y ago

My concern is that Sandboxie won't stop malware from stealing files, browser cookies, sessions, and opening a browser and puppeting it to steal your bank accounts.

stiray 4y ago
For this it would be nice if Outpost Firewall would be still there. The application firewalls are becoming less and less configurable =/ Anyway: https://sandboxie-website-archive.github.io/www.sandboxie.com/RestrictionsSettings.html https://sandboxie-website-archive.github.io/www.sandboxie.co... (old site before it was bought and later released into open source)
- out-of-ideas 4y ago
  I have been trying to find the name of this software (Outpost Firewall) on-and-off for a year; wondered what happened to it... sad that it is gone. Any good alternatives (I was never a fan of the Zone Alarm one)? Edit: specified Outpost